Privacy policy

1. Who we are

Dotweb (“we”, “us”, “our”) is operated by Dotweb Solutions AB, a company registered in Sweden with organization number 559560-0320, located at Fredrika Bremersgatan 16, 754 42 Uppsala, Sweden. We are the data controller for the personal data described in this policy, except for the content you store in our hosting services, which we process on your behalf.

This policy explains what personal data we collect when you visit our website, order from us and use our services: domain registration, web hosting, WordPress hosting, managed VPS and customer support. It also explains why we collect the data, who we share it with and the rights you have.

Our website at https://dotweb.io gives information about our services and has no sign-in or accounts of its own. You order through our checkout at https://checkout.dotweb.io, and you manage your account, services, invoices and support tickets in the client area at https://my.dotweb.io. The checkout and the client area are run for us by our billing and client-area platform partner (“our billing partner”).

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and other applicable data protection laws. We serve customers globally, and this policy applies wherever you use our services.

Dotweb Solutions AB also operates the agency site https://dotweb.solutions. This policy describes the processing carried out at https://dotweb.io and in our checkout and client area.

2. Data we collect on our website

Our website has no accounts, so you don’t need to tell us who you are to use it. When you use it, we collect:

• Your preferences: the currency prices are shown in, and the language if you choose one. We store them in cookies so that the website remembers them.
• Your cookie choice, which we store in a cookie so that we don’t have to ask you on every page.
• Domain searches: the domain search is provided by our billing partner. When you search, your browser loads the partner’s search component on our pages and sends your search to the partner, so the partner receives your IP address and what you searched for. The component keeps its settings in your browser’s local storage. If you go on to our checkout, it sets a cookie that keeps your basket and checkout session for up to a day.
• Technical data: your IP address, browser and device information, and server logs created when you load our pages.
• Analytics data, only if you accept analytics, as described in the Cookies and analytics section below.

3. Cookies and analytics

We use cookies and similar technologies, such as your browser’s local storage, on our website. The first time you visit, a banner asks whether you accept analytics. The website uses two categories:

• Necessary: these keep the website and checkout working and remember the choices you make, such as your currency, your language, your cookie choice and your basket, as well as the domain search’s settings. They don’t track you, so they are always on.
• Analytics, only if you accept it: the pages you view, what you click and what you search for in the knowledge base and the domain search, together with technical data such as your browser, your device and your approximate location, which is derived from your IP address. We use the clicks to create heatmaps. We may also record sessions to see where pages are hard to use. In recordings, everything you type into forms is masked, and so is the text of your searches.

Our analytics partner processes the analytics data for us and stores it in the EU. The data reaches the partner through our own domain, so the partner receives your IP address, your browser details (user agent) and the address of the page you came from (referrer). IP addresses are anonymized, so the partner does not store them.

No analytics runs, and no analytics cookies or identifiers are stored on your device, unless you accept analytics.

You can change or withdraw your choice at any time under Cookie settings at the bottom of every page. Your choice lasts 6 months, after which we ask you again. You can also clear the cookies for our website in your browser, and the banner will then ask you again.

Cookie settings lists every cookie and storage item the website uses, with its purpose, how long it is kept and who provides it.

4. Data we collect when you order and use our services

When you order through our checkout and use the client area and our services, we collect:

• Account details: your name, email address, password and account settings such as language and currency.
• Billing details: your billing address, tax country and VAT number where applicable.
• Orders and invoices: the services you order, their billing periods, your order history and your invoices.
• Payment details: you enter your card details with our payment processor, and we never see your full card number. We store only a token for the payment method you save, which lets the payment processor charge it, for example for renewals.
• Domain registrant details: the name, organization, postal address, country, phone number and email address you give for a domain registration, and any additional identifiers that a registry requires, for example a personal or company registration number for certain country-code domains.
• Support and communication: your support tickets in the client area, the emails you send us, attachments you upload and questions you ask before you order.
• Technical data: your IP address, browser and device information, and logs created when you use the checkout, the client area and your services.

The website content, files, databases and email you keep in our hosting services are stored on our hosting infrastructure. You decide what they contain. For any personal data in them, we act as your processor: we process it only on your behalf, to provide the service.

5. Domain registration data

When you register, transfer or renew a domain, we must share your registrant contact details with the responsible domain registry and our accredited registrar partners in order to complete the registration. In addition:

• Some registries require identity or contact validation before a domain is activated.
• Some registries publish limited registrant data in public directories such as WHOIS or RDAP. What is published follows each registry’s own rules.
• Privacy protection replaces your details in the public WHOIS directory and is free on every extension that allows it. Some registries require certain details to stay public. To turn it on or off for a domain, contact our support team.
• Certain top-level domains require additional data by law or registry policy, for example a national identity number or a company registration number.
• Registrar accreditation rules may require registration data to be deposited with an independent data escrow provider.

We only share the data that the specific registration requires. Registries and registrar partners process it under their own legal responsibilities and policies.

