Privacy Policy

01 Who We Are

FM Hosting UK is operated by Coates IT, a sole trader / company based in Newcastle upon Tyne. For the purposes of UK data protection law, we are the data controller in respect of personal data you provide to us when using our website or services.

02 What Data We Collect

We collect personal data only where it is necessary to provide our services or communicate with you. This may include:

Identity data

Your name and, where applicable, your company or trading name.

Contact data

Email address, telephone number, and postal address.

Billing data

Your bank account details as collected and held by GoCardless for Direct Debit purposes. We do not store your bank account details directly.

Technical data

IP address, browser type, referring pages, and access timestamps collected automatically when you visit our website.

Service data

Information about the services you use, support requests you raise, and correspondence between us.

Hosted data

Files, databases, and content you upload or store on our servers. This may contain personal data about your own users or customers — you are the data controller for this data.

03 How We Collect It

• Directly from you — when you fill in our quote or order forms, email us, or contact us via WhatsApp.
• Automatically — our web server logs basic access data (IP address, browser, pages visited) as a standard part of HTTP server operation.
• Via GoCardless — when you set up a Direct Debit mandate, GoCardless collects and processes your bank details on our behalf.
• Via third-party services — see Section 6 for details of services embedded in our website (Google Fonts, Trustpilot).

04 Why We Process Your Data

We use your personal data for the following purposes:

• To set up, deliver, and manage the hosting or IT services you have ordered
• To communicate with you about your service, including support, maintenance, and billing
• To process payments via GoCardless Direct Debit
• To respond to enquiries and quote requests
• To send service-related notices (e.g. maintenance windows, renewals, policy updates)
• To meet our legal and regulatory obligations
• To improve our website and services, using anonymised access logs

We do not use your data for unsolicited marketing, profiling, or automated decision-making.

05 Lawful Basis for Processing

Under UK GDPR, we rely on the following lawful bases:

• Contract (Article 6(1)(b)) — processing your name, contact details, and billing data is necessary to enter into and perform the contract for services you have requested.
• Legitimate interests (Article 6(1)(f)) — we process server access logs to maintain security and diagnose technical issues. Our legitimate interest in operating a secure, reliable service outweighs any minor privacy impact of retaining these logs.
• Legal obligation (Article 6(1)(c)) — we may retain certain records to comply with financial, tax, or regulatory obligations.
• Consent (Article 6(1)(a)) — where we ask for your consent (for example, to send non-essential communications), you can withdraw it at any time by contacting us.

06 Third Parties We Share Data With

We share personal data only where necessary. We do not sell your data to any third party.

We may also disclose personal data where required by law, court order, or competent regulatory authority.

07 International Data Transfers

We aim to store and process your data within the United Kingdom and/or the European Economic Area (EEA). Where any data is transferred outside of these regions (for example via Google Fonts requests to Google's global infrastructure), we rely on the European Commission's adequacy decisions or Standard Contractual Clauses as the appropriate transfer mechanism.

GoCardless operates under FCA regulation and maintains appropriate safeguards for international transfers of payment data.

08 How Long We Keep Your Data

• Customer contact & service records — retained for the duration of your service relationship plus 6 years, to comply with UK limitation periods for contractual claims.
• Billing records — retained for 7 years in line with HMRC requirements.
• Quote and enquiry data — retained for up to 12 months if a service is not taken up, then deleted.
• Server access logs — retained for up to 90 days for security and diagnostic purposes, then purged.
• Hosted client data — retained for 30 days following service termination, then permanently deleted. See our Terms of Service for details.

09 Your Rights

Under UK GDPR you have the following rights in relation to your personal data. To exercise any of them, contact us at [email protected] — we will respond within one calendar month.

10 Cookies

Our website is a static site and does not set any first-party cookies of its own. However, third-party resources loaded by the site may set cookies or log requests:

• Google Fonts — fonts are loaded from fonts.googleapis.com. Google may log your IP address and browser as part of serving these font files. We have implemented the rel="preconnect" hint to minimise latency, but cannot control Google's logging behaviour.
• Trustpilot badge — the Trustpilot review badge is a static link and does not load third-party scripts or set cookies on page load. If you click through to Trustpilot, their own cookie policy applies.

We do not use analytics cookies, advertising cookies, or any tracking technology on this website.

11 Security

We take reasonable technical and organisational measures to protect your personal data, including:

• HTTPS encryption enforced across all pages
• Access controls and authentication on server infrastructure
• Regular patching and security hardening of servers
• Limiting access to personal data to those who need it to perform their role

No method of electronic transmission or storage is completely secure. In the event of a data breach that is likely to result in risk to your rights and freedoms, we will notify the ICO within 72 hours and inform affected individuals without undue delay.

12 Children

Our services are directed at businesses and individuals aged 18 and over. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us at [email protected] and we will delete it promptly.

13 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we do:

• The effective date at the top of this page will be updated.
• For material changes, we will notify active clients by email.
• Continued use of our services following notification constitutes acceptance of the updated policy.

14 Contact & Complaints

If you have any questions about this policy, wish to exercise your data rights, or have a concern about how we handle your personal data, please contact us: