Privacy Policy
Revised July 30, 2026
1. The controller
The data controller is Azaanex Inc., a company registered in Canada under company number 1766541-5, registered office 5-145 1/2 Church St, Toronto, Ontario M5B 1Y4, Canada. Hosting & Domains is a trading name of Azaanex Inc..
Any matter touching your personal data, including the rights listed in section 7, should be sent to info@hosting-n-domains.com and put “Data protection” in the subject line.
This is a Canadian company, its hosting platform sits in the United Kingdom, and it sells worldwide. The notice below is therefore written to meet Canada's PIPEDA, the UK GDPR and the EU GDPR at the same time.
2. The data we process
- Account and billing details — your name, your email address, your billing address, and every invoice raised against the account.
- Payment details — dealt with by Stripe. What reaches us is a payment token plus the last four digits of the card; the full number and the security code never arrive on our systems at all.
- Support correspondence — tickets, emails, and anything at all you decide to write in them.
- Domain registrant details — the contact details a registry demands before it will record a name as belonging to you.
- Technical logs — IP addresses, request data, and the error logs recorded while you are working on the platform.
- Your site's content — the files, databases and mailboxes sitting on our hosting. Nobody here looks inside them, except where you have asked us to for support purposes, or where a specific abuse or security report makes it necessary.
3. Purposes and lawful bases
Every purpose we process for needs a lawful basis under data protection law. Ours appear below in full instead of being summarised, so each one can be weighed on its own merits.
| Purpose | Lawful basis | What it covers |
|---|---|---|
| Providing the services you ordered | Contract | Setting up the account, provisioning hosting, registering names, issuing invoices and taking payment. |
| Handling support requests | Contract | Dealing with tickets and correspondence, along with anything you decide to write into them. |
| Protecting the platform | Legitimate interests | Server logs, IP addresses, abuse investigations and fraud prevention. The interest at stake is a platform that cannot be abused. We regard it as proportionate because the data involved is narrow and held for only a short period. |
| Essential service notices | Contract | Renewal reminders, invoices, notice of maintenance windows and incident alerts. All of these form part of the service itself, not marketing, and that is why no opt-out exists for them. |
| Marketing email | Consent | These go out only where you have opted in. Consent can be withdrawn at any point, either through the unsubscribe link or by writing to us. |
| Analytics | Consent | Measurement and advertising tags are requested only once the category holding them has been accepted, and consent can be withdrawn from the footer of any page. |
| Page-speed measurement | Legitimate interests | Core Web Vitals timings, gathered without cookies and with no identifier attached, which lets us judge whether the site is quick for actual visitors rather than merely under laboratory conditions. The interest here is a site that performs, and we treat it as proportionate because none of what gets collected can be traced back to you. |
| Accounting records | Legal obligation | UK tax law obliges us to keep transaction records for a fixed period. |
We sell no personal data at all, and none of it is used to train machine-learning systems either.
4. Cookies and measurement
A handful of necessary cookies keep the site functioning: the currency your prices appear in, and the record of your cookie choice so the banner stops asking again. Consent is not required for those.
Everything beyond that waits for your agreement. None of that is configured on this deployment, which means no measurement and no advertising run here at all, even for a visitor who accepts every optional category. Every page carries, in its footer, a Cookie Settings link that reopens the panel showing the answer we recorded, so withdrawing takes precisely the effort agreeing took. Our cookie policy carries the detail.
Before August 2026 this notice stated that our analytics set no cookies and that no advertising tracker ran here. That described software which has since been taken out, so the text now records what the site actually loads rather than quietly going stale.
5. Which others process your data
We keep this list short. Every party named below either acts on our instructions under contract, or is itself a controller in its own right where the service requires it. A registry, for example, holds registrant records on its own account.
| Recipient | Role | Location |
|---|---|---|
| Vercel | Runs this website and serves its pages | US / global edge |
| 20i | Supplies the hosting platform and the server our billing system runs on | United Kingdom |
| Stripe | Takes card payments and stores the card data itself | US / Ireland |
| Namecheap | Handles registration and renewal of most endings for us | United States |
| PKNIC | The official registry behind .pk names | Pakistan |
| Resend | Sends the contact-form and newsletter mail, which means it processes the name, address and message you submit | United States |
| Domain registries | Keep the registrant record behind each name you have registered | Varies by extension |
| Pexels | Supplies part of the illustrative photography, so your IP address is passed to their CDN | Global CDN |
We may also disclose data where the law compels us to, or where a legal claim has to be brought or defended.
6. Transfers of data beyond the UK and EEA
Your data can leave the UK and the European Economic Area, because a number of the providers named above are based beyond those territories. Nothing moves without an appropriate safeguard standing behind it. That means one of three things: a UK adequacy decision covering wherever the data is going, the UK International Data Transfer Agreement or its Addendum, or Standard Contractual Clauses issued by the European Commission.
Your hosting account, along with everything held on it, sits inside a London datacentre. Email info@hosting-n-domains.com and we will tell you which safeguard applies to any given transfer.
7. The rights you hold over data
Those are the rights you hold in respect of your own data. To exercise any of them, email info@hosting-n-domains.com. We reply within one month, and nothing is charged for it.
- Access — Request a copy of the personal data held about you in our records.
- Rectification — Put right any record about you that is inaccurate or incomplete.
- Erasure — Have the records deleted, unless some obligation requires us to keep them.
- Restriction — Pause our processing until a query about accuracy or legitimacy has been settled.
- Portability — Take away everything you supplied, in a structured and machine-readable format.
- Objection — Object where our processing rests on the legitimate-interests basis.
- Withdraw consent — Withdraw consent at any moment you choose; processing done before that remains lawful.
Identity may have to be confirmed before we act on a request, so that nobody else can walk away with your data.
Not satisfied with the way we have handled your data? A complaint can go to the Office of the Privacy Commissioner of Canada, the regulator there at priv.gc.ca. Where the data falls under the UK GDPR, complaints instead go to the UK's Information Commissioner's Office at ico.org.uk. Inside the EU, the supervisory authority in your own country is the one that handles it. We would welcome the chance to put things right first, although nothing whatsoever obliges you to come to us before going to a regulator.
8. Retention periods
- Account and billing records — held for as long as the account stays open, then for six years following your final transaction, that being the period UK tax law prescribes.
- Support tickets — three years beyond closure, so the history remains available should the same fault come back.
- Server and access logs — normally 30 to 90 days; a log is retained beyond that only when it forms part of a live security or abuse investigation.
- Your hosted content — throughout the life of the service, then for a short while inside copies once you cancel, and after that it follows the account out of our systems.
- Marketing consent records — until consent is withdrawn, together with a record of the withdrawal itself so that it can be respected.
9. Names and public WHOIS
To register a name, your contact details have to be handed to the registry. Wherever a registry permits it, free WHOIS privacy is switched on for you, which keeps those personal details out of public lookups. Not every ending permits it, though. Country-code endings in particular often refuse, and your details can then end up sitting on a public record. Should that matter to you, ask us before the registration goes through.
10. Children
Children are not the audience for what we sell, and no data is knowingly collected from anyone under 16. If you believe a child has handed us personal data, tell us and it will be deleted.
11. Changes to this notice
If a change materially alters the way your data gets handled, you will hear about it by email or inside the client area before the change takes effect. Whichever version is current is marked by the date printed at the top of this page. Questions go to info@hosting-n-domains.com.