hosting3-header-bg

Privacy Policy

Our Privacy Policy.

Effective date: 22 August 2026
Data Controller: Ffon Solutions Limited trading as Raleway Hosting
Company Registration Number: 14646146
Registered Office: 82a James Carter Road, Mildenhall, Bury St Edmunds, England, IP28 7DE
Website: https://raleway.uk
Privacy Contact / DPO Contact: [email protected]

1. Introduction and Scope

Ffon Solutions Limited trading as Raleway Hosting (“Raleway”, “we”, “us”, or “our”) respects your privacy and is committed to protecting your personal data.

This Privacy Policy sets out how we collect, process, store, and safeguard personal data when you visit our website, create an account, purchase or use our hosting and domain services, submit support requests, or otherwise interact with us. It also informs you of your legal rights under UK data protection legislation, including the Data Protection Act 2018 and the UK GDPR (retained EU Regulation 2016/679 as incorporated into domestic law).

This policy applies to personal data collected where we act as a Data Controller (e.g., account administration, billing, and server log monitoring). Where you host websites, applications, databases, or mailboxes containing third-party personal data on our infrastructure, you act as the Data Controller and Raleway acts as a Data Processor under Section 11 of this policy.

2. The Data We Collect About You

We may collect, use, store, and transfer different kinds of personal data about you, categorised as follows:

  • Identity Data: First name, last name, title, business name, or company registration details.
  • Contact Data: Billing address, registered address, email address, and telephone numbers.
  • Financial Data: Payment card details, direct debit mandates, and bank account details (processed securely via our third-party payment gateways; we do not store full raw card numbers).
  • Transaction Data: Invoices, payment history, subscribed hosting packages, domain registrations, SLA credits, and billing records.
  • Technical and Log Data: Internet Protocol (IP) addresses, browser type and version, time zone setting, operating system, platform, access logs, DDoS mitigation logs, automated malware scanning telemetry, and server resource utilisation metrics.
  • Profile and Usage Data: Account login credentials (passwords stored only as salted cryptographic hashes), support tickets, service communications, and records of compliance with our Acceptable Use Policy.
  • Marketing and Communications Data: Your preferences in receiving marketing updates from us and your communication preferences.

We do not intentionally collect any Special Category Personal Data (e.g., health data, biometric data, philosophical/religious beliefs, or political opinions).

3. Lawful Bases for Processing

Under the Data Protection Act 2018, we must identify an appropriate lawful basis for every processing activity. We rely on the following bases:

Purpose / Activity Type of Data Lawful Basis for Processing
Registering you as a customer and creating your account Identity, Contact Performance of a contract
Processing orders, billing, and applying SLA downtime credits Identity, Contact, Financial, Transaction Performance of a contract; Legal obligation (tax/accounting records)
Managing our relationship, service alerts, and support requests Identity, Contact, Profile, Usage Performance of a contract; Legitimate interests (maintaining customer relations)
Running security defences, DoS/DDoS mitigation, and malware scanning Technical, Log, Usage Legitimate interests (securing infrastructure, preventing cyberattacks, and enforcing our Acceptable Use Policy)
Domain registration and registry WHOIS/RDAP records Identity, Contact, Technical Performance of a contract; Legal obligation (accredited domain registry rules)
Investigating abuse, fraud, or network security incidents Identity, Contact, Technical, Log Legitimate interests; Legal obligation (preventing crime and complying with law enforcement notices)
Sending direct service updates and relevant commercial offers Identity, Contact, Marketing Legitimate interests (or Consent where required by the Privacy and Electronic Communications Regulations (PECR))

4. Technical Telemetry, DDoS Mitigation, and Malware Scanning

To maintain our targeted 99.99% availability SLA and preserve network integrity:

  • DDoS Mitigation & Traffic Monitoring: We actively inspect network traffic patterns to detect and mitigate denial-of-service attacks. This involves processing incoming and outgoing IP addresses, request volumes, and packet structures.
  • Automated Malware Scanning: We deploy automated security software across our hosting platform to scan files, scripts, and server environments for malware, vulnerabilities, and unauthorized backdoors.
  • Access Logs: Standard web, mail, and SSH access logs are captured to ensure server security, debug system failures, and verify audit trails.

