Privacy Policy

1. Introduction

This Privacy Policy explains how Falcon Hosting Ltd (Company No. 15676555), trading as "Falcon Hosting" and "AwakeNode", collects, uses, stores, and protects personal data when you use our websites (falconhosting.co.uk, awakenode.co.uk), billing platform, and hosting services.

This policy is issued in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (together, "Data Protection Legislation") and the Privacy and Electronic Communications Regulations 2003 (PECR). Terms such as "personal data", "data subject", "controller", "processor", and "processing" have the meanings given to them in the UK GDPR.

This Privacy Policy should be read alongside our Terms of Service and Service Level Agreement, which together form the complete agreement governing your use of our services.

2. Data Controller

The data controller responsible for your personal data is:

• Company: Falcon Hosting Ltd
• Company Number: 15676555
• Registered in: England and Wales
• Registered office: Anglo Dal House, 5 Spring Villa Park, Spring Villa Road, Edgware, Middlesex, HA8 7EB, United Kingdom
• ICO registration number: ZB377567
• Support ticket: Open a ticket

For data protection queries or requests to exercise your rights, use a support ticket or write to our registered office.

3. Controller and Processor Roles

Falcon Hosting Ltd operates in two distinct data protection roles depending on the type of data being processed:

3.1 Falcon Hosting as Data Controller

We act as the data controller (as defined in Article 4(7) of the UK GDPR) for personal data we collect directly from you for the purpose of providing our services. This includes:

• Account information (name, email address, and optionally phone number and company name)
• Billing and transaction records
• Support tickets and the emails we send you
• Technical data such as IP addresses, sign-in records, account activity and service usage metrics

This Privacy Policy governs how we process this data as controller. Our lawful bases for processing are set out in Section 5.

3.2 Falcon Hosting as Data Processor

For personal data that you (or your end users) store on our hosting infrastructure - including website visitor data, application databases, game server data such as player names, and any other data hosted on your service - you are the data controller and we are the data processor (as defined in Article 4(8) of the UK GDPR).

In this capacity:

• We process your hosted data solely on your documented instructions and for the purpose of providing the hosting services you have purchased.
• We do not access, monitor, analyse, or use your hosted data except as necessary to operate the infrastructure, provide features you use (such as crash reports for game servers, see Section 4.8), troubleshoot issues at your request, or comply with legal obligations.
• You are responsible for ensuring that your processing of personal data on our infrastructure complies with Data Protection Legislation, including obtaining appropriate consents and legal bases from your end users.
• Our obligations as data processor are set out in detail in Section 8 of our Terms of Service.

3.3 Data Processing Agreement

If you require a separate Data Processing Agreement (DPA), request one through a support ticket. Section 8 of our Terms of Service sets out the processor terms that apply to hosted data.

4. What Personal Data We Collect

The remainder of this Privacy Policy relates to personal data for which we act as data controller (as described in Section 3.1), except where Section 4.8 says otherwise. It does not cover data you host on our infrastructure, for which you are the controller.

4.1 Account Information

When you create an account, we collect:

• Full name
• Email address
• Company name (optional)
• Phone number (optional)
• Your password, which we store only as a one-way scrypt hash - we can never see it
• Your two-factor authentication settings, if you turn it on

If you sign in with Google, Microsoft, GitHub or Apple, that provider tells us your name, email address and an account identifier, and we keep a link between your account and theirs. We don't receive your password for that provider.

Lawful basis: Performance of contract (Article 6(1)(b)) - this data is necessary to create your account, provide your services, and manage your billing relationship with us.

4.2 Payment Information

Cards, PayPal and available digital wallets are processed through Stripe. Stripe and the payment method you choose collect the details needed to complete the payment. We do not store your card number, CVV code or payment authentication data. Stripe handles card data under its PCI-DSS controls.

We keep the following records of each transaction:

• Invoices, orders, amounts and dates
• Payment method type (e.g., "Visa ending 1234", "bank transfer")
• Transaction IDs and payment status (paid, refunded, failed)
• When you asked for your service to start within the 14-day cancellation period

Lawful basis: Performance of contract (Article 6(1)(b)) and legal obligation (Article 6(1)(c)) - UK tax law requires us to keep billing records.

4.3 Bank Transfer Payments

If you pay by bank transfer, you send the payment to our business bank account at Starling Bank using a reference we give you. We receive the following details of each transfer from Starling and use them to match your payment to your account:

• The amount and date of the transfer
• The payment reference you included
• The payer name your bank sends with the payment

We do not store your sort code or account number. Where a payment doesn't match what's due, we use these details to contact you about the difference.

Lawful basis: Performance of contract (Article 6(1)(b)) and legal obligation (Article 6(1)(c)).

4.4 Support Communications

When you open a support ticket, request a quote or contact us, we collect and store:

• Your name and email address, if you contact us without an account
• The content of your messages and our replies
• Any files or attachments you provide
• Timestamps of communications

Authorised staff can view your client area as you see it, to help with support requests and to administer your account.

Lawful basis: Performance of contract (Article 6(1)(b)), or legitimate interests (Article 6(1)(f)) in answering enquiries before you become a customer.

4.5 Emails We Send You

We keep a copy of the emails we send you (such as invoices, service notices and support replies) so we have a record of what we told you and can answer questions about it later. Passwords and other login details are never kept in these copies. See Section 7 for how long we keep them.

