Privacy Policy

Last updated: 12 October 2026

Who we are

Eighteen Zeros Limited is a company registered in England & Wales, with registered number 16984763. We provide European-sovereign managed IT services.

If you have any questions about this policy or your data, contact us at hello@eighteenzeros.com.

What data we collect

Website analytics

We use Rybbit, a privacy-respecting analytics tool, self-hosted on our own European infrastructure. Rybbit collects:

  • Page URL and referrer
  • Browser and operating system type
  • Screen size
  • Country (derived from IP, which is not stored)

Rybbit does not use cookies, does not track you across sites, and does not collect any personal data. No individual visitors can be identified from the data we collect.

Newsletter signup

If you subscribe to our newsletter, we collect your email address. This is processed by rapidmail (rapidmail GmbH, Freiburg, Germany), acting as a data processor on our behalf. rapidmail is an EU company hosting within the EU. We use your email address to:

  • Notify you of events (e.g. new features or pricing changes) relating to our services
  • Send occasional relevant updates and useful information relating to our services and to digital sovereignty in general

You can unsubscribe from our mailing lists at any time via the links provided in our emails.

Enquiries

If you contact us by email, we collect the details you choose to share, such as your name and message. We use this information only to respond to you.

LinkedIn Company Page

We operate a LinkedIn Company Page for Eighteen Zeros. When you visit, follow, or interact with our Page, LinkedIn collects information about your engagement and provides us with aggregated statistics (“Page Insights”) about our audience — for example, the job functions, industries, and countries of our followers as a group. We do not receive data that identifies you individually through Page Insights, and we cannot link the statistics back to specific people. For this processing, Eighteen Zeros Limited and LinkedIn Ireland Unlimited Company act as joint controllers under Article 26 of the UK GDPR and EU GDPR. LinkedIn is primarily responsible for informing LinkedIn members about this processing and for handling data subject rights requests. The full terms are set out in LinkedIn’s Pages Terms, which includes the Page Insights Joint Controller Addendum. If you want to exercise your rights in relation to data processed by LinkedIn, the most effective route is to contact LinkedIn directly through your account settings. You can also contact us at hello@eighteenzeros.com and we will pass your request on.

  • Analytics: Legitimate interest in understanding how our website is used, balanced against minimal privacy impact (Note: no personal data is collected).
  • Email signup: Your consent, given when you submit your email address. We also use a double opt-in mechanism to ensure no-one can sign-up on your behalf without your consent
  • Contact form: Legitimate interest in responding to your enquiry.
  • Customer accounts, billing and service emails: Performance of our contract with you, i.e. providing the managed platform and billing for it. We keep billing records to meet our legal obligation to keep tax and accounting records.
  • LinkedIn Page Insights: Legitimate interest in understanding our professional audience, processed as joint controllers with LinkedIn. Only aggregated, non-identifying statistics are provided to us.

Third parties

Our core infrastructure and processors are European-headquartered, and your data stays in Europe:

  • rapidmail GmbH — processes email signups and sends emails on our behalf (Freiburg, Germany)
  • Scaleway SAS — hosts our infrastructure in Paris, France

We also use LinkedIn as a marketing channel:

  • LinkedIn Ireland Unlimited Company — operates our LinkedIn Company Page. LinkedIn is part of Microsoft Corporation (United States); personal data processed by LinkedIn is subject to their own privacy policy and international transfer mechanisms. We receive only aggregated audience statistics and do not upload customer data to LinkedIn.

Use of LinkedIn is entirely at your discretion and is not required to interact with us or our services. If you prefer not to use LinkedIn, you can contact us directly by email.

Data retention

  • Analytics data is retained for as long as we operate the service and is not personally identifiable.
  • Email addresses are retained until you unsubscribe or request deletion.
  • Contact form messages are retained for up to 12 months, then deleted.
  • Billing records (invoices, credit notes and payment records) are retained for six years after the end of the financial year they relate to, as UK tax law requires, even after an account is closed.
  • LinkedIn Page Insights data is processed and retained by LinkedIn according to their own retention policies. We do not separately retain this data.

The managed platform (for our customers)

The sections above cover the personal data we process as a controller through this website. When you become a customer of our managed platform, two further relationships apply, and it matters to distinguish them.

Our two roles

  • Controller — your account. To provide the service we collect account data: your name, email address, phone number (if given) and organisation details. We use it to create and administer your account, provision your services, and contact you about the service. This data is held in our own database, hosted in the EU. Requests to access, correct or erase it come to us directly, using the contact details below.
  • Processor — your content. The files, users, messages and other content you and your team put into your platform belong to you. For that content you are the controller and we act as your processor, handling it only on your instructions and under a data-processing agreement (Article 28 UK GDPR) that forms part of your service terms. Requests from your own staff to access or erase their data are handled by you, using the controls in your platform; where you need our help to act on them, we will.

Account and service emails

We use the email address your account owner gave at signup, and any billing contact you set, to contact you about your account and the Service. For example, we email about invoices, missing payment details, failed payments and suspension. These are service messages, not marketing, and they are sent because they are part of providing the Service you signed up for.

We only send marketing to people who have separately opted in to receive it, through the double opt-in newsletter signup described above. We never send marketing to your account address on the strength of your account alone.

Billing and payments

To bill for the Service we keep your billing name and address, any billing contact email you set, your invoices and payment history, and the user counts that each invoice is based on.

Direct Debit payments are processed by GoCardless Ltd (London, United Kingdom), an FCA-authorised payment institution. You set up your Direct Debit on GoCardless’s own secure pages, and your bank account details are collected and held by GoCardless, not by us. We never see or store your bank account number. We hold only GoCardless’s reference for your Direct Debit and the status of your payments. GoCardless is the data controller for your bank details and handles them as set out in its own privacy notice.

Platform sub-processors

To run the managed platform we use the following sub-processors, all EU-based, with your data kept in Europe:

  • Scaleway SAS — hosts the platform infrastructure and object storage in Paris, France.
  • QBoxmail S.r.l. — provides mailboxes and email delivery for your custom domains (Italy).
  • Hetzner Online GmbH — stores encrypted, off-site backups in Germany.
  • Scaleway (Transactional Email) — sends transactional email from the platform, such as verification and notification messages, from the EU.

We keep this list current and notify customers of material changes to our sub-processors.

Platform retention and erasure

Platform backups are kept on a documented, bounded rotation — no backup is kept indefinitely, and the current worst-case retention across all backup tiers is up to 35 days. We do not surgically edit backups. When personal data is erased from the live platform, any residual copies in backup are placed beyond use — not accessed, and not restored for any purpose other than disaster recovery — and age out within that window. If a backup is ever restored, the erasure is re-applied as part of the restore procedure.

Your rights

Under the UK General Data Protection Regulation (UK GDPR), you have the right to:

  • Access the personal data we hold about you
  • Rectify inaccurate personal data
  • Erase your personal data
  • Restrict processing of your personal data
  • Port your personal data to another service
  • Object to processing of your personal data

To exercise any of these rights, email hello@eighteenzeros.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

Outside of the UK, other privacy legislation may apply. If you have any questions relating to our data processing in the context of other jurisdictions, please contact us at hello@eighteenzeros.com.

Cookies

We do not use cookies. Our analytics tool is cookieless, and we do not use any other scripts that set cookies.

Changes to this policy

We may update this policy from time to time. The “last updated” date at the top of this page will reflect any changes. Where possible, we will notify you of material changes.