Privacy Policy
Last updated
This policy explains what personal data LBREEZE LIMITED collects, why we collect it, what we do with it, how long we keep it, and what rights you have. It covers our website, our customer portal, and the hosting, domain, certificate and software services we sell.
1. Who is responsible for your data
LBREEZE LIMITED is the controller of the personal data described in this policy. We are registered in England and Wales under company number 15422629, with our registered office at 83 Second Avenue, London E12 6EN, United Kingdom.
Our registration with the Information Commissioner's Office is ZB693451.
For anything to do with your personal data, write to privacy@lbreeze.com or to the postal address above marked for the attention of the Data Protection Lead. We have not appointed a statutory Data Protection Officer, because our processing does not meet the thresholds in Article 37 of the UK GDPR.
There is an important boundary in this policy. We are the controller for data about you as our customer: your account, your billing, your support conversations. We are not the controller for personal data that you put inside your own virtual machines, containers or self-hosted applications. For that data you are the controller and we act as your processor, on the terms in our Data Processing Addendum. We do not decide what you store there, we do not use it for our own purposes, and we do not access it except as that Addendum permits.
2. The personal data we collect
Account and identity data. Your name, the name of your business, your postal address, email address, telephone number, and where you are a business customer your company registration and VAT numbers. We collect this when you register and whenever you update it.
Billing and payment data. Invoices, payments, credits, refunds, the billing address you give us, the last four digits and expiry of a payment card, and the payment processor's token for that card. We do not receive or store full card numbers or security codes; those go directly to our payment processor.
Technical and usage data. IP addresses, browser and device information, the pages you view, the actions you take in the customer portal, and authentication events including sign-in attempts, their outcome and their source IP. Our servers and network devices also write operational logs.
Service metadata. Identifiers and measurements for the services you buy: virtual machine identifiers, hostnames, resource usage, bandwidth, uptime, and the state of deployments. This is data about the service, not about what runs inside it.
Domain and certificate data. Registrant, administrative, technical and billing contact details that a registry or certificate authority requires in order to register a domain or issue a certificate. Some of this is published in public directories; see section 8.
Support and communications data. Tickets, emails, live chat transcripts, call notes, and any files you attach. Attachments are not screened for personal data, so please do not send us more than we need.
Marketing data. Whether you have consented to marketing, what you have opened or clicked, and your preferences. You can change these at any time.
Fraud screening data. Signals produced when an order is checked before provisioning, which may include IP geolocation, the mismatch between billing and network location, and the reputation of an email address or payment method.
We do not deliberately collect special category data, and we ask you not to send it to us in support tickets. Where you do, we hold it only as long as the ticket requires.
3. Why we use it, and our lawful basis
| What we do | Lawful basis under UK GDPR |
|---|---|
| Create and administer your account, and provide the services you have ordered | Performance of a contract (Art. 6(1)(b)) |
| Take payment, invoice you, chase overdue invoices, apply late fees | Performance of a contract; legitimate interests in recovering sums owed (Art. 6(1)(f)) |
| Keep accounting records and file tax returns | Legal obligation (Art. 6(1)(c)) |
| Provide support and respond to your enquiries | Performance of a contract; legitimate interests in answering non-customers |
| Secure our network: authentication logs, abuse detection, rate limiting, blocking attacks | Legitimate interests in protecting our systems, our customers and third parties (Art. 6(1)(f)) |
| Screen orders for fraud before provisioning | Legitimate interests in preventing payment fraud and abuse of free or trial resources |
| Register and renew domains, and issue certificates, using the contact details you give | Performance of a contract; legal obligation where a registry or CA policy requires publication |
| Send service messages: outages, maintenance, renewals, price changes, changes to these documents | Performance of a contract; legal obligation where a data protection notice is required |
| Send marketing about services similar to those you have bought, with an opt-out in every message | Legitimate interests, relying on the soft opt-in in regulation 22(3) of PECR |
| Send marketing to people who have asked for it | Consent (Art. 6(1)(a)), withdrawable at any time |
| Measure how our website is used | Consent, given through the cookie banner |
| Establish, exercise or defend legal claims, and comply with court orders and lawful requests | Legal obligation; legitimate interests in defending claims |
Where we rely on legitimate interests, we have weighed our interest against your rights and concluded that the processing is necessary, proportionate and not something you would find unexpected. Write to privacy@lbreeze.com if you want the assessment for a particular activity.
4. Automated decisions
Orders are screened automatically before provisioning. A high enough risk score can hold an order for manual review, or decline it. This can affect whether you receive a service, so if it happens you may ask for the decision to be reviewed by a person, explain your circumstances, and contest the outcome. Write to support@lbreeze.com and a human will look at it. We do not use profiling to make any other decision that has a legal or similarly significant effect on you, and we do not use your data for automated marketing scoring.
5. Where the data comes from
Almost all of it comes from you. The rest comes from: our payment processors, which tell us whether a payment succeeded and return card metadata and fraud signals; registries and registrars, which return domain status and expiry; certificate authorities, which return validation results; and publicly available sources such as company registers where we verify a business customer's details.
6. Who we share it with
We share personal data with service providers who process it on our behalf, under contracts that meet Article 28 of the UK GDPR. They may use it only to provide their service to us. The current list, with what each one receives and where it is located, is published at lbreeze.com/legal/sub-processors and forms part of this policy. We will give you at least 30 days’ notice before adding or replacing a sub-processor.
