Skip to content
Product About Compliance

Privacy Policy

Last updated: 21 July 2026

Who we are

Eighteen Zeros Limited is a company registered in England & Wales, with registered number 16984763. We provide European-sovereign managed IT services.

If you have any questions about this policy or your data, contact us at hello@eighteenzeros.com.

What data we collect

Website analytics

We use Rybbit, a privacy-respecting analytics tool, self-hosted on our own European infrastructure. Rybbit collects:

  • Page URL and referrer
  • Browser and operating system type
  • Screen size
  • Country (derived from IP, which is not stored)

Rybbit does not use cookies, does not track you across sites, and does not collect any personal data. No individual visitors can be identified from the data we collect.

Waitlist and newsletter signup

If you join our waitlist or subscribe to updates, we collect your email address. This is processed by rapidmail (rapidmail GmbH, Freiburg, Germany), acting as a data processor on our behalf. rapidmail is an EU company hosting within the EU. We use your email address to:

  • Notify you of events (e.g. product launches) relating to our services
  • Send occasional relevant updates and useful information relating to our services and to digital sovereignty in general

You can unsubscribe from our mailing lists at any time via the links provided in our emails.

Sign-ups and enquiries

If you join our early-access list, we collect your email address to keep you informed about our launch. If you contact us by email, we collect the details you choose to share, such as your name and message. We use this information only to respond to you or to keep you informed about our launch.

LinkedIn Company Page

We operate a LinkedIn Company Page for Eighteen Zeros. When you visit, follow, or interact with our Page, LinkedIn collects information about your engagement and provides us with aggregated statistics (“Page Insights”) about our audience — for example, the job functions, industries, and countries of our followers as a group. We do not receive data that identifies you individually through Page Insights, and we cannot link the statistics back to specific people. For this processing, Eighteen Zeros Limited and LinkedIn Ireland Unlimited Company act as joint controllers under Article 26 of the UK GDPR and EU GDPR. LinkedIn is primarily responsible for informing LinkedIn members about this processing and for handling data subject rights requests. The full terms are set out in LinkedIn’s Pages Terms, which includes the Page Insights Joint Controller Addendum. If you want to exercise your rights in relation to data processed by LinkedIn, the most effective route is to contact LinkedIn directly through your account settings. You can also contact us at hello@eighteenzeros.com and we will pass your request on.

  • Analytics: Legitimate interest in understanding how our website is used, balanced against minimal privacy impact (Note: no personal data is collected).
  • Email signup: Your consent, given when you submit your email address. We also use a double opt-in mechanism to ensure no-one can sign-up on your behalf without your consent
  • Contact form: Legitimate interest in responding to your enquiry.
  • LinkedIn Page Insights: Legitimate interest in understanding our professional audience, processed as joint controllers with LinkedIn. Only aggregated, non-identifying statistics are provided to us.

Third parties

Our core infrastructure and processors are European-headquartered, and your data stays in Europe:

  • rapidmail GmbH — processes email signups and sends emails on our behalf (Freiburg, Germany)
  • BunnyCDN (BunnyWay d.o.o.) — delivers static website assets via their content delivery network (Slovenia)
  • Scaleway SAS — hosts our infrastructure in Paris, France

We also use LinkedIn as a marketing channel:

  • LinkedIn Ireland Unlimited Company — operates our LinkedIn Company Page. LinkedIn is part of Microsoft Corporation (United States); personal data processed by LinkedIn is subject to their own privacy policy and international transfer mechanisms. We receive only aggregated audience statistics and do not upload customer data to LinkedIn.

Use of LinkedIn is entirely at your discretion and is not required to interact with us or our services. If you prefer not to use LinkedIn, you can contact us directly by email.

Data retention

  • Analytics data is retained for as long as we operate the service and is not personally identifiable.
  • Email addresses are retained until you unsubscribe or request deletion.
  • Contact form messages are retained for up to 12 months, then deleted.
  • LinkedIn Page Insights data is processed and retained by LinkedIn according to their own retention policies. We do not separately retain this data.

The managed platform (for our customers)

The sections above cover the personal data we process as a controller through this website. When you become a customer of our managed platform, two further relationships apply, and it matters to distinguish them.

Our two roles

  • Controller — your account. To provide the service we collect account data: your name, email address, phone number (if given) and organisation details. We use it to create and administer your account, provision your services, and contact you about the service. This data is held in our own database, hosted in the EU. Requests to access, correct or erase it come to us directly, using the contact details below.
  • Processor — your content. The files, users, messages and other content you and your team put into your platform belong to you. For that content you are the controller and we act as your processor, handling it only on your instructions and under a data-processing agreement (Article 28 UK GDPR) that forms part of your service terms. Requests from your own staff to access or erase their data are handled by you, using the controls in your platform; where you need our help to act on them, we will.

Platform sub-processors

To run the managed platform we use the following sub-processors, all EU-based, with your data kept in Europe:

  • Scaleway SAS — hosts the platform infrastructure and object storage in Paris, France.
  • QBoxmail S.r.l. — provides mailboxes and email delivery for your custom domains (Italy).
  • Hetzner Online GmbH — stores encrypted, off-site backups in Germany.
  • Scaleway (Transactional Email) — sends transactional email from the platform, such as verification and notification messages, from the EU.

We keep this list current and notify customers of material changes to our sub-processors.

Platform retention and erasure

Platform backups are kept on a documented, bounded rotation — no backup is kept indefinitely, and the current worst-case retention across all backup tiers is up to 35 days. We do not surgically edit backups. When personal data is erased from the live platform, any residual copies in backup are placed beyond use — not accessed, and not restored for any purpose other than disaster recovery — and age out within that window. If a backup is ever restored, the erasure is re-applied as part of the restore procedure.

Your rights

Under the UK General Data Protection Regulation (UK GDPR), you have the right to:

  • Access the personal data we hold about you
  • Rectify inaccurate personal data
  • Erase your personal data
  • Restrict processing of your personal data
  • Port your personal data to another service
  • Object to processing of your personal data

To exercise any of these rights, email hello@eighteenzeros.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

Outside of the UK, other privacy legislation may apply. If you have any questions relating to our data processing in the context of other jurisdictions, please contact us at hello@eighteenzeros.com.

Cookies

We do not use cookies. Our analytics tool is cookieless, and we do not use any other scripts that set cookies.

Changes to this policy

We may update this policy from time to time. The “last updated” date at the top of this page will reflect any changes. Where possible, we will notify you of material changes.