Privacy Notice

1. Introduction

This Privacy Notice explains how Nini Websites Ltd collects, uses, stores, shares and protects personal information when you visit our website, contact us, open an account, purchase a service or use our hosting, development, maintenance, consulting or related services.

We are committed to handling personal information lawfully, fairly, transparently and securely.

This Notice applies when we determine how and why personal information is processed as a controller. In some circumstances, we process information on behalf of a customer as a processor. Those activities may also be governed by a separate data-processing agreement.

2. Who is responsible for your information?

Nini Websites Ltd is a company registered in England and Wales under company number 16869867.

Our registered office is 167–169 Great Portland Street, 5th Floor, London, W1W 5PF.

For questions about this Privacy Notice or our use of personal information, contact us at info@niniwebsites.com.

3. Applicable data-protection law

We process personal information in accordance with applicable UK data-protection law, including the UK General Data Protection Regulation and the Data Protection Act 2018.

The Privacy and Electronic Communications Regulations may also apply to electronic marketing, cookies and similar technologies.

If we offer services to, or monitor the behaviour of, individuals in the European Economic Area, the EU General Data Protection Regulation may additionally apply to the relevant processing.

4. Personal information we collect

The information we collect depends on how you interact with us and which Services you use.

• Identity information, including your name, organisation, role and customer reference.
• Contact information, including your email address, telephone number, billing address and service address.
• Account information, including your username, permissions, authentication records and account preferences.
• Contract information, including quotations, Orders, service agreements, project requirements and approvals.
• Billing information, including invoices, transaction history, payment status, refunds and masked payment-card details.
• Technical information, including IP addresses, browser type, device information, operating system, login records and server logs.
• Service information, including domain names, hosting settings, cPanel activity, website files, databases and support diagnostics.
• Communications, including emails, support requests, enquiries, complaints, reviews and feedback.
• Usage information, including pages visited, referring websites, session information and interactions with our Website.
• Marketing information, including your communication preferences and interactions with marketing messages.
• Security and compliance information, including fraud indicators, abuse reports, identity checks and records needed to protect or defend legal rights.
• Customer Content containing personal information that customers ask us to host, migrate, maintain or otherwise process.

5. Payment information

Card payments are normally processed by an authorised third-party payment processor.

We generally receive limited payment information such as a transaction identifier, payment status, card brand, expiry information and the last four digits of the card number.

We do not intend to collect or store complete payment-card numbers or card security codes on our systems.

Payment information may be used to process authorised transactions, reconcile invoices, issue refunds, prevent fraud, respond to payment disputes and meet accounting or legal obligations.

If you cancel or withdraw recurring card-payment authority, we will record that instruction and stop initiating further payment requests under that authority.

We may retain invoice, transaction and payment-status records where necessary for accounting, taxation, contractual disputes or legal claims.

6. How we obtain personal information

We may obtain personal information from the following sources:

• Directly from you when you contact us, request a quotation, place an Order, open an account or use our Services.
• From authorised users or representatives within your organisation.
• Automatically through your use of our Website, account, hosting platform or other Services.
• From payment processors, banks and fraud-prevention providers.
• From domain registries, registrars and technology suppliers.
• From analytics or advertising providers where their use is permitted and appropriate consent has been obtained.
• From public sources, including Companies House and publicly accessible business websites.
• From professional advisers, debt-recovery providers, regulators or authorities where lawful and relevant.

7. How we use personal information

We may use personal information for the following purposes:

• To create, administer and secure customer accounts.
• To provide website development, hosting, domain, maintenance, support, consulting and related Services.
• To prepare quotations, accept Orders and manage Contracts.
• To process authorised payments, issue invoices and administer refunds.
• To provide technical support and respond to enquiries or complaints.
• To maintain, monitor, troubleshoot and improve our Website and Services.
• To detect fraud, malware, unauthorised access, abuse and other security threats.
• To communicate important account, security, service and billing information.
• To manage domain registrations, renewals and transfers.
• To comply with accounting, taxation, legal and regulatory requirements.
• To establish, exercise or defend legal claims.
• To send marketing communications where permitted by law.
• To measure marketing and Website performance where appropriate consent has been obtained.
• To manage business restructuring, investment, acquisition or sale activity subject to appropriate safeguards.

8. Our lawful bases

We process personal information only where we have an appropriate lawful basis.

• Contract: processing is necessary to enter into or perform a Contract with you.
• Legal obligation: processing is necessary to comply with accounting, tax, regulatory or other legal requirements.
• Legitimate interests: processing is necessary to operate, improve and secure our business, support customers, receive payment, prevent fraud or protect legal rights, provided those interests are not overridden by individual rights.
• Consent: you have given clear permission for a particular activity, such as certain marketing or non-essential cookies.
• Legal claims: processing is necessary to establish, exercise or defend legal rights where applicable.