In broad categories, those providers are: payment processing; domain registration and WHOIS handling; TLS certificate issuance; data centre and network infrastructure; transactional email delivery; support and communications tooling; accounting and bookkeeping; and, where a feature you use depends on it, AI processing of the specific text you submit to that feature.
We also share data with our professional advisers where they need it, with a buyer and its advisers if we sell the business, and with law enforcement, regulators, courts or registries where we are legally required to or where it is necessary to defend a legal claim or prevent harm. We do not sell personal data and we do not share it with advertisers for their own purposes.
7. Sending data outside the UK
Our infrastructure and the personal data described in this policy are held in the United Kingdom and the European Economic Area.
Some of our providers are outside the UK. Where they are in a country the UK has found adequate, that finding is the safeguard. Where they are not, we use the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum, together with a transfer risk assessment and additional measures such as encryption in transit and at rest. You can ask us for a copy of the safeguard used for a specific transfer.
8. Domain registration data is partly public
Registering a domain is not private. The registry for the relevant extension, and in some cases the public WHOIS or RDAP directory, will hold the registrant details you give us, and some of those details may be published. What is published varies by extension and by registry policy, and neither we nor you control it. Some registries publish less for individuals than for organisations; some offer a privacy or proxy service, which we will tell you about where it is available. You must keep registrant details accurate: an inaccurate record can lead to the domain being suspended or cancelled by the registry.
9. How long we keep it
| Data | Retention |
|---|---|
| Account records after the last service ends | 6 years, to match the limitation period for contract claims |
| Invoices, payments and accounting records | 6 years after the end of the accounting period, as required by tax law |
| Support tickets and chat transcripts | 3 years from closure |
| Authentication and security logs | 12 months |
| Server, network and application operational logs | 90 days |
| Backups of platform data | 30 days on a rolling cycle, then overwritten |
| Customer content in a terminated service | 30 days after termination, then deleted |
| Marketing consent records and preferences | Until withdrawn, then 2 years as proof that consent existed |
| Fraud screening decisions | 2 years |
| Cookie consent records | 12 months, then re-asked |
Where a legal hold, an investigation or a live dispute applies, we keep what is relevant until it ends. When a period expires we delete the data or irreversibly anonymise it.
10. Your rights
You have the right to: be told what we hold and why; get a copy of it; have inaccurate data corrected; have data erased where we no longer have a basis for holding it; restrict processing while a dispute about it is resolved; object to processing based on legitimate interests, including an absolute right to object to direct marketing; receive data you gave us in a portable machine-readable form where the processing is by consent or contract and is automated; and withdraw consent at any time without affecting what we did before you withdrew it.
To exercise any of these, write to privacy@lbreeze.com. We will respond within one month. If the request is complex or you have made several, we may extend by two further months and will tell you why within the first month. We do not charge for this, unless a request is manifestly unfounded or excessive, in which case we will either charge a reasonable fee or explain why we are refusing. We may ask for proof of identity, and we will only ask for what is necessary to be confident who you are.
If your request concerns data inside a customer's virtual machine or application rather than data we hold as controller, we will tell you promptly and direct you to that customer, who is the controller for it.
If you are unhappy with how we have handled your data, tell us first at privacy@lbreeze.com. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, by telephone on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Complaining to us first is not a precondition.
11. Security
We protect personal data with measures appropriate to the risk, including encryption in transit using current TLS, encryption at rest for sensitive fields and for backups, access control on the principle of least privilege, multi-factor authentication for staff access to production systems, logging of administrative actions, network segmentation, and regular patching. Our staff are bound by confidentiality obligations and are given access only where their role requires it. The current technical and organisational measures are described in more detail in the Data Processing Addendum.
No system is perfectly secure. If a breach of personal data occurs and it is likely to result in a risk to people's rights and freedoms, we will report it to the ICO within 72 hours of becoming aware of it, and where the risk is high we will tell the affected people without undue delay. Where the breach concerns data we process on a customer's behalf, we will tell that customer without undue delay so they can meet their own obligations.
12. Cookies and similar technologies
We set cookies that are strictly necessary for the site and the customer portal to work, including session and authentication cookies, without asking, because the law does not require consent for those. Anything else, including analytics, is set only after you consent through the banner, and you can change or withdraw that at any time from the cookie settings link in the footer. Our Cookie Policy lists every cookie, what it does and how long it lasts.
13. Marketing
If you are already a customer, we may email you about services similar to those you have bought. Every such message has an unsubscribe link, and you can also opt out at any time by replying or by writing to privacy@lbreeze.com. If you are not a customer, we only send marketing where you have asked for it. We do not sell or rent your details to anyone for their own marketing.
14. Children
Our services are sold to businesses and to adults. We do not knowingly collect personal data from children under 13, and our services are not directed at them. If you believe a child has given us personal data, write to privacy@lbreeze.com and we will delete it.
15. Changes to this policy
We update this policy when the law changes, when we add or change a service, or when we add or replace a provider that handles personal data. The current version is always at lbreeze.com/legal/privacy with the date it was last updated at the top. Where a change materially affects how we use your data, we will email account holders at least 30 days before it takes effect. Older versions are available on request.