Your information, handled properly

1. Who we are

Pocket Maze LTD ("Pocket Maze", "we", "us", "our") is a private limited company registered in England and Wales. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we are the data controller for the personal information described in this policy — that is, we decide why and how it is used.

2. Scope of this policy

This policy explains how we collect, use, share, store, transfer and protect personal information when you:

• visit or interact with pocketmaze.site or any other website we operate;
• contact us by WhatsApp, email, telephone, social media or a website form;
• ask for a quote, place an order, or use any of our services — web hosting, VPS, cloud and dedicated servers, domain registration and DNS, business email, SSL certificates, backups, security and maintenance plans, or software development;
• host a website, application, shop, database or mailbox on our infrastructure (we then also process data about your own customers and visitors — see section 7);
• deal with us as a supplier, contractor, partner or job applicant.

It does not apply to third-party websites or services that we link to or resell. Those organisations have their own privacy notices, and you should read them. Where we resell a third-party service (for example a domain registry, a payment provider or an SSL certificate authority), your information may be shared with that provider as described in section 7.

If you give us information about someone else — for example an employee whose mailbox you are ordering, or an authorised contact on your account — you must have their permission to do so and should point them to this policy.

This policy is written in accordance with the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR) and, where relevant, the EU GDPR for individuals in the European Economic Area.

3. Information we collect

We collect the following categories of personal information. In each case we have shown typical examples — we only collect what a given service actually needs.

We do not collect special category data (such as health, racial or ethnic origin, political opinions, religious beliefs, biometric or genetic data) and we ask you not to send it to us. If you do send it, we will delete it unless we are legally required to keep it. We do not knowingly collect information about children — see section 13.

4. How we collect your information

5. Why we use your information and our lawful bases

We use your personal information only where we have a lawful basis to do so under the UK GDPR. This table sets out each purpose and the basis we rely on.

Where we rely on legitimate interests, we have carried out a balancing assessment to confirm that our interests do not override your rights and freedoms. You can ask us for a summary of that assessment at any time. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of what we did before you withdrew.

We do not use your personal information for automated decision-making or profiling that produces legal or similarly significant effects.

6. Cookies and similar technologies

Cookies are small text files placed on your device. We also use comparable technologies such as local storage and server-side session identifiers.

We currently use only strictly necessary cookies plus web fonts requested from Google Fonts, which means Google may see the IP address of your device when the font files are fetched. You can block web fonts in your browser, in which case the system fonts of your device will be used instead.

Where we introduce non-essential cookies we will ask for your consent first and give you a way to change your mind. You can also control or delete cookies through your browser settings; blocking strictly necessary cookies may break parts of the website. For independent guidance see the Information Commissioner’s Office guide to cookies at ico.org.uk.

7. Who we share information with

We share personal information only as described below, and only as much as is needed.

Where a supplier handles personal information on our behalf, we put a written data processing agreement in place that meets Article 28 of the UK GDPR, and we require equivalent protection for any onward transfer.

Where you are the controller. If you host content, a website, an application or a ' 'mailbox with us, you are the controller of that data and we act as your processor. We ' 'process it only on your documented instructions, only for the purpose of providing the service, ' 'and we notify you without undue delay if we become aware of a personal data breach affecting ' 'it. Our data processing agreement is available on request.

8. International transfers

Our own systems and data are hosted within the United Kingdom and the European Economic Area wherever possible. However, some of the providers we rely on — for example payment processors, Google (web fonts), Meta (WhatsApp) and some certificate or software suppliers — may process data in other countries, including the United States.

Where personal information leaves the UK or EEA we make sure a lawful transfer mechanism is in place, such as:

• a UK adequacy regulation, or an adequacy decision of the European Commission for EEA transfers;
• the UK International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum to the EU Standard Contractual Clauses;
• a transfer risk assessment for the specific transfer, plus, where needed, additional technical and organisational safeguards such as encryption in transit and at rest.

You can ask us for details of the safeguards used for a particular transfer by emailing info@pocketmaze.site.

9. How long we keep information

We keep personal information only for as long as we need it. The periods below are the standard retention periods we apply; we may keep information longer where the law requires it, or where it is necessary for a specific legal claim.

10. How we protect your information

We apply technical and organisational measures appropriate to the risk, including:

• TLS encryption for data in transit, and encryption at rest for backups and sensitive stores;
• least-privilege access control, individual named accounts, and multi-factor authentication for administrative access;
• firewalls, intrusion detection, malware scanning and regular patching of operating systems and applications;
• daily backups held off-site, with restores tested as part of our routine operations;
• logging and 24/7 monitoring of our infrastructure, with alerting to our engineers;
• confidentiality obligations for everyone who works with us, and secure handling of removable media;
• a documented incident response process, so that a breach is contained, assessed and reported.

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office within 72 hours of becoming aware of it, and we will tell you without undue delay where the breach is likely to result in a high risk to you. Where we act as your processor, we notify you and you remain responsible for your own regulatory notifications.

No system is completely secure. Please use a strong, unique password for your account, enable two-factor authentication where we offer it, and tell us immediately at info@pocketmaze.site if you suspect unauthorised access.

11. Your rights

Under the UK GDPR you have the following rights. They are not absolute — for example we may need to keep information to comply with tax law, or to defend a legal claim — but we will always explain our reasoning if we cannot act on a request.

To make a request, email info@pocketmaze.site with the subject “Data request”, or write to us at Suite 9165, 182-184 High Street North, East Ham, London E6 2JA, UK. We will respond within one month, and we do not charge for handling a request unless it is clearly unfounded or excessive (for example repeated requests). We may ask you to confirm your identity, and if you are asking on behalf of someone else we may ask for written authority. If your request concerns data you host with us (for example a mailbox on your domain), we may need to refer you to the organisation that controls that data, or to act on their instruction.

12. Marketing and communications

• If you are an existing customer we may email you about similar services, relying on the soft opt-in. Every message includes a one-click unsubscribe link.
• For anyone else we ask for consent before sending marketing, and you can withdraw it at any time.
• Reply STOP to any WhatsApp message, or email us, to opt out of marketing. We will still contact you about a service you have ordered, a payment, a renewal or a security issue — these are service messages and are not marketing.
• We keep a short suppression list so that we do not contact you after you have opted out.

13. Children

Our services are designed for businesses and professional users and are not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us and we will delete it promptly unless we are legally required to keep it.

14. External links and third-party services

Our website may link to third-party websites and we may resell or integrate third-party services. We are not responsible for how those organisations handle your information. Where a third party processes your information as a controller — for example a payment provider, a domain registry or a social network — its own privacy notice applies in addition to this one.

15. Complaints and the Information Commissioner’s Office

If you are unhappy with how we have handled your information, please tell us first. Email info@pocketmaze.site with the subject “Privacy complaint”. We will acknowledge it within 5 working days, investigate, and give you a substantive response within 30 days. Many issues can be resolved quickly once we know about them.

If you are not satisfied with our response, you have the right to complain to the UK supervisory authority:

If you live outside the United Kingdom, you may also complain to the supervisory authority in your country of residence or place of work.

16. Changes to this policy

We review this policy regularly and may update it to reflect changes in our services, our suppliers or the law. The version number and date at the top of the page always show the current version.

If we make a material change — for example a new category of data, a new purpose or a new category of recipient — we will tell you by email or by a prominent notice on the website at least 30 days before it takes effect, unless the change is required sooner by law or to respond to a security risk.

17. How to contact us

Questions about this policy, or about how we handle your information, can be sent to:

This policy is provided in English. It is governed by the laws of England and ' 'Wales. If we translate it into another language for convenience, the English version prevails.' '