Privacy Policy

Data controller: Little Moo Limited, company number 16986790, Radcliffe House, Blenheim Court, Warwick Road, Solihull B91 2AA, United Kingdom

Information Commissioner's Office registration number: ZC168766

Privacy requests and data protection complaints: privacy@littlemoogroup.co.uk. General enquiries: contact@littlemoogroup.co.uk. Telephone: 0300 124 6935.

Legal Centre: https://www.littlemoohosting.com/legal/

This Privacy Policy explains how Little Moo Limited collects, uses, shares and protects personal data, and sets out your rights. In this policy, Data Protection Legislation means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003, in each case as amended, including by the Data (Use and Access) Act 2025, together with any legislation which replaces or supplements them. Guidance and codes of practice issued by the Information Commissioner are not legislation, but we take them into account where appropriate.

1. Introduction and Who we Are

1.1

Little Moo Limited is a private limited company registered in England and Wales with company number 16986790. Our registered office is at Radcliffe House, Blenheim Court, Warwick Road, Solihull B91 2AA, United Kingdom. We operate remotely from our registered office and meetings are available by appointment only.

1.2

We are the controller of the personal data described in this policy, except where we say otherwise in section 3.

1.3

We are registered with the Information Commissioner's Office under registration number ZC168766.

1.4

We have not appointed a data protection officer because we are not required to do so under Article 37 of the UK GDPR. Responsibility for data protection within our business sits with our management, who can be reached at privacy@littlemoogroup.co.uk.

1.5L

ittle Moo Hosting is a trading division of Little Moo Limited and is not a separate company.

2. Scope of This Policy

2.1

This policy applies to personal data we process about visitors to our websites, prospective customers, customers and their staff, suppliers, subcontractors and freelance associates, applicants and other individuals who contact us.

2.2I

t covers https://www.littlemoohosting.com, the Little Moo Hosting client portal, support-ticket system and hosting services.

2.3

It does not cover websites operated by our customers which we have designed, built, maintained or hosted. Those websites are controlled by our customers, who are responsible for their own privacy notices.

2.4

It does not cover third party websites linked from our websites. Those sites have their own privacy notices.

3. Our Role as Controller and as Processor

3.1

We act as a controller in relation to personal data we process for our own purposes. That includes account administration, billing and payment, support records and correspondence, security monitoring, abuse prevention and fraud detection, complaints handling, and compliance with our legal and regulatory obligations, as well as data about website visitors, enquirers, suppliers and subcontractors. This policy explains that processing.

3.2

We act as a processor in relation to personal data contained within a customer's website, database, mailbox, form submissions, backups or other material stored on or processed through our services, or which we process while carrying out design, development, maintenance or marketing work. In that case our customer is the controller, our customer's own privacy notice applies to the individuals concerned, and our processing is governed by our Data Processing Agreement.

3.3

A single record may contain both categories of data. A support ticket, for example, may include information we hold to administer your account and respond to you, for which we are the controller, and personal data belonging to your own customers which we access only in order to carry out work you have instructed, for which we are the processor. Our role depends on why and how the particular information is being processed rather than on where it is stored.

3.4

If you believe your personal data is held on a website we host for one of our customers and you wish to exercise your rights, you should contact the operator of that website. If you cannot identify or reach them, contact us at privacy@littlemoogroup.co.uk and we will pass your request to our customer.

3.5

Our payment providers, Stripe and PayPal, decide how and why they process payment data and act as independent controllers in that respect. Their own privacy notices apply to that processing.

4. Personal Data we Collect Directly from You

4.1

Depending on how you interact with us, we may collect:

(a)

identity data, including your full name, the name of your business, your job title and, where relevant to a domain registration, your registrant details;

(b)

contact data, including your postal address, billing address, delivery address, email address and telephone number;

(c)

account data, including your username, password in hashed form, account preferences and portal settings;

(d)

transaction data, including details of services and products you have purchased, invoices, receipts, purchase orders and payment records, but not full payment card numbers;

(e)

service data, including domain information, hosting account information, DNS records, mailbox information, website content and configuration details you provide to us;

(f)

communications data, including support tickets, emails, website enquiry and contact form submissions, telephone call notes and correspondence;

(g)

artwork and project data, including copy, images, logos and other materials you supply for a design, development or print project; and

(h)

marketing data, including your marketing preferences and the record of any consent you have given or withdrawn.

