Privacy Policy

Who controls your data

The controller is AMVEN Ltd, trading as InstaHost, company number 15878352, registered office 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.

Data protection enquiries: Legal@InstaHost.co.uk.

What we collect

• Account and billing data — name, business name, address, email, phone, and the records of what you have bought.
• Support data — the contents of tickets, emails and calls.
• Technical data — server and access logs, IP addresses, and diagnostic information generated by running your services.
• Domain registrant data — where you register a domain, the details required by the registry, some of which may be published in WHOIS unless privacy is applied.

Why we use it, and our lawful basis

• To provide the service you bought — performance of a contract.
• To take payment and keep accounting records — contract, and legal obligation for tax records.
• To keep the platform secure and diagnose faults — legitimate interests in running a safe, working service.
• To meet legal and registry obligations — legal obligation, including domain registry rules.

This website itself

By default the instahost.co.uk website sets no cookies, runs no analytics, and carries no advertising or tracking pixels. The one exception is an optional Ecologi carbon-impact widget on the sustainability page, which loads only if you accept it through the consent bar. See the Cookie Policy.

It does load fonts from Google Fonts, which means Google receives the IP address of visitors in order to serve the font files. See the Cookie Policy.

Our blog, at blog.instahost.co.uk, is separate and does use Google Analytics — but only with your consent, via a banner that blocks it until you accept. See the Cookie Policy.

Who else processes your data

• 20i Ltd — the underlying hosting platform behind our control panel, webmail and servers. They process customer and technical data on our instructions.
• Domain registries and registrars — including Nominet for .uk domains, where registration requires it.
• Payment providers — Stripe, PayPal and GoCardless, depending on how you choose to pay. Card details are handled by them directly and are not stored on our systems.
• Google — font delivery on the website, reCAPTCHA on the control panel checkout sign-in, and Google Analytics on our blog (loaded only with your consent). Analytics data is processed by Google, including in the United States, under its data processing terms.
• Ecologi — the carbon-impact widget on the sustainability page, loaded only with your consent. When shown, it runs third-party code from Ecologi in your browser.

International transfers

Most processing takes place in the UK. Some reaches providers outside it: Google for fonts and reCAPTCHA, and Stripe and PayPal for payments, all of which have US operations. GoCardless is UK-based. For those transfers we rely on the standard contractual clauses and UK Addendum in each provider’s data processing agreement, which we have accepted.

How long we keep it

We keep data no longer than we need it. In practice that means:

• Billing and accounting records — six years from the end of the accounting period they relate to, which is what HMRC expects.
• Account details — for as long as you are a customer, then deleted within 90 days of closure, except where they form part of a financial record.
• Support tickets and correspondence — 24 months.
• Server and access logs — 90 days, then deleted or aggregated.
• Backups — 30 days, after which they are overwritten.
• Domain registrant data — for the life of the registration, plus any period the registry requires.

Your rights

Under UK GDPR you can ask us for a copy of your data, to correct it, to erase it, to restrict or object to how we use it, and to receive it in a portable form. Some rights are qualified — we cannot delete records we are legally required to keep.

To exercise any of these, email Legal@InstaHost.co.uk. We will respond within one month.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113. We would rather you came to us first.

Security

Services run on UK data centres with encryption in transit, access controls on administrative systems, and backups retained for 30 days. No system is perfectly secure, and you remain responsible for the security of what you install and run on your own hosting.

Changes

We may update this policy. The date at the top records the last change, and material changes are notified by email to your registered address and by notice in the control panel.