Privacy policy

Two roles, kept separate

We are a controller for data about our own customers — the people who hold accounts with us. We are a processor for data that passes through the network on behalf of those customers. The two are handled under different rules and are described separately below.

As controller: our customers

When you open an account we collect the name and email of the account contact, billing details, and authentication data. We use it to provide the service, bill you, and send operational notices. The legal basis is performance of a contract, and for security notices, legitimate interest.

Billing records are retained for six years to meet statutory accounting obligations. Account data is deleted within 30 days of account closure, except where retention is legally required.

As processor: traffic through the network

Delivering a request requires processing the visitor's IP address. We log, for each request:

• truncated source IP address (last octet of IPv4, last 80 bits of IPv6 removed)
• country and autonomous system number, derived from the IP before truncation
• requested URL, method, response status and byte count
• cache status and the edge node that served the request
• user agent string and referrer, where the browser sends them
• timestamp with millisecond precision

Logs are retained for 7 days on Starter and 30 days on Growth and Scale, then deleted irreversibly. Aggregated counters that cannot identify an individual are kept for 13 months for capacity planning.

We do not set cookies on visitors, do not fingerprint devices, do not build profiles, and do not sell or share log data with advertisers or data brokers. We have no advertising business, which is the most reliable guarantee we can offer you on that point.

Where data is processed

Requests are processed at the edge location nearest the visitor, which may be outside the EEA. Log aggregation and storage take place in Frankfurt and Amsterdam. Transfers outside the EEA rely on the European Commission's Standard Contractual Clauses together with technical measures including truncation at the point of collection.

Sub-processors

We give 30 days' notice before adding a sub-processor, during which a customer may object and terminate without penalty.

Security

Traffic is encrypted in transit with TLS 1.2 or above. Logs are encrypted at rest. Access to production systems requires hardware-backed multi-factor authentication and is logged. We run an annual third-party penetration test and publish a summary to customers on request.

Your rights

Under the GDPR you may request access to your personal data, correction, erasure, restriction, portability, or object to processing. Write to privacy@digitalprovider.online and we will respond within 30 days. If you are a visitor to a site we deliver rather than our customer, send the request to that site's operator — they are the controller and we act only on their instructions.

You also have the right to complain to your national supervisory authority. Ours is the Irish Data Protection Commission.

Contact

Data protection enquiries: privacy@digitalprovider.online.