4.2

You are not obliged to provide personal data to us, but if you do not provide the data we need in order to enter into or perform a contract with you, we may be unable to supply the services you have requested.

5. Personal Data we Collect Automatically

5.1

When you visit our websites or use our services, we and our service providers may automatically collect:

(a)

technical data, including your internet protocol address, browser type and version, operating system, device type, screen settings, language settings and time zone;

(b)

usage data, including pages viewed, referring pages, dates and times of access, session duration and interactions with our websites;

(c)

server log data generated by our hosting infrastructure, including request records, error records and security events; and

(d)

cookie and similar technology data, as described in section 11 and in our Cookie Policy.

5.2

Internet protocol addresses and server log data are personal data in some circumstances. We use them for security, fault diagnosis, abuse prevention and the operation of our services.

5.3

We do not use automated technology to build a detailed profile of you for advertising purposes across other websites.

6. Personal Data we Receive from Third Parties

6.1

We may receive personal data about you from:

(a)

our payment providers, Stripe and PayPal, including confirmation of payment, the last four digits of a card, the card type and the outcome of fraud screening;

(b)

our accounting software provider, Xero, in connection with invoicing and reconciliation;

(c)

our hosting infrastructure supplier and domain registrars, in connection with the provisioning, transfer, abuse handling and renewal of services;

(d)

your colleagues or your organisation, where they supply your contact details as a project or billing contact;

(e)

publicly available sources such as Companies House and business websites, where we verify business details; and

(f)

third parties who report abuse, complaints or alleged infringement relating to a service we provide.

6.2

Where a customer supplies us with the personal data of its own staff or contacts, that customer is responsible for informing those individuals and for having a lawful basis to share the data with us.

7. Special Category Data and Criminal Offence Data

7.1

We do not seek to collect special category personal data as defined in Article 9 of the UK GDPR, which includes data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, data concerning health, and data concerning a person's sex life or sexual orientation.

7.2

We do not routinely process criminal offence data. We may process limited information about alleged unlawful activity where it is necessary to investigate an abuse report or to respond to a legal claim or a request from a law enforcement authority.

7.3

Please do not send us special category data in support tickets, enquiry forms or project materials unless we have specifically asked for it. If you provide such data to us in a website you ask us to build, host or maintain, you are the controller of it and you must ensure that a condition under Article 9 of the UK GDPR applies.

8. Why we use Your Personal Data and Our Lawful Bases

8.1

We use personal data for the following purposes, relying on the lawful bases indicated:

(a)

to respond to enquiries and provide quotations, on the basis that it is necessary for steps taken at your request before entering into a contract, or on the basis of our legitimate interests where you enquire on behalf of an organisation;

(b)

to enter into and perform our contract with you, including provisioning services, delivering projects, providing support and managing your account, on the basis that processing is necessary for the performance of that contract;

(c)

to process payments, issue invoices and collect sums due, on the basis of contractual necessity and our legitimate interest in recovering debts;

(d)

to register, renew, transfer and administer domain names, on the basis of contractual necessity and, in respect of disclosure to registries, our legal obligations and legitimate interests;

(e)

to operate, secure, monitor and improve our websites, infrastructure and services, on the basis of our legitimate interests;

(f)

to prevent, detect and investigate fraud, abuse, spam, malware and security incidents, on the basis of our legitimate interests and, where applicable, our legal obligations;

(g)

to send service messages, including renewal reminders, maintenance notices, security notices and changes to our terms, on the basis of contractual necessity and our legitimate interests;

(h)

to send marketing communications, on the basis of consent or the soft opt in described in section 12, and of our legitimate interests in respect of corporate subscribers;

(i)

to keep accounting, tax and business records, on the basis of our legal obligations;

(j)

to handle complaints, disputes and legal claims, on the basis of our legitimate interests and our legal obligations; and

(k)

to comply with a court order, a regulatory requirement, a registry policy or a lawful request from a public authority, on the basis of our legal obligations.

