This policy explains what personal data ALR Network collects, why, who we share it with, how long we keep it and what your rights are. It covers this website (alr-network.co.uk), the client portal at alr-network.co.uk/account/, the hosting, domain and website services we provide, and ALR Publisher, the social media publishing tool in the websites we build.
1. Who we are
ALR Network is a trading name of ROBERTS AARON LEE PFA (Strada Petru Maior 13, Ap.4, 400002 Cluj-Napoca, Cluj, Romania; trade register ROONRC.F12/1132/2019, fiscal code / CUI 41431477), the data controller for the personal data described here. For anything about this policy or your data, email gdpr [at] alr-network.co.uk.
When you host a website or email with us, the personal data inside your website, databases and mailboxes belongs to you: for that data you are the controller and we act as your processor, only handling it to provide the service. See Requests to ALR Network for Customer Data. The same applies to the websites we build and maintain for clients, including the social media accounts connected to them through ALR Publisher: the website owner decides what is posted and where, and we only provide and support the software.
2. What we collect
When you visit this website
- Server and security logs: IP address, date and time, the page requested, browser type and referring page. Our hosting server and Cloudflare (which protects and speeds up the site) create these automatically.
- Analytics, only if you allow it: with your consent, Google Analytics records which pages are visited and how people found the site. Nothing is collected unless you choose “Accept” in the cookie banner. See our cookie policy.
- Preferences: if you pick a currency on a price list we remember it in a cookie; the billing-period choice is kept in your browser for the visit.
When you send us a form
The contact, health check and plan-request forms collect what you type in: your name, email address and message, and optionally your phone number, company, website address, domain and the plan you chose. We keep a scrambled (hashed) version of your IP address for an hour-by-hour spam limit; it can’t be turned back into your address. Forms may use Cloudflare Turnstile to check you are not a bot.
When you become a client
- Account and contact details: name, company, email address, phone number, postal address and VAT or company details where relevant.
- Billing: the services you have, invoices, payments and payment method. Card payments are handled by Stripe or PayPal: we never see or store your full card number.
- Domain registrations: the registrant details that domain registries require. Depending on the domain extension some of these may be published in the public WHOIS / RDAP directory, as set by ICANN and the registry. Some registries require proof of identity, which we only ask for when they do.
- Support and communications: emails and messages you send us, and our replies.
- Portal sign-ins: login history (date, time, IP address and browser) for your security.
When you connect a social media account (ALR Publisher)
ALR Publisher is the publishing tool in the admin area of the websites we build and maintain, our own and our clients’. It lets the website’s owner share their own published content (for example a new photo gallery or blog post) to their own accounts on Facebook, Instagram, Threads, TikTok, Pinterest, Tumblr, Bluesky, Pixelfed and Google Business Profile. An account is only connected when its owner signs in on the platform and approves access, and only posts that the owner chooses, or sets rules for, are sent.
When an account is connected, the website stores:
- The sign-in keys (access and refresh tokens) the platform issues, kept encrypted, so the website can post on the owner’s behalf.
- Basic account details: the account’s ID, username or display name and profile picture address, and the names of the pages, boards or accounts the owner picks to post to. Before a TikTok post, the account’s nickname, picture and the privacy options TikTok allows are shown to the owner.
- A history of what was posted: the post’s ID and link on the platform, the date, the text sent and any error, so the owner can see, change or remove posts.
Google Business Profile: when a website owner connects their Google account, ALR Publisher asks Google only for permission to manage their Business Profile (business.manage). It uses it to list the owner’s business accounts and locations, so they can choose where to post, and to publish, change or delete the updates they send from their website. It doesn’t read reviews, messages, insights or any other Google account data. ALR Publisher’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: this data is used only to provide the posting feature, isn’t transferred to anyone else, isn’t used for advertising, and isn’t read by people except with the owner’s permission, for security, or where the law requires.
ALR Publisher does not read anyone else’s data: not followers’ details, messages, comments or other people’s posts. Data from these platforms is never sold, shared with advertisers or used to train AI, and is only used to publish the owner’s own content. It is stored in the database of the website where the account was connected, on our servers in the EU, and only that website’s administrators can use it. The content posted is then handled under each platform’s own privacy policy (for example Meta, TikTok and Pinterest).
3. Why we use it, and on what legal basis
- To provide the services you order (hosting, email, domains, websites), to bill you and to support you: performance of our contract with you.
- To answer enquiries and quote for work sent through our forms: steps you asked us to take before a contract, or our legitimate interest in replying to you.
- To keep invoices and accounting records and to send electronic invoices to the Romanian tax authority (ANAF e-Factura) where the law requires it: legal obligation.
- To register and manage domain names: contract, and the rules of ICANN and the domain registries.
- To keep our servers, website and your services secure and to prevent spam, fraud and abuse: our legitimate interest in running a safe service.
- Website analytics: your consent, which you can withdraw at any time from “Cookie settings” at the bottom of every page.
- ALR Publisher: the website owner’s approval on each platform, which they can withdraw at any time (see below); for our own accounts, our legitimate interest in sharing our work.
- Service and billing messages (maintenance notices, renewal reminders, invoices, abuse reports about your service): contract.
- Offers to existing clients about services similar to the ones you have (for example a renewal discount or an upgrade): our legitimate interest. You can tell us to stop at any time by replying to any of these emails or writing to the address above. We don’t send newsletters, and we never send offers to people who aren’t our clients without their consent.
We don’t sell personal data, and we don’t use it for automated decisions that have legal or similarly significant effects on you.
4. Who we share it with
Only with the service providers we need to run ALR Network, each under contract to protect it, and only what they need:
- Hosting: our servers are in a data centre in Bulgaria (EU), run by our infrastructure provider. Our website, client portal, billing system, email and the services we host for you run there, and our emails are sent from these servers.
- Cloudflare (website protection and delivery, DNS, Turnstile bot checks, and domain registration).
- Internet.bs (domain registration) and the registry for each domain extension.
- Stripe and PayPal (card and online payments), and our banks (Raiffeisen Bank, Revolut) for transfers.
- Google (Google Analytics, only with your consent).
- The social media platforms a website owner connects through ALR Publisher (such as Meta, TikTok and Pinterest), which receive the content the owner chooses to post.
- ANAF, the Romanian tax authority, for electronic invoices, and our accountant.
We may also disclose data where the law requires it (for example a court order), or to defend our legal rights.
5. Transfers outside Europe
Our own systems are in the European Union. Some of the providers above (for example Cloudflare, Stripe, PayPal, Google and the social media platforms) may process data in the United States or elsewhere. Where they do, the transfer is covered by the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses, together with the provider’s own safeguards.
6. How long we keep it
- Form messages: 24 months, then deleted automatically, unless they become part of a client relationship.
- Client account, billing and invoice records: for as long as you are a client, then as long as Romanian accounting and tax law requires.
- Domain registration data: for as long as the domain is registered with us, plus any period the registry or ICANN requires.
- Server and security logs: normally a few weeks; longer only when needed to investigate an incident.
- Analytics: for the retention period set in our Google Analytics account (no longer than 14 months).
- ALR Publisher connections: while the account stays connected. Removing a connection deletes its sign-in keys and account details straight away; the history of what was posted stays with the website until its owner deletes it. Sign-in keys also expire by themselves if they aren’t renewed (for example after a year on TikTok).
- Backups: copies may stay in our backups for a limited time before they are overwritten.
7. How we protect it
All our sites and the client portal use HTTPS. Admin access is limited to the people who need it and protected by two-factor authentication. We keep software up to date, monitor our servers and use firewalls. No system is perfectly secure, so please use a strong, unique password for your client account.
8. Your rights
You can ask us to:
- give you a copy of the personal data we hold about you;
- correct anything that’s wrong or incomplete;
- delete your data, where we don’t have to keep it by law or to provide a service you still use;
- restrict or stop using your data, or object to uses based on our legitimate interests;
- give you your data in a portable format;
- withdraw consent (for example to analytics) at any time; this doesn’t affect what we did before.
Email gdpr [at] alr-network.co.uk. We’ll reply within one month and may need to confirm your identity first. You can also see and update most of your details yourself in the client portal.
Disconnecting a social media account, and deleting its data
A connected account can be removed at any time in the website’s admin (Publisher → Connections → Remove), which deletes the stored sign-in keys and account details. Access can also be withdrawn on the platform itself, which stops it working straight away:
- Facebook and Instagram: Facebook Settings → Business integrations (or Apps and websites), then remove ALR Publisher; on Instagram, Settings → Website permissions → Apps and websites.
- TikTok: Settings and privacy → Security and permissions → Apps and services (Manage app permissions), then remove ALR Publisher.
- Pinterest: Settings → Security → App logins, then Revoke access.
- Google: your Google Account → Security → Your connections to third-party apps and services (myaccount.google.com/connections), then remove ALR Network.
To have everything deleted, including the history of what was posted, email gdpr [at] alr-network.co.uk with the website and the account, and we’ll delete it within one month and confirm. Posts already published on a platform stay there until you delete them on that platform.
If you’re unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to a data protection authority: in Romania the National Supervisory Authority for Personal Data Processing (ANSPDCP), in the UK the Information Commissioner’s Office (ICO), or the authority where you live or work.
9. Changes to this policy
We’ll update this page when what we do with personal data changes, and change the date at the top. If a change is significant, we’ll also email our clients.
10. Contact
ALR Network – gdpr [at] alr-network.co.uk. See also our GDPR page, cookie policy and terms and conditions.