6. Why we process your data

We only process personal data when we have a legal basis for doing so:

• To perform our contract with you, or to take steps you ask for before you order: answering your domain searches, keeping your basket, processing orders and payments, managing your account in the client area, registering and managing domains, providing hosting and managed VPS, and giving you support.
• To comply with legal obligations: keeping accounting records of orders, invoices and payments as required by bookkeeping law, and applying the correct VAT based on your billing country.
• Based on our legitimate interests: running the website and remembering your preferences and cookie choice, keeping the website, checkout, client area and our services secure (fraud prevention, abuse detection, rate limiting and log analysis), improving our services, and sending existing customers relevant information about similar services. You can object to direct marketing at any time and we will stop immediately.
• Based on your consent: analytics, as described in the Cookies and analytics section. You can withdraw your consent at any time without affecting other processing. For analytics, you do this under Cookie settings at the bottom of every page.

We do not use automated decision-making that produces legal or similarly significant effects for you.

7. Who we share your data with

We never sell your personal data. We share it only as needed with these recipients, described by their role:

• Our billing and client-area platform partner, which runs our checkout, our client area and the domain search, and stores your account, order, invoice and support data.
• Our payment processor, which handles your card details and processes your payments.
• Domain registries and our registrar partners, which receive the registrant details needed to register, transfer and renew your domains.
• Our hosting and data center infrastructure providers, which run the servers for our website and your services.
• Our email delivery provider, which delivers the emails we send you.
• Our analytics partner, only if you accept analytics.

Apart from domain registries and registrar partners, these recipients are our data processors. They are bound by data processing agreements and may only use your data according to our instructions. Registries and registrar partners process registration data under their own legal responsibilities and policies, as described in the Domain registration data section.

We may also share personal data with public authorities, when we are legally required to or when it is necessary to establish, exercise or defend legal claims, and with a successor business if we are involved in a merger, acquisition or asset sale. In that case, this policy continues to apply to your data.

8. International transfers

We primarily store and process personal data within the EU/EEA. Analytics data is stored in the EU.

Your hosting services, and the content and email in them, are stored in the server location you choose at checkout. If you choose a location outside the EU/EEA, that data is stored there.

Some of our service providers may process data in countries outside the EU/EEA. When that happens, we make sure an adequate level of protection is in place, for example through an adequacy decision by the European Commission or through the European Commission’s Standard Contractual Clauses, together with additional safeguards where needed. You can contact us for more information about the safeguards we use.

9. How long we keep your data

We keep personal data only for as long as it is needed for the purposes described in this policy:

• Account data is kept for as long as your account in the client area exists. When your account is deleted, we delete or anonymize your personal data within a reasonable time, unless we are required to keep it longer.
• Accounting records, including orders, invoices and payment references, are kept for seven years plus the current year, as required by the Swedish Bookkeeping Act.
• Domain registration data is kept for as long as the registration exists, plus any period required by registry or escrow rules.
• Support history is kept while your account is active so that we can give better assistance, and is deleted or anonymized after the account is closed.
• Session recordings are deleted after 30 days.
• Other analytics data is pseudonymous: it is linked to a random ID rather than to your name. We keep it for up to 7 years, the longest our analytics partner keeps data, so that we can compare how the website is used over time.
• Your cookie choice is kept for 6 months, after which we ask you again. Cookie settings shows how long each of the other cookies and storage items is kept.
• Technical logs are kept for a limited period for security and troubleshooting purposes and are then deleted or anonymized.

10. Your rights

Under the GDPR you have the right to:

• Access your personal data and receive a free copy of the data we process about you.
• Have inaccurate or incomplete data corrected.
• Have your data deleted when it is no longer needed for the purposes it was collected for, or when you withdraw your consent, unless we have another legal basis or obligation to keep it.
• Restrict the processing of your data in certain situations.
• Receive the data you have provided to us in a structured, commonly used, machine-readable format and have it transferred to another controller (data portability).
• Object to processing based on our legitimate interests, including direct marketing. If you object to direct marketing, we stop immediately.
• Withdraw any consent you have given, at any time, without affecting processing that took place before the withdrawal.

To exercise your rights, contact us at support@dotweb.io. You can also update your account details yourself in the client area at https://my.dotweb.io, and change your cookie choice under Cookie settings at the bottom of every page. We may need to verify your identity before acting on a request.

If you believe we process your personal data incorrectly, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) or with the supervisory authority in the country where you live.

11. How we protect your data

We use appropriate technical and organizational measures to protect your personal data, including encryption in transit (HTTPS/TLS), hashed password storage, access controls, network isolation and continuous monitoring.

No method of transmission or storage is completely secure. If a data breach occurs that is likely to result in a risk to your rights, we will notify you and the supervisory authority as required by law.

12. Children

Our services are not directed at children. You must be at least 18 years old to create an account and order our services. We do not knowingly collect personal data from children.

13. Changes to this policy

We may update this policy from time to time, for example when we launch new services or when the law changes. The current version is always published on this page together with the date of the latest update. If a change materially affects how we process your personal data, we will notify you by email or in the client area before it takes effect.

14. Contact us

If you have questions about this policy or about how we handle your personal data, please contact us:

• Dotweb Solutions AB
• Organization number: 559560-0320
• Fredrika Bremersgatan 16, 754 42 Uppsala, Sweden
• Email: support@dotweb.io
• Phone: +46 10 808 69 41
• Websites: https://dotweb.io and https://dotweb.solutions