8.2

Where we rely on consent, you may withdraw it at any time as described in section 10. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

8.3

If we need to use your personal data for a purpose that is not compatible with the purpose for which it was collected, we will tell you and explain the lawful basis before doing so.

9. Our Legitimate Interests

9.1

Where we rely on legitimate interests, those interests are:

(a)

running, growing and administering our business and our trading divisions;

(b)

understanding how our websites and services are used so that we can improve them;

(c)

protecting our infrastructure, our customers and other internet users from abuse, unsolicited communications, malicious code and security threats;

(d)

maintaining accurate business records and communicating effectively with business contacts;

(e)

promoting our services to businesses and organisations that are likely to be interested in them; and

(f)

establishing, exercising and defending legal claims and protecting our commercial position.

9.2

Before relying on legitimate interests we consider the impact of the processing on you and whether it would override your interests, rights and freedoms. You may object to processing based on legitimate interests as described in section 23.

10. Consent

10.1

Where we rely on your consent, we will ask for it in a clear and specific way and will keep a record of what you consented to and when.

10.2

You may withdraw consent at any time. For privacy related consent withdrawals, email privacy@littlemoogroup.co.uk. For marketing emails, you may also use the unsubscribe link included in the message. For cookies and similar technologies, use the cookie preference control available on our websites. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

10.3

Withdrawing consent will not affect the services you receive under a contract with us, which do not depend on consent.

11. Cookies and Similar Technologies

11.1W

e use cookies and similar technologies on our websites. Full details, including the categories of cookie we use and how to control them, are set out in our Cookie Policy, available at https://www.littlemoohosting.com/legal/cookie-policy/.

11.2

Cookies which are strictly necessary for the operation of our websites and our client portal, including security and session cookies, are set without consent as permitted by regulation 6(4) of the Privacy and Electronic Communications (EC Directive) Regulations 2003.

11.3

Where consent is legally required for a functional, analytics or marketing cookie, that cookie is not set unless you have given consent through our cookie banner. Our Cookie Policy explains the limited exceptions in which consent is not legally required, and identifies the technologies concerned even where consent is not sought. Rejecting non-essential cookies is as easy as accepting them, and you can change your choice at any time.

11.4

Where we implement cookies, analytics or tracking technologies on a website we build for a customer, we do so on that customer's instructions and the customer is the controller of the resulting processing.

12. Marketing Communications

12.1

We may send marketing communications about our services by email where you have consented, or where you have previously bought or negotiated to buy a similar service from us, we obtained your details in the course of that sale or negotiation, and you were given a simple means of opting out at the time and in every message. This is known as the soft opt in and is permitted by regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003.

12.2

Marketing to corporate subscribers, which means limited companies and limited liability partnerships, may be sent on the basis of legitimate interests with an opportunity to object in every message. Sole traders and unincorporated partnerships are treated in the same way as individuals for this purpose and receive marketing only where consent or the soft opt in applies.

12.3

You can opt out of marketing at any time by clicking unsubscribe in any marketing email or by emailing contact@littlemoogroup.co.uk. We will action opt out requests promptly and will keep a suppression record so that we do not contact you again in error.

12.4

Opting out of marketing does not stop service messages such as invoices, renewal reminders, maintenance notices, security notices and notices of changes to our terms, which are necessary for the performance of our contract with you.

12.5

We do not sell personal data and we do not share personal data with third parties for their own direct marketing purposes.

13. Client Portal, Billing and Payments

13.1

Our client portal is operated using WHMCS billing and support software and holds your account details, services, invoices, support tickets and recurring billing arrangements.

