PRIVACY AND COOKIE POLICY IWIHOST

Effective date: 07.10.2026

1. Who we are and what this policy covers

1.1. This Privacy and Cookie Policy ("Policy", referred to in the Terms of Service as the "Privacy Policy") explains how HOST TELECOM LTD., a company incorporated in the United Kingdom, operating under the brand IWIHOST ("we", "us", "the Company"), collects, uses, stores, shares and protects personal data in connection with the website iwihost.net and any associated sub-domains, applications and services (the "Platform"). We are the controller of the personal data described in this Policy, and our registered office address is stated on the Platform.

1.2. This Policy applies to visitors to the Platform and to registered Account holders, including the persons who act on behalf of legal entities. It forms part of the Agreement and should be read together with the Terms of Service. It does not apply to data that you place on your VPS or VDS, which is governed by section 12.

1.3. Personal data is collected and processed lawfully, fairly, securely and, where consent is the basis for processing, on the basis of your informed consent.

1.4. By accessing or using the Platform you confirm that you have read and understood this Policy. Where the processing of particular data requires your consent, that consent is requested separately and this clause does not replace it.

2. Definitions

2.1. Terms defined in the Terms of Service at https://iwihost.net/terms-of-service have the same meaning in this Policy, unless otherwise stated or unless the context requires otherwise.

2.2. "Personal data" means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, an IP address, an account number, a payment instrument or a wallet address, or to one or more factors specific to the identity of that person.

2.3. "Processing" means any operation performed on personal data, whether or not by automated means, including but not limited to collection, recording, organisation, storage, alteration, retrieval, consultation, use, disclosure, transmission, restriction, erasure and destruction.

2.4. "Controller" and "processor" have the meaning given to them in applicable data protection law.

2.5. "Performance of our contract with you" means that the processing is necessary in order to provide the Services you have requested, to give effect to the Terms of Service, or to take steps at your request before you enter into them. Where processing is carried out on this basis and you decline to provide the data concerned, we may be unable to open or maintain your Account or to provide the Service in question.

2.6. "Compliance with our legal obligations" means that the processing is necessary in order to comply with an obligation to which we are subject, including but not limited to accounting and tax requirements, sanctions requirements, record keeping and responding to lawful requests of courts and other competent authorities. Processing on this basis is not optional and cannot be objected to. Where you decline to provide the data concerned, we may be required to restrict your access to the Platform.

2.7. "Our legitimate interests" means that the processing is necessary for purposes pursued by us or by a third party, provided that those purposes are not overridden by your interests or rights. The interests we rely on are the protection of the Platform, of our infrastructure and of other customers and third parties, the prevention and detection of fraud and abuse, the handling of abuse complaints, the security and availability of our systems, the protection of our legal rights and the operation and improvement of our services.

2.8. "Your consent" means that you have given a freely given, specific, informed and unambiguous indication of your agreement to the processing, by a statement or by clear affirmative action.

3. Data we collect and collection purpose

3.1. In order to provide the Services, we process personal data relating to you. The table below is an overview of the categories of personal data processed, the purposes of such processing and the basis on which it is carried out.

