Section 01
Twerple Ltd is the data controller for the personal data described in this policy. We are registered in England and Wales under company number 17433914, and our registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. For anything to do with your personal data, email support@twerple.com or write to us at that address.
This policy covers the personal data we hold about the people we deal with directly: visitors to twerple.com, customers and their authorized contacts, people who contact our support team, and people who apply to work with us. Personal data stored on your own websites and servers is covered separately in section 10.
In plain English
We collect what we need to run your account, bill you, register your domains and help you when you ask. We do not sell your data, we share it only with the partners needed to provide the service, and you can see, correct or delete it by asking us.
Section 02
We collect personal data when you give it to us, when it is created by your use of our services, and in a few cases from third parties such as our payment partner.
Account and contact details
Your name, email address, postal address, phone number, company name and the password you choose (stored in a hashed form that we cannot read). If you add authorized contacts, their names and email addresses.
Orders and billing
The services you order, your invoices and payment history, and your billing address. Payments are handled by our payment partners, Paddle (card payments) and PayPal; we receive confirmation of the payment and, for cards, the last digits of the card number, never the full number. If you pay by bank transfer to our IBAN, we see the payer name, IBAN and payment reference that appear on our bank statement.
Domain registration details
The registrant, administrative and technical contact details required by domain registries. Where the registry allows, WHOIS privacy replaces your details in the public record with those of a privacy service.
Support conversations
Support tickets, emails and live chat messages, including conversations with Milo, our AI support assistant, and any files you attach to them.
Technical and usage data
IP addresses, browser and device type, the pages you visit on twerple.com, the time of your sign-ins, and server and access logs created when you use our services. With your consent, website analytics (see section 4).
Job applications
If you apply for a role, the details and CV you send us. These are used only to consider your application and are deleted after 12 months unless you ask us to remove them sooner.
We do not ask for, and do not want, special category data such as health, religious or political information. Please do not include it in support messages.
Section 03
The UK GDPR requires us to have a lawful basis for every use of your personal data. These are ours:
To provide what you have bought (performance of a contract)
Creating and running your account, setting up hosting and servers, registering and renewing domains, issuing SSL certificates, sending invoices and service notices, and answering your support requests.
Because the law requires it (legal obligation)
Keeping accounting and tax records, meeting the identity and contact requirements of domain registries, and responding to lawful requests from courts, regulators and law enforcement.
To run a safe, reliable service (legitimate interests)
Protecting our platform and customers against fraud, abuse and attacks; monitoring and improving performance; investigating complaints; and sending you information about changes to the services you already use. We balance these interests against your rights, and you can object at any time (section 9).
Because you have agreed (consent)
Marketing emails about new products and offers, and non-essential cookies such as analytics. You can withdraw consent at any time: every marketing email has an unsubscribe link, and cookie preferences can be changed as described in section 4.
We do not use your personal data for automated decisions that have a legal or similarly significant effect on you. Our AI support assistant suggests answers to your questions; it does not make decisions about your account.
Section 04
Cookies are small files a website stores in your browser. We use two kinds:
- Essential cookies keep you signed in, remember what is in your cart, protect forms against forgery and let the live chat work. The site cannot function without them, so they do not require consent.
- Analytics cookies (Google Analytics) help us understand which pages are visited and how people move through the site, so we can improve it. They are set only if you agree. Google processes this data on our behalf; IP addresses are truncated and we do not use advertising features. You can also block Google Analytics in every browser with Google’s opt-out add-on.
You can change or withdraw your cookie choice at any time, and you can delete or block cookies in your browser settings. Blocking essential cookies will stop parts of the client area from working. We do not use advertising or social media tracking cookies on twerple.com.
Section 05
We do not sell, rent or trade personal data. We share it only with the companies that help us provide our services, each of which is bound by a contract to protect it and to use it only on our instructions, and where the law requires us to.
Domain registration: Namecheap and the registries
To register a domain we must pass the registrant contact details to our registrar partner, Namecheap, which in turn passes them to the registry for that extension and, where required, to ICANN-approved escrow providers. Registries publish some of this data in WHOIS unless privacy protection is applied.
Payments: Paddle, PayPal and our bank
Card payments are processed by Paddle.com Market Ltd, and PayPal payments by PayPal. Each receives your name, email address, billing address and payment details to take the payment, prevent fraud and handle any taxes due, and each has its own privacy policy that applies to that processing. Bank transfers are handled by our bank, which processes the payer details that accompany the payment.
