1. Introduction
Purpose of this policy
This Privacy Policy explains how BPanel.net ("BPanel", "we", "us" or "our") collects and uses personal data when you use the BPanel platform and admin area (the "Service") or visit bpanel.net (the "Site"). It should be read together with our Terms of Service (bpanel.net/terms) and our Acceptable Use Policy (bpanel.net/acceptable-use).
This policy applies to people with a BPanel account, including those invited to manage an organisation's website ("Admin Users"), people who represent our customers, visitors to the Site and the admin area, and anyone who contacts us. We do not sell personal data, and we do not use advertising or third-party tracking.
Controller and processor
BPanel is the controller of the personal data described in this policy. You can contact us about it at [email protected].
Each website built on BPanel is run by the organisation responsible for it. If you visit one of those websites, apply for an event or opportunity, or sign up to its newsletter, that organisation is the controller of your data and its own privacy notice applies. We process that data only on the organisation's behalf and on its instructions. Please send any questions or requests about it to the organisation. If you contact us instead, we will pass your request on to them.
2. The personal data we collect about you
We may collect the following kinds of personal data:
- Identity Data includes your name and username or account identifier.
- Contact Data includes your email address and, where you give them to us, your organisation's details.
- Profile Data includes the organisation(s) and role(s) linked to your account, when your access ends, your preferences and your account settings.
- Transaction Data includes details of the plans and fees agreed with you, invoices and payments. We do not store card details.
- Technical Data includes your IP address (held only briefly, to protect the Service from spam and abuse), sign-in data such as when you last signed in, the type of device you use and records of errors.
- Usage Data includes information about how you use the Service and the Site, such as the pages you visit, the website you came from (its name only) and a record of significant actions taken in the admin area (who changed what and when).
- Communications Data includes messages you send us, including through our contact form, and our replies.
We need your name and email address to give you an account. If you do not provide them, we cannot provide the Service to you.
3. How we collect your personal data
We collect personal data:
- directly from you, when you accept an invitation, create or update your account, contact us or agree a plan with us;
- from your organisation, when one of its Admin Users invites you or gives you a role; and
- automatically, when you use the Service or visit the Site, as described under "Visit statistics" and "Cookies" below.
4. How we use your personal data
We use personal data only where the law allows us to. Most commonly, this is where we need it to perform our contract with you, where it is in our legitimate interests (or those of your organisation) and those interests are not overridden by your rights, or where we must comply with a legal obligation.
Purposes for which we will use your personal data
| Purpose | Type of data | Legal basis |
|---|---|---|
| To create and run accounts, let Admin Users sign in and manage their organisation's website, and send service emails such as invitations and account emails | Identity, Contact, Profile, Technical | Performance of a contract with you or, where you act for an organisation, our and that organisation's legitimate interests in running its website |
| To keep the Service secure, prevent spam, abuse and fraud, and keep records for accountability and support | Identity, Technical, Usage | Legitimate interests (protecting the Service, our customers and their visitors) |
| To respond to enquiries, complaints and reports of content | Identity, Contact, Communications | Legitimate interests (answering you) or taking steps at your request before entering into a contract |
| To agree fees, invoice and keep financial records | Identity, Contact, Transaction, Communications | Performance of a contract and compliance with a legal obligation (such as tax law) |
| To produce visit statistics and improve the Site | Usage | Legitimate interests (improving our service) |
| To tell you about important changes to the Service, our terms or this policy | Identity, Contact | Performance of a contract and legitimate interests (keeping you informed) |
| To send platform news, such as new features and improvements | Identity, Contact, Profile | Legitimate interests (keeping our customers informed about the Service) |
| To deal with legal claims and comply with the law | All | Legitimate interests and compliance with a legal obligation |
Visit statistics
We use our own privacy-friendly analytics to understand how the Site is used, such as which pages are visited and how people find us. It does not use cookies, does not store your IP address and does not identify you or track you across other websites. We only look at the results as overall totals, such as the number of visits to each page.
Service messages and platform news
We send account holders service messages about their account and important changes to the Service, our terms or this policy. These are part of providing the Service, so you cannot opt out of them while you have an account.
We may also send account holders occasional platform news, such as new features and improvements. You can opt out of these at any time using the link in each email or by emailing [email protected]. We never send marketing on behalf of other companies or share your details with others for their marketing.
Cookies
We use only a small number of cookies and similar technologies, which are needed for the Service to work or which you have asked for. Because of this, we do not need your consent and do not show a cookie banner. These are used on the Site, the admin area and websites built on BPanel, and their names may change from time to time.
| Name or type | What it does | How long | Type |
|---|---|---|---|
| Session cookie (named after the site) | Keeps a visit or sign-in together and protects forms | 2 hours of inactivity | Strictly necessary |
| XSRF-TOKEN | Security: stops other websites submitting forms on your behalf | Same as the session | Strictly necessary |
| remember_web_… | Keeps you signed in on this device, only if you tick "keep me signed in" | About 400 days | Requested by you |
| Admin visit marker | Stops admins' own visits being counted in visit statistics | 90 days | Functional |
| Display mode (browser storage) | Remembers light or dark mode | Until cleared | Preference |
| Application marker (browser storage) | Remembers that this browser has already applied to an event | Until cleared | Functional |
| Unsaved text (browser storage, admin area only) | Keeps unsaved typing on your own device if you are signed out, so it can be restored | Until restored | Functional |
You can block or delete cookies in your browser settings. If you block strictly necessary cookies, signing in and forms will not work. Websites built on BPanel may include content from other services, such as embedded videos, which may set their own cookies. The organisation running that website is responsible for that content.