Data type	Example of data collected	Collection purpose	Basis of collection
Registration data	Full name, residential or legal address, email address, telephone number, company name and registration number, name of the authorised person, username, password in encrypted form.	Creating and administering your Account, providing the Services you request, communicating with you about the Services.	Performance of our contract with you.
Purchase and payment data	Services purchased, invoices, billing records, payment status, transaction identifiers, amounts and currencies, type of payment method, and cryptocurrency wallet addresses and transaction hashes where you pay in cryptocurrency. Bank card data is processed by payment providers.	Processing payments, invoicing, refunds and chargebacks, accounting and tax.	Performance of our contract with you, compliance with our legal obligations.
Service data	Plan, server location and operating system selected, IP addresses assigned to you and records of the binding of IP addresses to servers over time, dates of activation and termination.	Providing the Services and assigning IP addresses, responding to abuse complaints concerning IP addresses.	Performance of our contract with you, our legitimate interests in responding to abuse.
Technical data	IP addresses used to log in to your Account and date and time of access.	Securing your Account and our infrastructure, preventing fraud and unauthorised access, diagnosing problems.	Our legitimate interests in security and the prevention of fraud, compliance with our legal obligations.
Abuse and security data	Abuse complaints concerning your Services, results of our investigation and measures taken.	Investigating abuse, incidents and attacks, protecting our infrastructure and third parties, cooperating with data centres, network operators and authorities.	Our legitimate interests in protecting our infrastructure and third parties, compliance with our legal obligations.
Communication data	Support tickets, correspondence, complaints and records of their handling.	Responding to your enquiries, handling complaints and disputes, keeping evidence.	Performance of our contract with you, our legitimate interests in handling abuse and keeping evidence.
SSL certificate data	Domain names, organisation details, contact details and validation documents supplied for a certificate.	Obtaining, validating and managing certificates through certificate suppliers and CAs.	Performance of our contract with you.
Marketing data	Marketing preferences, records of consent given and withdrawn.	Sending marketing communications and ensuring that they are not sent after you withdraw consent.	Your consent, which may be withdrawn at any time.
Website and cookie data	Cookie identifiers, pages visited, referral source, referral link identifiers.	Operating the website, remembering your preferences, measuring use of the Platform, attributing referrals under our affiliate programme.	Our legitimate interests in operating and improving the Platform, your consent for cookies other than strictly necessary cookies.
Data obtained from third parties	Information provided by payment providers, certificate suppliers and CAs, persons who submit abuse complaints, authorities and, where relevant, our affiliate partners.	Processing payments, issuing certificates, investigating abuse, complying with information requests, crediting referrals.	Performance of our contract with you, our legitimate interests, compliance with our legal obligations.

3.2. In addition to the categories of personal data set out in the table above, we may in exceptional cases need to collect further personal data relating to you. We do so only where it is necessary, only to the extent required in the circumstances, and only for the purposes set out in clause 3.1.

3.3. Such additional collection may arise where:

(a) we are required to do so in order to comply with a legal or regulatory obligation applicable to us;

(b) we receive a request or direction from a competent regulatory, tax, law enforcement or judicial authority;

(d) you request a service, feature or payment method for which the data set out in the table above is not sufficient.

3.4. Where additional personal data is collected under clause 3.2, we will inform you in advance of the data required and the reason for the request, save where we are prohibited from doing so by law or where notification would prejudice an investigation by a competent authority. Such data is processed only for the purpose for which it was collected and is retained in accordance with section 7.

4. Automated processing

4.1. Unless required by applicable law, we do not undertake any general monitoring of the content of traffic or the activity of End Users on your servers. The Platform and Accounts on the Platform are protected by technical measures, which may include automated detection of unauthorised login attempts. Data centres and network operators may apply their own network-level protection under their own policies.

4.2. Automated monitoring may result in the restriction of network access, the suspension of a Service or the blocking of an Account. You may request a review of a decision with a significant effect on you by contacting us at support@iwihost.net.

5. Who we share your data with

5.1. We may share personal data, to the extent necessary for the relevant purpose, with:

(a) payment service providers, banks and, in respect of cryptocurrency payments, the processors of those payments;

(b) data centres and network operators that support the Services;

(d) persons who submit abuse complaints, to the extent necessary to handle the complaint;

(e) providers of hosting, communications, customer support and analytics services engaged by us, who act on our instructions and are bound by confidentiality and data protection obligations;

(f) professional advisers, auditors and insurers;

(g) law enforcement authorities, courts and other regulatory, tax or competent authorities where we are required or permitted to make disclosure, as described in clause 5.3;

(h) a purchaser or prospective purchaser of our business or assets, subject to appropriate confidentiality undertakings.

5.2. We do not sell personal data.

5.3. We may disclose information that we hold, including information about you and Content, where requested by law enforcement authorities or required by a court, applicable law or regulation, may report suspected unlawful activity to authorities on our own initiative, and may disclose information to providers, CAs and registries as reasonably necessary for handling abuse.

6. International transfers

6.1. The Services are provided from infrastructure in several countries, and our service providers may be located outside the country in which you are resident, so your personal data may be transferred to and processed in other jurisdictions.

6.2. Where such a transfer takes place, we put in place appropriate safeguards to protect your data, which may include adequacy regulations, the International Data Transfer Agreement or Addendum, binding corporate rules, risk assessments or another lawful transfer mechanism with the recipient.

7. How long we keep your data

7.1. Payment, invoice and billing records are retained during the Agreement and for the period required by accounting and tax law.