13.2

Card payments are processed by Stripe and by PayPal. We do not receive or store full payment card numbers. We receive confirmation of payment together with limited details such as the card type, the last four digits and the outcome of any fraud screening.

13.3

Where you set up a recurring payment mandate, the mandate is held by the relevant payment provider and we hold a reference to it in our billing system.

13.4

We keep records of transactions in our accounting system, Xero, in order to meet our accounting and tax obligations.

13.5

If a payment is disputed or charged back, we may share information about the transaction with the payment provider, your bank or a card scheme in order to respond to the dispute.

14. Support Tickets and Communications

14.1

We keep records of support tickets, emails and notes of telephone calls so that we can respond to you, maintain a history of your services and improve our support.

14.2

We do not routinely record telephone calls. If we ever introduce call recording, we will tell you at the start of the call and will update this policy.

14.3

Please do not send passwords, payment card information or other sensitive information in ordinary emails or in the main body of a support ticket. Where credentials are required, they must be submitted through the designated secure credentials area. Access is restricted to authorised personnel and the credentials are removed when the relevant task is completed, subject to any short technical deletion or backup cycle.

14.4W

e may use approved artificial-intelligence tools to help draft support responses and knowledgebase content. A member of our team reviews the output before it is sent or published. Customer Personal Data is not submitted to an AI provider unless that use has been assessed, the provider is recorded in our current supplier information where required, and appropriate contractual and transfer safeguards are in place. Passwords, credentials and payment-card information must not be submitted to general-purpose AI tools. No decision producing legal or similarly significant effects is made solely by automated means.

15. Hosting, Domains and Registry Data

15.1W

hen you buy hosting or email services, we process account, technical and configuration data in order to provision and support the service. Our United Kingdom hosting plans use infrastructure provisioned in a United Kingdom data centre through an authorised hosting sub-processor. The current Sub-processor Register identifies the providers used, their purposes, processing locations and relevant transfer safeguards.

15.2

When you register, renew or transfer a domain name, we must supply registrant, administrative, technical and billing contact details to the registrar and to the relevant registry. Registry rules require these details to be accurate and kept up to date.

15.3

Registries and registrars may publish or make available registration data through registration data lookup services, or disclose it to third parties, in accordance with their own policies, including the policies of Nominet UK for .uk domain names and the policies of ICANN for generic top level domains. We do not control those policies.

15.4

Where a domain name becomes the subject of a dispute resolution proceeding or a law enforcement request, we may be required to disclose registration data to the registry, the dispute provider or the requesting authority.

15.5

We process abuse reports, security alerts and log data relating to hosted services in order to protect our infrastructure, our customers and third parties.

18. Artificial Intelligence and Automated Decision Making

18.1

We use artificial intelligence tools internally to assist with administration, customer support, knowledgebase creation, website content generation and business operations. Output generated by those tools is reviewed by a member of our team before it is published or sent.

18.2

We do not currently make decisions which produce legal effects concerning you, or which similarly significantly affect you, based solely on automated processing. Where the law requires human review, an explanation, a right to contest a decision or other safeguards in relation to automated processing, we will provide them.

18.3

Automated screening may be applied to payments by our payment providers for fraud prevention purposes, and automated filtering may be applied to email and web traffic for security purposes. Where such a process results in a service being refused or blocked, you may ask us to review it and we will do so manually.

18.4W

e do not supply personal data held in our systems for the purpose of training publicly available models. Any approved AI provider that processes personal data on our behalf is subject to appropriate contractual controls, confidentiality requirements and the supplier assessment described in this policy and our Data Processing Agreement.