9. Legitimate interests

Where we rely on legitimate interests, those interests may include operating and securing our business, providing customer support, administering accounts, improving Services, recovering properly due payments, preventing misuse and protecting legal rights.

We consider whether the processing is necessary and balance our interests against the interests, rights and freedoms of affected individuals.

You may contact us to request further information about a relevant legitimate-interest assessment.

10. Service and billing communications

We may send essential communications concerning your account, Contract, Website, hosting, domains, security, invoices and payment status.

These communications are not marketing and may continue where reasonably necessary even if you opt out of promotional messages.

A request to cancel recurring card authority will stop further payment attempts under that authority. It will not prevent us from sending a lawful invoice or communicating about a genuine outstanding balance.

We will not disguise promotional marketing as an essential service or billing communication.

11. Marketing communications

We may send information about NiniWebsites Ltd services where you have consented or where another lawful basis permits it.

You can opt out at any time by using the unsubscribe link in a marketing message or contacting us.

Withdrawing marketing consent does not affect processing already carried out lawfully and does not stop essential contractual, security or billing messages.

12. Cookies and similar technologies

Our Website may use cookies and similar technologies to operate authentication, security, account, shopping and other essential functions.

We may also use analytics, preference or advertising technologies where appropriate consent has been obtained.

Non-essential cookies should not be activated before consent where consent is required.

Our cookie controls should allow you to reject non-essential cookies as easily as accepting them and to change your preferences later.

Further information about individual cookies, providers, purposes and storage periods should be available in our Cookie Policy.

13. Who we share personal information with

We share personal information only where it is reasonably necessary and lawful.

• Cloud, hosting, backup, email, security and technical-support providers.
• Amazon Web Services where AWS infrastructure or services are used.
• Payment processors, banks and fraud-prevention providers.
• Domain registries and registrars.
• Accountants, tax advisers, lawyers, insurers and auditors.
• Analytics and cookie providers where they are enabled lawfully.
• Advertising partners where appropriate consent or another lawful basis exists.
• Debt-recovery providers where a valid amount remains properly due.
• Regulators, courts, law-enforcement agencies and public authorities where disclosure is required or lawfully justified.
• A purchaser, investor or successor involved in a genuine business sale, acquisition or restructuring, subject to appropriate confidentiality and data-protection safeguards.

14. Advertising partners

We only share information with advertising or measurement partners where it is necessary for an identified and lawful purpose.

Where consent is required for advertising cookies or tracking technologies, information will not be shared through those technologies before valid consent is obtained.

You may withdraw consent or change your cookie preferences at any time.

We do not sell personal information.

15. When we process information for customers

Customers may use our hosting, maintenance or development Services to process personal information about their own users, customers, staff or other individuals.

Where the customer determines why and how that information is processed, the customer is normally the controller and NiniWebsites Ltd acts as a processor.

We process that information in accordance with the customer’s documented instructions, the applicable Contract and any data-processing agreement.

If you wish to exercise rights concerning information controlled by one of our customers, you should normally contact that customer directly. We will assist the customer where required by law.

16. AWS, hosting locations and data regions

We may use Amazon Web Services and other hosting providers to store, transmit, back up or otherwise process information.

Personal information may be processed in the United Kingdom or in other service regions selected for the relevant infrastructure.

The actual processing location depends on the Service, customer configuration, supplier and technical requirements.

We review the data-processing and security arrangements of providers where appropriate to the nature and risk of the processing.

17. International transfers

Some service providers may process personal information outside the United Kingdom.

Where UK personal information is transferred to a country not covered by UK adequacy regulations, we use an appropriate lawful transfer mechanism where required.

These mechanisms may include the UK International Data Transfer Agreement, the UK Addendum to the European Commission’s Standard Contractual Clauses, binding corporate rules or another legally recognised safeguard.

We may also assess transfer risks and apply supplementary technical or organisational safeguards where appropriate.

Where EU GDPR applies to particular processing, we use an appropriate EU transfer mechanism for relevant transfers from the European Economic Area.

Contact info@niniwebsites.com to request more information about safeguards relevant to a particular transfer.

18. How we secure personal information

Security is a high priority. We use technical and organisational measures appropriate to the nature, context and risk of the processing.

• Access controls and least-privilege permissions.
• Strong authentication and multi-factor authentication where supported.
• Encryption in transit.
• Encryption at rest where supported and appropriate.
• System patching and vulnerability management.
• Malware protection and security monitoring.
• Logging and incident-investigation procedures.
• Backup and restoration arrangements appropriate to the relevant Service.
• Supplier and processor review.
• Confidentiality requirements and restricted administrative access.
• Personal-data breach assessment and response procedures.

