Legal / 02

Privacy Policy

• Last updated 14 October 2026
• Version 0.1
• SCB Network Ltd

Draft. This document has not yet been reviewed by a solicitor and is not in force. Highlighted items are details SCB Network still has to confirm.

This policy explains what personal data SCB Network Ltd collects, why, who we share it with, how long we keep it and the rights you have under UK data protection law.

01Who we are

SCB Network Ltd is the controller of the personal data described in this policy. We are registered in England and Wales under company number 16060725, with our registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. Our registration number with the Information Commissioner's Office (ICO) is [ICO registration number].

For any privacy question or request, email [email protected].

This policy covers our website, the client area and our services. It does not cover the data our customers store on our servers about their own visitors or users: for that data the customer is the controller and we act on their instructions (see section 10 of our Terms of Service).

02What we collect

• Account details: name, company name, email address, phone number, postal and billing address, and the contacts you add to your account.
• Sign-in and security data: your password (stored only as a one-way hash), two-factor authentication settings, sign-in times, IP addresses and the devices you sign in from.
• Billing data: orders, invoices, payments, account credit and refunds. Card payments are handled by Stripe: we receive only the card brand, the last four digits, the expiry date and the payment result, never the full card number.
• Domain registrant data: the owner and contact details you give for each domain name, which registries require.
• Certificate validation data: the organisation and contact details a certificate authority needs to validate an SSL certificate.
• Support and communications: tickets, attachments, emails and contact-form messages you send us, and the replies we send.
• Technical data: server and security logs (IP address, browser, pages requested, time), which our systems record to keep the services running and secure.

We collect this data from you directly, from your use of our services, and from Stripe, registries and certificate authorities about the transactions you make through them. We do not buy personal data and we do not use advertising or analytics trackers.

03Why we use it, and our lawful basis

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

04Who we share it with

We never sell your data. We share it only with service providers that help us run our business, under contracts that require them to protect it:

Registries may publish some registrant details in their public WHOIS or RDAP services, depending on their rules. For most generic domains and for individuals using .uk domains, personal details are withheld from public lookup.

We may also share data with professional advisers, with law enforcement or regulators when the law requires it, or with a buyer if our business is sold (in which case this policy continues to apply).

05International transfers

Some of the providers above process data outside the UK. When they do, we make sure the transfer is protected: either the country has UK "adequacy regulations" (as the EU/EEA does), the provider is certified under the UK Extension to the EU-US Data Privacy Framework, or we use the ICO's International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. [Confirm the safeguard used for the server location, for example an IDTA if servers are outside the UK and EEA.] You can ask us for a copy of the relevant safeguards.

06How long we keep it

07How we protect it

All traffic to our website and client area is encrypted. Passwords are stored only as salted hashes, two-factor authentication is available on every account, staff access is limited to what each role needs, and our servers are monitored and patched. No system is perfectly secure; if a breach puts your rights at high risk, we will tell you and the ICO as the law requires.

08Your rights

Under the UK GDPR you have the right to:

• access the personal data we hold about you and get a copy;
• have inaccurate data corrected (most details can be changed yourself in the client area);
• have data erased where we no longer have a reason to keep it;
• restrict how we use your data in certain cases;
• object to processing based on our legitimate interests, and to direct marketing at any time;
• data portability: receive data you gave us in a machine-readable format; and
• withdraw consent where we rely on it, without affecting earlier processing.

To use any of these rights, email [email protected]. We will reply within one month and may ask you to confirm your identity. There is normally no charge.

09Complaints

If you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113.

10Children, cookies and changes

Our services are not intended for anyone under 18 and we do not knowingly collect their data.

The few cookies we use are described in our Cookie Policy.

We will update this policy when our practices change. Significant changes will be emailed to account holders before they take effect.