Privacy Policy.
1. Who we are
1.1 The WordPress Maintenance Company (“we”, “us”, “our”) is a trading name of Melted House Digital Ltd, a company registered in Scotland (company number SC521020), registered office 4 Main Road, Condorrat, Cumbernauld G67 4BS.
1.2 Melted House Digital Ltd is the controller of the personal data described in this policy. We are registered with the Information Commissioner’s Office (ICO), registration number CSN8479570.
1.3 Contact us about anything in this policy at support@wordpressmaintenanceco.com, on 0333 050 4410, or by post to the address above.
2. What this policy covers
2.1 This policy explains how we handle personal data about people who visit this website, contact us, or become our clients, including the staff of client businesses.
2.2 Data on our clients’ websites. When we maintain, back up or host a client’s website, any personal data on that website belongs to our client. Our client is the controller and we act as their processor. That processing is covered by Schedule 1 of our Terms of Service, not by this policy. If you are a customer or user of one of our clients’ websites, please contact that business first.
3. What we collect, why, and our lawful basis
| Purpose | Data | Lawful basis (UK GDPR) | How long we keep it |
|---|---|---|---|
| Answering enquiries and sign-up requests sent through our website form | Name, company name, email, phone number, website address, plan of interest, your message | Taking steps at your request before entering a contract; otherwise our legitimate interest in responding to enquiries | 12 months from our last contact if you do not become a client |
| Live chat | Anything you type, your name and email if you give them, and technical data (IP address, browser, device, pages viewed during the chat) | Our legitimate interest in answering questions quickly | 12 months |
| Providing our maintenance and hosting services | Contact details of your authorised staff, website access details, correspondence and records of work carried out | Performing our contract with your business | For the length of the Plan, then 6 years. Website login details are deleted within 30 days of a Plan ending, as set out in our Terms |
| Billing and payment | Billing name and address, invoices, payment history, and Direct Debit details (held by our Direct Debit provider) | Performing our contract; complying with tax and accounting law | 6 years after the end of the financial year they relate to |
| Understanding how our website is used | Pages viewed, how you arrived, approximate location (city level), device and browser type, linked to a random identifier stored in an analytics cookie | Your consent, given through our cookie banner. You can withdraw it at any time (see section 8) | 14 months, then deleted automatically by Google Analytics |
| Keeping our website secure and blocking spam | IP address, browser details, request logs and form spam checks | Our legitimate interest in protecting our website and our users | Up to 30 days for security logs |
3.2 If you do not give us the information we need to provide a Plan, we may not be able to provide it.
3.3 We do not send marketing emails. We do not make decisions about you using only automated processing, and we do not sell your personal data.
4. Who we share it with
4.1 We use the service providers below. Most process personal data only on our behalf, under a contract, and only for the purpose listed. GoCardless is also responsible in its own right for the Direct Debit details you give it, under its own privacy notice.
| Provider | What they do for us | Where the data is processed |
|---|---|---|
| Heart Internet | Hosting this website | UK |
| ManageWP (GoDaddy), on Amazon S3 | Backups of this website | United States |
| Google (Google Analytics, reCAPTCHA) | Website statistics; spam protection on our forms | United States |
| tawk.to Inc. | Live chat | United States |
| Adobe (Adobe Fonts) | Displaying the fonts on this website (receives your IP address) | United States |
| Defiant Inc. (Wordfence) | Website firewall and security | United States |
| Heart Internet | Our email | UK |
| GoCardless Ltd | Collecting Direct Debit payments | UK |
| Xero | Invoicing and accounts | United States |
4.2 We may also share personal data where the law requires it, with our professional advisers and insurers, or as part of a sale or restructure of our business, in which case the buyer would have to treat it in line with this policy.
5. Transfers outside the UK
5.1 Some of our providers process data in the United States, as shown in section 4. Where a provider is certified under the UK Extension to the EU-US Data Privacy Framework, we rely on that. Otherwise, we rely on the ICO’s International Data Transfer Agreement or the International Data Transfer Addendum to the EU Standard Contractual Clauses. Contact us for more detail on the safeguard used for any provider.
6. How we protect it
6.1 We use encrypted connections, firewalls, two-factor authentication on our admin accounts, restricted access and up-to-date software. Client login details are stored in an encrypted password manager. No website or system is completely secure, but we take reasonable steps to protect your data.
7. Your rights
7.1 You have the right to:
- ask for a copy of the personal data we hold about you;
- ask us to correct data that is wrong or incomplete;
- ask us to delete your data;
- ask us to restrict how we use your data;
- object to how we use your data, including for analytics;
- ask us to transfer data you gave us to another organisation;
- withdraw your consent at any time, where we rely on consent.
7.2 Some rights depend on the lawful basis we rely on and can be limited by law, for example where we must keep billing records. We will explain if that applies.
7.3 To use any of these rights, contact us using the details in section 1. We will respond within one month. There is normally no charge.
7.4 Complaints. If you are unhappy with how we have handled your data, please tell us first. We will acknowledge your complaint within 30 days and tell you the outcome. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
8. Cookies and analytics
8.1 We use a small number of cookies and similar technologies. Full details, including each cookie and how long it lasts, are in our Cookie Policy. In summary:
- Essential (security, spam protection with Google reCAPTCHA, and remembering your cookie choices): always on, because the website and its forms cannot work safely without them.
- Preferences (tawk.to live chat): only loaded if you allow them.
- Statistics (Google Analytics): only set if you allow them. Until then, Google Analytics runs with storage switched off and sets no cookies.
8.2 When you first visit, a banner asks for your choice. You can accept, deny, or choose which categories to allow. You can change your mind at any time using the “Manage consent” tab on the website.
8.3 Our website loads fonts from Adobe Fonts. This does not set cookies, but Adobe receives your IP address so it can deliver the fonts.
9. Children
9.1 Our services are for businesses. This website is not aimed at children and we do not knowingly collect data about anyone under 18.
10. Changes to this policy
10.1 We will update this policy when how we use personal data changes. The version number and effective date at the top show when it last changed. If a change affects our clients significantly, we will tell them by email.
11. Contact
11.1 support@wordpressmaintenanceco.com · 0333 050 4410 · 4 Main Road, Condorrat, Cumbernauld G67 4BS.