This policy explains what personal data ALR Network collects, why, who we share it with, how long we keep it and what your rights are. It covers this website (alr-network.co.uk), the client portal at alr-network.co.uk/account/ and the hosting, domain and website services we provide.
1. Who we are
ALR Network is a trading name of ROBERTS AARON LEE PFA (Strada Petru Maior 13, Ap.4, 400129 Cluj-Napoca, Cluj, Romania; trade register ROONRC.F12/1132/2019, fiscal code / CUI 41431477), the data controller for the personal data described here. For anything about this policy or your data, email [email protected].
When you host a website or email with us, the personal data inside your website, databases and mailboxes belongs to you: for that data you are the controller and we act as your processor, only handling it to provide the service. See Requests to ALR Network for Customer Data.
2. What we collect
When you visit this website
- Server and security logs: IP address, date and time, the page requested, browser type and referring page. Our hosting server and Cloudflare (which protects and speeds up the site) create these automatically.
- Analytics, only if you allow it: with your consent, Google Analytics records which pages are visited and how people found the site. Nothing is collected unless you choose “Accept” in the cookie banner. See our cookie policy.
- Preferences: if you pick a currency on a price list we remember it in a cookie; the billing-period choice is kept in your browser for the visit.
When you send us a form
The contact, health check and plan-request forms collect what you type in: your name, email address and message, and optionally your phone number, company, website address, domain and the plan you chose. We keep a scrambled (hashed) version of your IP address for an hour-by-hour spam limit; it can’t be turned back into your address. Forms may use Cloudflare Turnstile to check you are not a bot.
When you become a client
- Account and contact details: name, company, email address, phone number, postal address and VAT or company details where relevant.
- Billing: the services you have, invoices, payments and payment method. Card payments are handled by Stripe or PayPal: we never see or store your full card number.
- Domain registrations: the registrant details that domain registries require. Depending on the domain extension some of these may be published in the public WHOIS / RDAP directory, as set by ICANN and the registry. Some registries require proof of identity, which we only ask for when they do.
- Support and communications: emails and messages you send us, and our replies.
- Portal sign-ins: login history (date, time, IP address and browser) for your security.
3. Why we use it, and on what legal basis
- To provide the services you order (hosting, email, domains, websites), to bill you and to support you: performance of our contract with you.
- To answer enquiries and quote for work sent through our forms: steps you asked us to take before a contract, or our legitimate interest in replying to you.
- To keep invoices and accounting records and to send electronic invoices to the Romanian tax authority (ANAF e-Factura) where the law requires it: legal obligation.
- To register and manage domain names: contract, and the rules of ICANN and the domain registries.
- To keep our servers, website and your services secure and to prevent spam, fraud and abuse: our legitimate interest in running a safe service.
- Website analytics: your consent, which you can withdraw at any time from “Cookie settings” at the bottom of every page.
- Service and billing messages (maintenance notices, renewal reminders, invoices, abuse reports about your service): contract.
- Offers to existing clients about services similar to the ones you have (for example a renewal discount or an upgrade): our legitimate interest. You can tell us to stop at any time by replying to any of these emails or writing to the address above. We don’t send newsletters, and we never send offers to people who aren’t our clients without their consent.
We don’t sell personal data, and we don’t use it for automated decisions that have legal or similarly significant effects on you.
4. Who we share it with
Only with the service providers we need to run ALR Network, each under contract to protect it, and only what they need:
- Hosting: our servers are in a data centre in Bulgaria (EU), run by our infrastructure provider. Our website, client portal, billing system, email and the services we host for you run there, and our emails are sent from these servers.
- Cloudflare (website protection and delivery, DNS, Turnstile bot checks, and domain registration).
- Internet.bs (domain registration) and the registry for each domain extension.
- Stripe and PayPal (card and online payments), and our banks (Raiffeisen Bank, Revolut) for transfers.
- Google (Google Analytics, only with your consent).
- ANAF, the Romanian tax authority, for electronic invoices, and our accountant.
We may also disclose data where the law requires it (for example a court order), or to defend our legal rights.
5. Transfers outside Europe
Our own systems are in the European Union. Some of the providers above (for example Cloudflare, Stripe, PayPal and Google) may process data in the United States or elsewhere. Where they do, the transfer is covered by the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses, together with the provider’s own safeguards.
6. How long we keep it
- Form messages: 24 months, then deleted automatically, unless they become part of a client relationship.
- Client account, billing and invoice records: for as long as you are a client, then as long as Romanian accounting and tax law requires.
- Domain registration data: for as long as the domain is registered with us, plus any period the registry or ICANN requires.
- Server and security logs: normally a few weeks; longer only when needed to investigate an incident.
- Analytics: for the retention period set in our Google Analytics account (no longer than 14 months).
- Backups: copies may stay in our backups for a limited time before they are overwritten.
7. How we protect it
All our sites and the client portal use HTTPS. Admin access is limited to the people who need it and protected by two-factor authentication. We keep software up to date, monitor our servers and use firewalls. No system is perfectly secure, so please use a strong, unique password for your client account.
8. Your rights
You can ask us to:
- give you a copy of the personal data we hold about you;
- correct anything that’s wrong or incomplete;
- delete your data, where we don’t have to keep it by law or to provide a service you still use;
- restrict or stop using your data, or object to uses based on our legitimate interests;
- give you your data in a portable format;
- withdraw consent (for example to analytics) at any time; this doesn’t affect what we did before.
Email [email protected]. We’ll reply within one month and may need to confirm your identity first. You can also see and update most of your details yourself in the client portal.
If you’re unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to a data protection authority: in Romania the National Supervisory Authority for Personal Data Processing (ANSPDCP), in the UK the Information Commissioner’s Office (ICO), or the authority where you live or work.
9. Changes to this policy
We’ll update this page when what we do with personal data changes, and change the date at the top. If a change is significant, we’ll also email our clients.
10. Contact
ALR Network – [email protected]. See also our GDPR page, cookie policy and terms and conditions.