19. Who we Share Personal Data with

19.1

We share personal data with the following categories of recipient:

(a)

our hosting infrastructure supplier, which provides the servers and data centre facilities used to deliver our hosting services;

(b)

WHMCS, which provides our client portal, billing and support ticket software;

(c)

Microsoft, which provides our Microsoft 365 email, document and collaboration services;

(d)

Stripe and PayPal, which process payments and which act as independent controllers in respect of payment data;

(e)

Xero, which provides our accounting software;

(f)

domain registrars and registries, including Nominet UK for .uk domain names;

(g)

certification authorities which issue SSL certificates;

(i)

freelance associates and subcontractors engaged to perform part of a project, who are bound by written agreements covering confidentiality, intellectual property and data protection;

(j)

our professional advisers, including accountants, insurers and lawyers, where necessary; and

(k)

law enforcement authorities, regulators, courts and other public authorities, where we are legally required to disclose or where disclosure is necessary to establish, exercise or defend legal claims.

19.2

We may introduce additional processors as our business develops. Where we do so, we carry out appropriate due diligence and put in place a written contract meeting the requirements of Article 28 of the UK GDPR.

19.3

If we sell or transfer part of our business, personal data may be disclosed to the prospective buyer and its advisers, subject to confidentiality obligations, and transferred to the buyer on completion.

19.4

We do not sell personal data.

20. International Transfers

20.1

Personal data is primarily stored within the United Kingdom. Our hosting infrastructure supplier is based in the United Kingdom.

20.2

Some of our service providers, including providers of email, collaboration, payment and accounting services, may process personal data outside the United Kingdom.

20.3

Where personal data is transferred outside the United Kingdom, we ensure that an appropriate safeguard recognised under Chapter V of the UK GDPR is in place. The mechanism relied on depends on the individual supplier, the location of processing and the circumstances of the transfer, and no single mechanism applies automatically to every recipient or to every recipient in a particular country. Depending on the recipient, it may be:

(a)

a determination by the Secretary of State that the receiving country provides an adequate level of protection;

(b)

the International Data Transfer Agreement issued by the Information Commissioner, or the UK Addendum to the European Commission's standard contractual clauses; or

(c)

for a recipient in the United States which is itself certified under the applicable United Kingdom extension of the EU-US Data Privacy Framework, and only where the transfer falls within the scope of that certification, that certification.

20.4

You may request further information about the safeguards applied to a particular transfer by emailing privacy@littlemoogroup.co.uk. The mechanism relied on for each supplier is recorded in our Data Processing Agreement.

21. Security

21.1

We take appropriate technical and organisational measures to protect personal data, including:

(a)

secure hosting infrastructure and encryption of data in transit using transport layer security;

(b)

role based access controls and the principle of least privilege;

(c)

strong authentication for administrative access and secure password management;

(d)

secure backups and a documented restore process;

(e)

regular application of software and security updates;

(f)

activity monitoring, logging and alerting; and

(g)

written confidentiality and data protection obligations in our contracts with staff, subcontractors and suppliers.

21.2

No system can be guaranteed to be completely secure. You are responsible for keeping your own credentials confidential and for the security of the devices you use.

21.3

We have procedures to deal with suspected personal data breaches. We investigate promptly and, where a breach is likely to result in a risk to the rights and freedoms of individuals, we will notify the Information Commissioner's Office within 72 hours of becoming aware of it, and will notify affected individuals where the breach is likely to result in a high risk to them, as required by Articles 33 and 34 of the UK GDPR.

21.4

Where we act as a processor, we will notify the relevant controller without undue delay after becoming aware of a personal data breach affecting their data.

22. How Long we Keep Personal Data

22.1

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy contractual, legal, taxation, accounting and regulatory obligations, and to establish, exercise or defend legal claims. The periods below are the periods we normally apply. Exact deletion timing depends on our technical systems and on our backup rotation cycle.

22.2

Our general retention periods, which we apply normally rather than to the day, are:

(a)

enquiries that do not result in a contract: 12 months from the last contact;

(b)

customer account, contract and project records: 6 years from the end of the relationship, reflecting the limitation period for contractual claims in England and Wales;

(c)

accounting and tax records: 6 years from the end of the accounting period to which they relate, in accordance with the Companies Act 2006 and applicable tax legislation;

(d)

support tickets and correspondence: 3 years from closure, unless relevant to an ongoing service or dispute;

(e)

server and security logs: normally up to 12 months, unless retained longer for the investigation of a specific incident;

(f)

marketing records, including consents and objections: for as long as we market to you, and thereafter a suppression record indefinitely so that we can honour your objection; and

(g)

domain registration data: for the period required by the registry, and thereafter in our contract records.