5. Disclosures of Your Personal Data

We may share your personal data with selected third parties who act as data processors or independent data controllers, including:

  • Domain Registrars and Registries: Central registries (e.g., Nominet UK, ICANN-accredited registrars) necessary to register, delegate, and manage your chosen domain names.
  • Payment Processors: Authorised and PCI-DSS-compliant payment service providers to handle subscription payments securely.
  • Infrastructure and Data Centre Partners: Authorised data centre and colocation providers operating physical infrastructure located within the United Kingdom.
  • Professional Advisers and Law Enforcement: Legal counsel, auditors, insurers, regulatory bodies (e.g., the Information Commissioner's Office (ICO)), and law enforcement agencies where we are legally required to do so or where reasonably necessary to establish, exercise, or defend legal claims.

We require all third-party service providers to respect the security of your personal data and to treat it in accordance with applicable data protection laws.

6. Server Location and International Transfers

Our primary production servers and data centre infrastructure are located entirely within the United Kingdom.

Where third-party service integrations (such as payment processing or upstream registry routing) require the transfer of personal data outside the UK, we ensure an equivalent degree of protection is afforded by implementing at least one of the following safeguards:

  • Transferring data to countries deemed by the UK Government to provide an adequate level of data protection; or
  • Utilising standard contractual clauses approved by the Information Commissioner’s Office (such as the UK International Data Transfer Agreement or Addendum).

7. Data Retention and Deletion

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, tax, or reporting requirements.

  • Account and Billing Records: Retained for a minimum of 6 years following the end of the financial year in which the transaction occurred to comply with UK statutory accounting obligations.
  • Support Tickets and Communications: Retained for up to 3 years from ticket closure.
  • Server Technical Logs: Retained on automated rolling cycles, typically between 30 and 90 days, unless required longer for an ongoing security incident investigation.
  • Customer Hosted Data on Termination: In accordance with our Hosting Terms and Conditions, upon the termination or expiry of your hosting services, all hosted website files, databases, mailboxes, and associated configurations are permanently deleted from our active servers and cannot be recovered.

8. Data Security

We have implemented technical and organisational measures to prevent your personal data from being accidentally lost, used, accessed in an unauthorised way, altered, or disclosed:

  • Encryption of data in transit using Transport Layer Security (TLS/HTTPS).
  • Restrictive access controls, firewalls, and cryptographic credential hashing.
  • Multi-factor authentication mechanisms for administrative interfaces.
  • Regular security patches, vulnerability assessments, and automated threat detection.

9. Your Legal Rights

Under UK data protection laws, you have rights regarding your personal data:

  • Right of Access: Request a copy of the personal data we hold about you (a Data Subject Access Request).
  • Right to Rectification: Request correction of inaccurate or incomplete personal data.
  • Right to Erasure ("Right to be Forgotten"): Request the deletion of personal data where there is no good reason for us continuing to process it.
  • Right to Object: Object to processing based on legitimate interests or to direct marketing.
  • Right to Restriction: Request the suspension of processing your personal data.
  • Right to Data Portability: Request the transfer of your data to you or a third party in a structured, commonly used, machine-readable format.
  • Right to Withdraw Consent: Withdraw consent at any time where processing is based solely on consent.

To exercise any of these rights, please contact [email protected]. We respond to all legitimate requests within one calendar month.

You also have the right to lodge a complaint with the UK supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: https://ico.org.uk

10. Cookies and Tracking Technologies

Our website uses essential cookies required for authentication, shopping cart operation, and portal session security. We may also use analytical cookies to evaluate site performance and improve user experience. You can configure your browser to reject non-essential cookies via your browser settings or our website cookie management tool.

11. Data Processing Addendum (DPA) Summary

Where you host personal data relating to your own users, clients, or third parties on our servers:

  1. Roles: You are the Data Controller (or intermediary Processor) and Raleway is the Data Processor.
  2. Scope of Processing: We process such content solely to store, host, transmit, route, and back up data in accordance with your service instructions and our Hosting Terms and Conditions.
  3. Security: We apply technical and organisational measures appropriate to the security requirements of server hosting.
  4. Confidentiality: Our staff and contractors authorised to access systems are bound by statutory or contractual obligations of confidentiality.
  5. Sub-processors: You grant us general authorisation to engage necessary infrastructure and network subcontractors, subject to equivalent data protection standards.
  6. Assistance: We provide technical capability to enable you to fulfil data subject access requests, rectifications, and deletions within your hosted control panel.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect operational, legal, or regulatory changes. Any updates will be published on this page with an amended "Effective date".

13. Contact Information

If you have questions about this Privacy Policy or wish to exercise your legal rights, please contact us at:

Ffon Solutions Limited (t/a Raleway Hosting)
82a James Carter Road, Mildenhall, Bury St Edmunds, England, IP28 7DE
Email: [email protected]
Company Registration Number: 14646146