Privacy policy

We only use your data to provide the services you order. We do not sell it, we do not track you with adverts, and we measure visits anonymously on our own infrastructure.

1. Who handles your data

The controller of your personal data is OSCLOUD LTD, 33 Loweswater Road, GL51 3AZ Cheltenham, United Kingdom, company registration number (CRN) 1615763866, which operates the Pibbo service at pibbo.pro (“we”, “us”).

For anything relating to your personal data, you can contact us by email at info@pibbo.pro or through the contact form on our website.

We process personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and, for customers in the European Union, with the EU General Data Protection Regulation (GDPR).

2. What data we process

  • Contact and billing details from your order: your name, company name and company number if applicable, email address, phone number (optional) and billing address.
  • Details of the services you order: plan, domain, number of users, order notes, payments and invoices.
  • Domain holder details required by the registry for the extension concerned (for example Nominet for .uk domains).
  • The content of messages you send us through the contact form or by email, including your name and email address.
  • Technical data: the IP address and time a form was sent, server logs, a strictly necessary cookie and anonymous visitor statistics.

We do not process the content you store on your hosting or in your mailboxes (websites, databases, emails) for our own purposes – we only handle it as a processor, as described in “Data you store with us”.

3. Why we process data and on what basis

  • To process your order and provide our services (setting up hosting, registering and managing domains, email, technical support) – performance of a contract.
  • To issue invoices and keep accounts – compliance with a legal obligation.
  • To reply to your contact form enquiry – our legitimate interest in answering you, or steps taken before entering into a contract.
  • To protect our website and services from misuse and spam (IP address on forms, server logs) – our legitimate interest in running things securely.
  • To measure visits to our website anonymously, so we know which pages people read and what is missing – our legitimate interest in improving the website.
  • To send service information about what you use (for example a domain expiry reminder or planned maintenance) – performance of a contract.

We never send you marketing emails or newsletters without your explicit consent.

4. How long we keep data

  • Customer data for as long as our contract lasts, and then for as long as we must keep it for accounting and tax purposes (in the United Kingdom usually 6 years from the end of the financial year).
  • Orders that never became a contract for no longer than 1 year.
  • Contact form messages and email correspondence for no longer than 3 years after our last contact, unless they form part of a contract.
  • Technical records used to protect forms from spam for no longer than 1 hour, server logs for no longer than 90 days.

Once these periods are over, we delete or anonymise the data. It disappears from backups at the latest with their regular rotation.

5. Who we share data with

We never sell your data. We only share it where it is necessary to provide the service or where the law requires us to:

  • With the domain registrar Subreg.cz and the registry for the relevant extension – when registering, transferring and managing a domain. Some domain holder details may be publicly available in the WHOIS service under the registry’s rules.
  • With the operator of the data centre in Stockholm (Sweden) where our servers are located.
  • With the OSCLOUD project, whose server at Hetzner in Germany runs our Umami visitor statistics – this is anonymous, aggregated data only.
  • With storage providers for backups in the United Kingdom, the Czech Republic and Germany.
  • With our bank when receiving payments, and with accountants and tax advisers to the extent needed to keep our accounts.
  • With public authorities where the law requires us to.

We process data in the United Kingdom and the European Economic Area, which are recognised as providing an adequate level of data protection. We do not transfer it outside these areas unless the registry for a particular domain you order requires it.

6. Cookies and visitor statistics

Our website uses a single cookie called “pibbo”. It is strictly necessary for sending forms securely (protection against forged submissions) and expires when you close your browser. That is why we do not need your consent for it and do not show a cookie banner.

We measure visits to our website with Umami, which we run ourselves as part of the OSCLOUD project (analytics.oscloud.cz) on a server at Hetzner in Germany. Umami does not use cookies, does not store IP addresses or any other data that could identify an individual visitor, and does not track you across websites. We only see aggregated statistics – for example how many people visited a page, where they came from and what kind of device and browser they use.

We do not use Google Analytics or any third-party advertising or tracking tools. Fonts and images are loaded from our own server.

7. Your rights

You have the right to:

  • access your data and receive a copy of it,
  • have inaccurate data corrected or incomplete data completed,
  • have your data erased where we no longer need it or are not allowed to keep processing it,
  • restrict processing,
  • data portability for data we process on the basis of a contract,
  • object to processing based on our legitimate interest,
  • withdraw your consent where you have given it to us for something.

Just email us at info@pibbo.pro. We will reply without undue delay and within one month at the latest. To make sure we do not hand your data to someone else, we may ask you to confirm your identity.

If you feel we are not handling your data properly, we would appreciate it if you contacted us first. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk), or, if you live in the European Union, to the data protection authority in your country.

8. How we protect your data

We run our servers ourselves and keep them up to date. Our website and email use encrypted connections, only the people who run Pibbo have access to the data, and we keep backups separately in several locations. If a data breach ever occurred that posed a risk to you, we would inform you and the supervisory authority as the law requires.

9. Data you store with us (data processing agreement)

On your hosting and in your mailboxes you may store personal data of other people – for example visitors to your website, customers of your shop or recipients of your emails. For that data you are the controller and we are the processor. By ordering a service, we enter into this data processing agreement under Article 28 of the UK GDPR (and GDPR):

  • We only process the data to the extent necessary to provide the service you ordered (storage, running, backups and technical support) and only on your instructions, which you give by configuring and using the service.
  • You determine the scope and type of data by what you store on your hosting or in your mailboxes. We do not look at the content unless it is necessary to solve a technical problem you ask us to help with, or the law requires us to.
  • We keep the data confidential and make sure everyone with access to it does the same.
  • We take appropriate technical and organisational measures to protect the data (see “How we protect your data”).
  • You agree that we may use the other processors listed in “Who we share data with” (the data centre and backup storage). We will let you know about any change and you may object to it.
  • We will reasonably help you deal with requests from the people whose data you process and with meeting your obligations under data protection law.
  • We will notify you of any data breach we become aware of without undue delay.
  • When the service ends, we will let you download your data and then delete it, including from backups with their regular rotation, unless the law requires us to keep it.
  • On request, we will give you the information needed to show that we meet these obligations.

10. Final provisions

This policy applies from the date shown below. We may update it reasonably, for example when our services or suppliers change. We will inform customers of significant changes by email in advance.

Matters not covered by this policy are governed by the UK GDPR, the Data Protection Act 2018 and other applicable law.

Effective from 2 November 2026.