DrivenHost ("we", "us") is committed to handling personal information responsibly and in accordance with the laws that apply to you: Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and provincial equivalents; United States federal and state privacy laws, including the California Consumer Privacy Act as amended by the CPRA and similar laws in other states; and the EU and UK General Data Protection Regulation (GDPR) for residents of the European Economic Area and the United Kingdom. This policy explains what we collect, why, and the choices you have. It applies to our website, client area, support channels and the Services.
1. Two roles: controller and processor
For the information you give us to run your account, we are the controller: we decide how it is used. For the data you store on our servers (your website's content, your mailboxes, your databases), you are the controller and we are a processor acting on your instructions. We do not access, mine or sell data you store with us; we touch it only to provide the Services, to give support you have requested, or to keep the platform secure. Customers who need a written processing agreement can rely on our Data Processing Addendum.
2. What we collect
Account information. Name, company, email address, billing address, and the last four digits and expiry of any payment card (full card details are held by our payment processor, not by us).
Service and technical data. Domain names, IP addresses, server logs (which record requests to your hosted sites and to our systems, including visitor IP addresses, timestamps and user agents), resource usage, and the configuration of your Services.
Support and communications. The content of tickets, emails and chat with us, and notes our engineers make while resolving them.
Website usage. Basic, privacy-respecting analytics on drivenhost.com (page views and referrers, aggregated). We do not use advertising trackers. Fonts are loaded from Google Fonts, which may record your IP address; see Google's privacy policy.
Contact form. What you type into it: name, email, phone number if you choose to give one, current host and your message.
3. Why we use it
To provide, bill for and support the Services; to secure the platform and detect abuse (logs are essential for this); to communicate with you about your account, renewals, maintenance and incidents; to comply with legal obligations, including tax records and responses to valid legal process; and, with your consent, to send occasional product news, which you can stop at any time with one click.
Our legal bases under the GDPR, where it applies, are performance of a contract, our legitimate interests in running a secure and reliable service, legal obligation, and consent for marketing.
4. Who we share it with
We share personal information only with: our payment processor, to take payment; our domain registrar and the relevant registry, to register domains in your name (registries require registrant contact details, which are protected by privacy services where the registry allows); our data centre and infrastructure providers, who host equipment but do not access your data; professional advisers where necessary; and authorities where required by law. We never sell personal information and we do not share it with advertisers.
5. Where it is stored
We operate infrastructure in Canada, the United States and the European Union. Account and billing information is held in Canada. Content you host is stored in the region your Service is provisioned in; encrypted backups may be replicated to another of our regions. Where personal data of EU or UK residents is transferred outside the EEA or UK, we rely on the European Commission's adequacy decision for Canada and on Standard Contractual Clauses (with the UK Addendum) for transfers to the United States. Copies of the clauses are available on request.
6. How long we keep it
Account and billing records are kept for the life of the account and for seven years afterwards, as required for tax purposes. Server logs are kept for 90 days unless needed for an ongoing security investigation. Support history is kept for the life of the account plus two years. Content you store with us is deleted within 30 days of your account closing, including from backups. Contact-form enquiries that do not become accounts are deleted after 12 months.
7. How we protect it
Access to customer data is limited to engineers who need it to do their job, authenticated with multi-factor authentication and logged. Data is encrypted in transit. Backups are encrypted at rest and stored off-site. We review access regularly and we will notify you without undue delay if we become aware of a breach that affects your personal information, as the law requires.
8. Your rights
Everyone can access, correct or export the personal information we hold about them through the client area or by contacting us, ask us to delete it subject to our legal retention obligations, and withdraw consent to marketing at any time. We will respond to requests within 30 days (45 days where a state law allows). We will never discriminate against you for exercising a privacy right.
Canada. You may complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner.
United States. Residents of California and other states with comprehensive privacy laws have the rights to know what personal information we collect and how it is used and shared, to delete it, to correct it, to opt out of its sale or sharing, and to limit use of sensitive personal information. We do not sell personal information, share it for cross-context behavioural advertising, or use sensitive personal information for any purpose other than providing the Services, and we have not done so in the preceding 12 months. You may designate an authorised agent to make a request for you; we will verify the request against the information on your account.
EEA and UK. You also have the rights to restrict or object to processing, to data portability, and to lodge a complaint with your supervisory authority. Our legal bases for processing are set out in section 3.
9. Cookies
Our website uses only strictly necessary cookies: a session cookie to keep you signed in to the client area and a preference cookie to remember settings. Because we set no analytics, advertising or tracking cookies, no consent banner is required under the EU ePrivacy rules, and no "Do Not Track" or Global Privacy Control signal changes what we do, since we already do not track you.
10. Children
Our Services are for businesses and adults. We do not knowingly collect personal information from anyone under 18, or under 16 in the EEA, and we do not sell the personal information of anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.
11. Contact
Privacy questions and requests should be sent to the support address on the Contact page with "Privacy" in the subject line. Our privacy officer will respond. Where required under the GDPR we will appoint a representative in the EU and UK and publish their details here.
12. Changes
We will post changes to this policy here and, for material changes, notify account holders by email at least 30 days before they take effect.