5. Who we share your personal data with
We share personal data only where necessary, with:
- our service providers, who help us run the Service and act only on our instructions:
| Type of provider | What they do for us |
|---|---|
| Hosting provider (UK) | Runs the Service, its databases and file storage |
| Email delivery provider (European Union) | Sends service emails, such as invitations, account emails and confirmations |
| Backup storage provider | Keeps encrypted off-site backups |
- the organisation you manage a website for, including its other Admin Users who manage accounts and, where that organisation has arranged it, an umbrella organisation that supports its website;
- professional advisers, such as lawyers and accountants, where needed;
- the police, regulators, courts or other authorities, where the law requires it or where necessary to protect rights, safety or property; and
- a buyer or successor of our business, if all or part of it is transferred, who may use your data in the same way as described in this policy.
6. International transfers
Our main servers are in the UK. Our email delivery provider is based in the European Union, which the UK recognises as providing adequate protection for personal data. Our encrypted off-site backups may be stored outside the UK. Where they are, we use the safeguards required by UK data protection law. You can ask us for details of these safeguards.
7. Profiling and automated decision making
We do not make decisions about you using solely automated processing that have legal or similarly significant effects, and we do not profile you for marketing or advertising.
8. Data security
We take appropriate measures to protect personal data, including secure (https) connections, optional two-step verification, encryption of sensitive data, automatic sign-out, limits on repeated sign-in attempts, strict separation between organisations' data and records of admin activity. No system is completely secure, so please tell us immediately at [email protected] if you suspect any unauthorised access to your account.
9. Data retention
We keep personal data only for as long as we need it, and we may delete it sooner. We may keep it for longer where we need it in connection with a legal claim or where the law requires it.
| Data | How long we keep it |
|---|---|
| Accounts | While you have an active role. An account is deleted automatically after 12 months with no active role and no sign-in, and an invitation that is never accepted is deleted after 30 days. Some accounts with ongoing responsibilities, such as the only owner of a website, are not deleted automatically. Content you created stays on the website but is no longer linked to you. |
| Activity records | Routine edits: 12 months. Other records: up to 3 years. |
| Contact form messages and correspondence | As long as we need them to deal with your enquiry. If you become a customer, for as long as you remain one, so that we have a record of our dealings, and for up to 12 months afterwards. Otherwise, no more than 12 months after our last contact. |
| Customer and payment records | As long as tax and accounting law requires (usually 6 years). |
| Visit statistics | Detailed records: 90 days. After that, we keep only daily totals that contain no personal data. |
| Security counters and error logs | Security counters: minutes to hours. Error logs: 14 days. |
| Backups | Overwritten in our regular backup cycle, usually within 30 days. |
10. Your legal rights
Under data protection law, you have:
- the right to request a copy of the personal data we hold about you;
- the right to ask us to correct personal data that is inaccurate, incomplete or out of date;
- the right to ask us to erase your personal data where we no longer need to keep it;
- the right to object to our use of your personal data where we rely on legitimate interests;
- the right to ask us to restrict our use of your personal data, for example while a dispute about its accuracy is resolved;
- the right to ask us to provide personal data you gave us to you, or to another organisation, in a commonly used format; and
- the right to withdraw your consent at any time, where consent is the legal basis for our use of your data.
These rights have some legal exceptions. To use any of them, email [email protected]. Admin Users can also update their account details in the admin area. To delete your account, email us. If you manage a website for an organisation, we may need to tell that organisation so its access can be reassigned.
No fee usually required
You will not usually have to pay to use your rights. We may charge a reasonable fee, or refuse to act, if a request is clearly unfounded, repetitive or excessive.
What we may need from you
We may ask you to confirm your identity before we act on a request. This helps make sure personal data is not disclosed to anyone who is not entitled to it.
Time limit to respond
We will respond within one month. If a request is complex or you have made several requests, it may take up to three months, and we will tell you why.
11. Changes to this policy and your duty to tell us of changes
We may update this policy from time to time. We will tell account holders about significant changes by email or by a notice in the admin area. The version and date at the top show when it last changed.
Please keep your account details up to date and tell us if anything changes while you are using the Service. You must be 18 or over to hold a BPanel account, and the Site is not intended for children.
12. Queries, requests or concerns
If you have any questions about this policy or how we use your personal data, or you want to use any of your rights, please email [email protected].