Privacy policy

This policy explains how Kualo Limited collects and uses personal information about our customers, the people who visit our websites and the people who contact us.

The short version

• We collect the information we need to provide our hosting, domain and related services, bill for them and support you.
• We share it only with organisations that help us run our services and our business, or where the law requires it. We don't sell it.
• Some of our systems and service providers are outside the UK, including in the United States. When information goes abroad, we protect it with the safeguards UK law requires.
• The websites, email and files you store with us are yours to control. This policy covers our own records about you.
• You can ask for a copy of your information, ask us to correct or delete it, and object to how we use it. Email [email protected].

1. Who we are

Kualo Limited ("Kualo", "we", "us") is the controller of the personal information described in this policy. That means we decide how and why it's used, and we're responsible for protecting it.

We're registered in England and Wales, company number 04004280. Our registered office is 20-22 Wenlock Road, London N1 7GU. We're registered with the Information Commissioner's Office (ICO), registration number Z115828X. Our VAT number is GB879440088.

If you have a question about this policy or your personal information, email our privacy contact at [email protected], or write to us at our registered office.

If you live in the European Union, our representative under EU data protection law is Kualo Europe Ltd, 32 "6-ti Septemvri" Str., floor 2, Sredets, Sofia 1000, Bulgaria.

2. What this policy covers

This policy applies to personal information about:

• our customers, and the contacts and users added to a customer's account
• people who visit our websites, including MyKualo, our customer area
• people who contact us by email, live chat, phone or through our forms
• people whose details we receive to provide a service, such as the contacts for a domain name, or someone mentioned in a request to us, for example a person a customer is having trouble emailing
• people who work for our suppliers and business partners
• people who apply to work with us

Information you store on our services. When you host websites, email or other data with us, you decide what personal information it contains and how it's used. We process it on your behalf, under the data processing terms in our Terms and Conditions. Those terms, not this policy, set out how we handle it. If you're a customer, the list of the companies that help us process it, our sub-processors, is in MyKualo under Data protection. If you can't see it there, ask us. That list covers information you store on our services. The companies we use for our own records about you, such as billing and support, are described in section 6.

If you've used a website or email address that we host, its owner is responsible for your information. Please contact them about it. If you contact us instead, we'll help you reach them where we can.

This policy doesn't cover our own staff or people applying to work for us. They receive separate information.

3. The information we collect

Information you give us

Information we collect automatically

• When you use our websites and MyKualo: your IP address, browser and device details, the pages you visit, when you log in, and your cookie choices. Our Cookie Policy has more detail.
• When you use our services: technical information about your services, such as resource usage, the software and versions they run (for example the PHP version and the website applications installed), security and performance readings from our monitoring, and records of actions taken on your account.
• When we speak by phone: your phone number and, where a call is recorded, the recording, which we transcribe and summarise. We tell you when a call is being recorded.

Information from other sources

• Payment providers tell us whether a payment has gone through.
• Fraud prevention services tell us how likely an order is to be fraudulent.
• Our identity verification provider tells us the result of an online identity check you complete.
• Public registers, such as Companies House, the Charity Commission, the Charity Commission for Northern Ireland, the Scottish Charity Regulator (OSCR) and, for US charities, the filings they make with the IRS, to confirm details about a business or charity, such as its name, directors or trustees. For example, when you apply for a charity discount or ask us to change the company name on your account.
• Your business's public website, when you ask us about our services.
• Other people may give us your details, for example a colleague who adds you to their account, or someone who manages a website for you.

If you don't give us information

We need your name, contact details, address and payment details to provide our services. Without them, we can't set up or run your account. Domain registries also require certain details before they'll register a domain name.

4. How we use your information

The law requires a lawful basis for each way we use personal information. This table sets out what we do and the basis we rely on.

Where the table says contract, that applies when you are our customer, or are asking to become one. If you are a contact or user on someone else's account, for example a colleague added to your organisation's account or a developer who manages a website, we rely instead on legitimate interests: running and supporting the account your organisation holds with us.

Where we rely on legitimate interests, we've weighed our interests against yours. You can object at any time (see section 9).

5. Automated checks and decisions

Some routine checks and billing steps run automatically. You can always ask a member of our team to review a decision, give us your view and challenge it.

• Fraud checks on new orders. A fraud prevention service scores each new order using details such as your IP address, email address, billing address and payment details. If an order looks high-risk, it is held automatically for our team to review, and we tell you when you place it. If it was the first order on a new account, the account is paused until the review is done, and reopens as soon as the order is approved. A member of our team looks at every held order, which may include checking the order details with you, calling you or asking you to complete our online identity check, and then accepts or rejects it. You are not charged for an order that is rejected. We may also refuse a new signup automatically, for example from a temporary email address, and we tell you how to contact us if that happens.
• Failed payments. If a payment fails, our billing system tries again once a week for up to four weeks.
• Unpaid invoices. Some services may be suspended, and in some cases ended, automatically if an invoice stays unpaid after the notice our Terms require. Where that applies, we tell you first.
• AI tools. Our team uses AI tools in its work, including to help read and reply to your requests. The tools don't make decisions about your account, and a person decides every change to an account, order or service. Under the terms we use, our AI providers may not use your information to train their models, and they keep it only for limited periods.

6. Who we share your information with

We share personal information only when we need to, and we don't sell it. Some of the companies below do a job that involves your details, such as taking a payment or registering a domain. Others provide tools our team works in, and hold information about you only if our team uses it there while working on something for you. The table says which is which, and many will never see anything about you at all. Our service providers may use what they see only to provide their services to us, under contracts that protect it, except where the table says a company also uses it for its own purposes.

This section covers our own records about you, including what you send us for support. Information you store on our services is covered by our sub-processor list, which customers can see in MyKualo under Data protection or ask for by opening a support ticket. Some companies do both, so they appear in both places, each time with what they do there.