22.3

Where we hold data as a processor on behalf of a customer, the retention period is determined by that customer and is set out in our Data Processing Agreement.

22.4

When personal data is no longer required, we generally delete it or anonymise it so that it can no longer be associated with you. Residual copies may remain temporarily within backup systems until they are removed through the normal backup rotation cycle, and remain subject to the same access controls until they are.

23. Your Rights

23.1

Under the UK GDPR you have the following rights, which apply in the circumstances set out in the legislation:

(a)

the right to be informed about how we use your personal data, which this policy is intended to satisfy;

(b)

the right of access to a copy of the personal data we hold about you;

(c)

the right to rectification of inaccurate or incomplete personal data;

(d)

the right to erasure of your personal data in certain circumstances;

(e)

the right to restrict processing in certain circumstances;

(f)

the right to data portability in respect of data you provided to us which we process by automated means on the basis of consent or contract;

(g)

the right to object to processing based on legitimate interests, and an absolute right to object to direct marketing at any time; and

(h)

the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you.

23.2

To exercise any of these rights, email privacy@littlemoogroup.co.uk or write to us at our registered office. Please tell us which right you wish to exercise and give us enough information to identify you and locate the data.

23.3

We do not charge a fee for responding to a request unless it is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act, and we will explain why.

23.4

We may need to verify your identity before acting on a request. We will respond within one month of receiving a valid request. If your request is complex or you have made a number of requests, we may extend that period by up to two further months and will tell you within the first month if we do.

23.5

Some rights are qualified. For example, we may be unable to erase data which we are required to retain for accounting or legal purposes, or which is held on behalf of a customer as processor rather than as controller.

24. Children's Personal Data

24.1

Our services are intended for customers aged 18 or over. Our websites are not directed at children and we do not knowingly collect personal data relating to children.

24.2

If you believe that a child has provided personal data to us, please contact us at privacy@littlemoogroup.co.uk and we will take steps to delete it.

24.3

Where a customer asks us to build, host or maintain a website which is likely to be accessed by children, that customer is the controller of the resulting processing and is responsible for its own compliance, including with the Information Commissioner's Age Appropriate Design Code where it applies.

25. Changes, Contact and Complaints

25.1

We may update this policy from time to time. The version number, publication date and effective date at the top of this policy show which version applies and from when, and a summary of material amendments is included there. Where a change is material we will notify customers by email.

25.2

If you have any question about this policy or about how we handle personal data, please contact us at privacy@littlemoogroup.co.uk, by telephone on 0300 124 6935, or by post at Little Moo Limited, Radcliffe House, Blenheim Court, Warwick Road, Solihull B91 2AA, United Kingdom.

25.3

We treat any complaint about how we have handled personal data as a data protection complaint, whichever address it arrives at, and we handle it as follows. We will:

(a)

acknowledge it within 2 Business Days of receipt, and in all cases within any applicable statutory period;

(b)

take appropriate steps to investigate it, including reviewing the processing concerned and the records relating to it;

(c)

keep you informed where the investigation is ongoing, and tell you if we need longer and why;

(d)

communicate the outcome to you without undue delay, explaining what we found and what we have done; and

(e)

retain a record of the complaint, the investigation and the outcome, in accordance with section 22.

Our full Complaints Procedure is available at https://www.littlemoohosting.com/legal/complaints/. We would like the opportunity to resolve any concern before you approach the regulator, but you do not have to contact us first.

25.4

You also have the right to lodge a complaint with the Information Commissioner's Office, the United Kingdom supervisory authority for data protection, at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, by telephone on 0303 123 1113, or at https://www.ico.org.uk.