7.2. Account data, IP addresses used to log in, records of the binding of IP addresses to servers, abuse and security records, support tickets and correspondence are retained during the Agreement and for up to 36 months after its termination, unless a longer period is required by applicable law or is necessary for pending claims, investigations or legal obligations.

7.3. Records of marketing preferences and consent are retained until you withdraw consent and for as long as necessary to evidence it. Cookie data is retained for the lifetime of each cookie.

7.4. Content placed on your VPS or VDS is deleted following termination as provided in clause 12.3 of the Terms of Service. After the applicable period personal data is deleted or anonymised, and after final deletion recovery may be impossible.

8. Security

8.1. We apply technical and organisational measures appropriate to the risk, including network protection, access restrictions and protection of Accounts by password.

8.2. Access to your Account is protected by your password. You are responsible for keeping your credentials confidential.

8.3. No system can be guaranteed to be entirely secure. Where a security incident affecting personal data occurs, we report it to the Information Commissioner's Office where required within 72 hours of becoming aware of it and notify affected Account holders where required and without undue delay.

9. Your rights

9.1. Subject to the data protection law applicable to you, you may request access to the personal data we hold about you, request correction of inaccurate data, request erasure of data that we are no longer required to retain, object to or request restriction of certain processing, request the transfer of certain data in a portable format, and withdraw consent where processing is based on consent.

9.2. Requests should be sent to support@iwihost.net. We will respond within one month, which we may extend where the law permits, and may ask you to verify your identity before doing so.

9.3. Certain rights are limited. In particular, we cannot erase records that we are required to retain under clause 7.1, and we cannot give effect to a request that would prevent us from complying with our legal obligations.

9.4. If you are dissatisfied with our handling of your request or of your personal data, you may complain to us at support@iwihost.net, and we will acknowledge and handle the complaint in accordance with applicable law. You may also complain to the Comission in the United Kingdom or to the data protection authority of your country.

10. Marketing

10.1. We send marketing communications only where you have consented to receive them. You may withdraw consent at any time from your Account settings or by using the unsubscribe link in any marketing message.

10.2. Withdrawal of marketing consent does not affect service, security or legal communications, which continue for as long as your Account remains open.

11. Cookies and similar technologies

11.1. We use cookies and similar technologies to operate the Platform, to remember your preferences, to secure your session and to measure use of the Platform.

11.2. We use the following categories:

(a) strictly necessary cookies, which are required for the Platform to function and cannot be disabled;

(b) functional cookies, which remember your settings;

(d) referral cookies, which are used to attribute referrals under our affiliate programme.

11.3. Cookies other than strictly necessary cookies are set only where you have given consent through the consent banner presented when you first access the Platform.

11.4. Most browsers allow you to block or delete cookies. Blocking strictly necessary cookies will prevent parts of the Platform from functioning.

12. Data on your VPS or VDS

12.1. You are responsible for the data placed on your VPS or VDS. We are not the owner or author of the content you place on a server. You decide what data to place on the server and are responsible for the lawfulness of its processing and storage, including notices to individuals, lawful bases and data subject requests.

12.2. As between the parties, you are the controller of that data and we act as your processor, on your documented instructions given by the Agreement and your use of the Services. We access it only as necessary to provide the Services, ensure security, handle abuse and comply with lawful requests.

12.3. As your processor we will:

(a) process the data only on those instructions, unless required by law;

(b) ensure that persons authorised to process it are bound by confidentiality;

(d) engage sub-processors, including data centres, on terms no less protective than this section;

(e) assist you, at your cost, with data subject requests and security incidents;

(f) delete or return the data on termination as provided in clause 12.3 of the Terms of Service, unless law requires retention;

(g) make available information reasonably necessary to demonstrate compliance.

13. Changes to this policy

13.1. We may amend this Policy. The amended version is published on the Platform with an effective date.

13.2. Where a change materially affects how we use your data, we notify you at your registered email address before it takes effect, where required by law.

13.3. By continuing to use the Platform after an amended version of this Policy has taken effect, you confirm that you have read the amended version.

14. Contact

14.1. HOST TELECOM LTD., a company incorporated in the United Kingdom, operating the website iwihost.net under the brand IWIHOST.

Questions about this Policy and requests concerning your data should be addressed to support@iwihost.net.