Infrastructure: data centre and server providers
Our servers are located in data centres in the United Kingdom, Germany, France and the United States. Some VPS servers are provisioned on infrastructure provided by Contabo GmbH in Germany. These providers host the equipment; they do not access the data on it.
Support assistant and analytics: Google
Messages you send to Milo, our AI support assistant, are processed by Google’s Gemini service to generate a reply. Website analytics, where you have consented, are processed by Google Analytics. Google acts as our processor and may not use this data for its own purposes.
Email delivery
Invoices, notices and support replies are sent through an email delivery provider, which handles your email address and the content of the message for the purpose of delivering it.
We may also disclose personal data where we are legally required to, for example to a court, regulator or law enforcement agency, to enforce our terms or protect the rights, property or safety of Twerple, our customers or others, and, if our business is sold or merged, to the new owner under the same protections.
Section 06
Most of your data is stored in the United Kingdom and the European Union. The UK Government recognizes the EU as providing adequate protection for personal data, so transfers to our German and French data centres need no further safeguards.
Some partners process data in the United States, including Namecheap, Google, PayPal and our US data centre. Where that happens we rely on the UK Extension to the EU-US Data Privacy Framework, where the partner is certified under it, or on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for details of the safeguard that applies to a particular transfer.
Section 07
We take appropriate technical and organizational measures to protect personal data against loss, misuse and unauthorized access, including:
Our measures include:
• Encryption of all traffic between you and our systems (HTTPS / TLS).
• Passwords stored only as salted hashes; two-factor authentication available to every customer and required for our staff.
• Access to customer data limited to the staff who need it for their work, with access logged.
• Regular security updates, monitoring, firewalls and account isolation on our hosting platform.
• Regular backups stored separately from the live systems.
• Data centres with physical access control and 24/7 security.
No system is completely secure. If a breach affecting your personal data ever occurs, we will notify the Information Commissioner’s Office within 72 hours where the law requires it, and tell you directly if the breach is likely to put your rights at risk.
Section 08
We keep personal data only as long as we need it for the purpose it was collected for, and then delete or anonymize it.
- Account, order and invoice records: for as long as your account is open, and then for six years after your last transaction, which UK tax law requires.
- Website and server content: deleted 14 days after the service ends, as described in our Terms of Service.
- Support tickets and chat transcripts: for the life of your account, so that we can see the history when you contact us again, and deleted when the account is closed.
- Server and access logs: normally up to 90 days, unless needed longer to investigate a security incident.
- Job applications: 12 months.
- Marketing preferences: until you unsubscribe, after which we keep only a record that you opted out.
Section 09
Under the UK GDPR you have the right to:
- Access the personal data we hold about you and receive a copy of it.
- Correct data that is inaccurate or incomplete. Most account details can be changed directly in your client area.
- Erase your data where we no longer need it, subject to records we must keep by law.
- Restrict or object to processing based on our legitimate interests, and object to direct marketing at any time.
- Receive the data you gave us in a portable, machine-readable format.
- Withdraw consent at any time where consent is the basis for processing, without affecting what was done before.
To exercise any of these rights, email support@twerple.com from the address on your account, or open a ticket in the client area. We will respond within one month and will not charge a fee unless a request is clearly unfounded or excessive. We may ask you to confirm your identity before releasing data.
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the UK supervisory authority, the Information Commissioner’s Office, at ico.org.uk or on 0303 123 1113.
Section 10
The websites, applications, databases and email you run on our hosting often contain personal data about other people: your visitors, customers, staff or subscribers. For that data you are the controller and Twerple is your processor. We store and process it only to provide the hosting service and only on your instructions; we do not look at it, analyze it or use it for anything else, except where the law requires us to or to investigate a security incident or abuse report.
The terms on which we process that data for you, including the security measures we commit to, how we handle sub-processors and what happens when the service ends, are set out on our GDPR page, which forms part of our Terms of Service. If you need a signed data processing agreement for your own records, contact us and we will provide one.
Section 11
Our services are intended for adults and businesses. We do not knowingly collect personal data from anyone under 18, and accounts may only be opened by people aged 18 or over.
We review this policy regularly and will update it when our practices or the law change. The date at the top shows when it was last updated. If a change significantly affects how we use your data, we will email you before it takes effect.
Contact us about privacy
Email: support@twerple.com
Post: Twerple Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
We aim to answer privacy enquiries within five working days and to complete rights requests within one month.