19. Security limitations

No internet transmission, hosting platform or electronic storage system can be guaranteed to be completely secure.

Customers are responsible for protecting their own credentials, devices, applications and independent backups.

If we become aware of a personal-data breach, we will investigate and notify the Information Commissioner’s Office, affected customers or affected individuals where required by law.

20. How long we retain personal information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected and for contractual, security, accounting, tax, insurance and legal requirements.

The precise period depends on the type of information, the relevant Service, legal obligations, potential disputes and whether a legal hold applies.

• Customer account and Contract records may generally be retained for the duration of the relationship and for up to six years afterwards where required for legal or contractual purposes.
• Invoices, transactions and accounting records may generally be retained for at least six years or for another period required by tax and accounting law.
• Support communications are retained only for as long as reasonably necessary to resolve issues, maintain service history and protect legal rights.
• Security and access logs are retained according to system risk, operational need and investigative requirements.
• Unsuccessful enquiries are deleted or anonymised when no longer reasonably required.
• Marketing information is retained until consent is withdrawn, an objection is received or the information is no longer useful for the stated purpose.
• Minimal suppression information may be retained to ensure that an opt-out continues to be respected.
• Customer Content is deleted or made inaccessible after termination in accordance with the applicable Contract, backup cycle and legal requirements.

21. Accessing and updating account information

Where available, you may view, update or delete certain information through your NiniWebsites client account.

Some records cannot be deleted immediately where they are needed for accounting, taxation, fraud prevention, security, legal claims or other legal obligations.

Contact us if you cannot access your account or the required control is not available.

22. Your data-protection rights

Depending on the circumstances and applicable law, you may have the following rights:

• The right to be informed about how your personal information is used.
• The right to request access to your personal information.
• The right to correct inaccurate or incomplete information.
• The right to request deletion of personal information.
• The right to restrict particular processing.
• The right to object to processing based on legitimate interests.
• The absolute right to object to direct marketing.
• The right to receive certain information in a portable format.
• The right to withdraw consent at any time.
• Rights relating to solely automated decisions that produce legal or similarly significant effects.

23. Exercising your rights

To exercise a data-protection right, email info@niniwebsites.com.

We may need to verify your identity and authority before completing a request.

We normally respond within one month, although the law permits an extension in certain complex cases. If an extension is necessary, we will explain the reason.

We do not ordinarily charge a fee. However, the law may permit a reasonable fee or refusal where a request is manifestly unfounded or excessive.

Data-protection rights are not absolute and a legal exemption may apply in some circumstances.

24. Automated decision-making

We do not currently intend to make solely automated decisions about customers that produce legal or similarly significant effects.

Automated security or fraud indicators may flag activity for human review.

If our use of legally significant automated decision-making changes, we will provide the information and safeguards required by law.

25. Children’s information

Our commercial Services are not directed to children, and individuals must be at least 18 years old to enter into a Contract with us.

If a customer uses our hosting Services to operate its own service involving children, that customer is responsible for satisfying its obligations as controller and agreeing appropriate processing arrangements with us.

26. External websites and services

Our Website may contain links to websites and services operated by other organisations.

Those organisations control their own privacy practices. You should review their privacy notices before providing personal information.

We are not responsible for an independent third party’s privacy practices, except to the extent that applicable law makes us responsible.

27. Business transfers

If NiniWebsites Ltd is involved in a merger, restructuring, investment, acquisition or sale, personal information may be disclosed to professional advisers and relevant parties where reasonably necessary.

We will use confidentiality and data-protection safeguards and provide additional notice where required by law.

28. Privacy concerns and complaints

If you have a concern about our use of personal information, please contact us first at info@niniwebsites.com so that we can investigate.

You also have the right to complain to the Information Commissioner’s Office.

Information about making a complaint is available through the Information Commissioner’s Office .

If you are located in the European Economic Area and EU GDPR applies, you may also have a right to complain to the relevant supervisory authority.

29. Changes to this Privacy Notice

We may update this Privacy Notice to reflect changes in applicable law, our Services, service providers, security arrangements or processing activities.

The updated version will be published on this page with a revised effective date.

Where a change materially affects individuals, we will provide additional notice or obtain consent where required.

You may contact us to request an earlier version of this Privacy Notice.

30. Contact NiniWebsites Ltd

Nini Websites Ltd

Company number: 16869867

Registered office: 167–169 Great Portland Street, 5th Floor, London, W1W 5PF

Privacy email: info@niniwebsites.com

Website: https://niniwebsites.com