Lawful basis: Legitimate interests (Article 6(1)(f)) - keeping an accurate record of our communications with customers, and handling complaints and disputes.

4.6 Technical, Security and Usage Data

• Sign-in sessions: When you sign in we record the IP address and browser or device you signed in from, so you stay signed in and so we can spot unauthorised access.
• Account activity: We keep a log of actions on your account - such as sign-ins, orders, payments, service changes and changes made by our staff - with the IP address they came from.
• Service resource usage: CPU, RAM, disk and network usage of your services, to show it to you, to keep our systems healthy and to tell you when a service is running short of resources (see Section 4.9).
• Error reports: If a page breaks while you're using it, we record the error, the address of the page and your browser type, so we can fix it.
• IP addresses assigned to your services are part of the service and are not used to track you.
• Server addresses: If you claim one of our free subdomains or add your own domain, we keep the hostname, its DNS or connection settings, and the service it points to. DNS records for free addresses are managed through Cloudflare.
• Container deployment settings: If you use container hosting, we keep the image name, exposed port, environment settings and optional registry credentials needed to deploy your application. Registry credentials are encrypted when stored.

Lawful basis: Performance of contract (Article 6(1)(b)) and legitimate interests (Article 6(1)(f)) - keeping accounts and systems secure, preventing abuse, and resolving disputes.

4.7 Fraud Prevention

To protect our customers and ourselves from fraud:

• Card payments are checked by Stripe's fraud screening, which may decline a payment or flag it for us to review.
• Free trials are limited to one per account, and some to a small number per network each day, using your IP address.

Lawful basis: Legitimate interests (Article 6(1)(f)) - preventing fraud and abuse of free trials.

4.8 Game Server Crash Reports

When a Minecraft server crashes or fails to start, we may send the relevant part of its log to Google's Gemini AI to explain the likely cause and suggest a fix. IP addresses and email addresses are removed from the log first. We use Google's paid service, under which Google does not use this data to train its models. Server logs are part of your hosted data, so for this we act as your processor (Section 3.2).

4.9 Emails About Upgrades

If one of your servers is consistently running short of memory, we may email you an offer to upgrade it. You can opt out when you sign up, from the link in any of these emails, or in your billing settings at any time. We send no other marketing emails, and we never share your details for marketing.

Lawful basis: Legitimate interests (Article 6(1)(f)), and the "soft opt-in" for existing customers under regulation 22 of PECR.

4.10 Cookies and Website Analytics

Strictly necessary cookies keep you signed in and keep your account secure. These don't need your consent under PECR because the service can't work without them. Some settings, such as light or dark mode and your cookie choice, are stored only in your browser.

Analytics: We use PostHog, hosted in the EU, to understand how people use our website so we can improve it - for example which pages are visited, what is clicked, and where people leave the ordering process. We record your browser, device, the page that referred you and your approximate location, worked out from your IP address.

• Without your permission, nothing is stored in your browser for analytics: each visit is counted on its own.
• If you click "Allow" on our cookie banner, PostHog uses cookies to recognise you on later visits, and records how you use our pages so we can see where they're hard to use. Anything you type is hidden from these recordings.
• When you're signed in, your activity on our website is linked to your account.
• You can change your choice at any time with "Cookie settings" at the bottom of every page.

We do not use advertising cookies, and we do not engage in cross-site tracking or behavioural advertising.

Lawful basis: Legitimate interests (Article 6(1)(f)) in understanding and improving our website; your consent (Article 6(1)(a) and regulation 6 of PECR) for analytics cookies and recordings.

5. How We Use Your Data and Legal Basis

We process your personal data for the following purposes, each with an identified lawful basis under Article 6(1) of the UK GDPR:

Where we rely on legitimate interests, we have carried out a Legitimate Interests Assessment to make sure the processing is necessary, proportionate, and does not override your rights and freedoms. You can ask us for a copy.

Automated decisions: The fraud checks in Section 4.7 can stop a payment or a free trial from going through. If that happens to you, contact us and a member of our team will review it. We do not otherwise make decisions about you based solely on automated processing.

We do not sell, rent, or share your personal data with third parties for their marketing.

6. Who We Share Your Data With

We share personal data only where necessary for the purposes above, with the following service providers acting on our behalf or as independent controllers, each under appropriate contractual safeguards:

• Stripe (Stripe Payments Europe Ltd and Stripe, Inc.) - cards, PayPal and available digital-wallet payments, invoices and fraud screening. See Stripe's privacy policy.
• Starling Bank Limited - our business bank, for receiving and matching bank transfer payments. See Starling's privacy notice.
• Microsoft (Microsoft Corporation) - delivers the emails we send you through Microsoft 365, and provides "Sign in with Microsoft" if you use it.
• Google (Google LLC) - Gemini AI for game server crash reports (Section 4.8), and "Sign in with Google" if you use it.
• GitHub (GitHub, Inc.) and Apple (Apple Inc.) - "Sign in with GitHub" and "Sign in with Apple", only if you use them.
• Hetzner Online GmbH - servers in the EU for some game servers and containers, and storage for backups.
• Cloudflare, Inc. - DNS records for free server addresses. These are DNS-only records; Cloudflare does not proxy the hosting traffic for them.
• Internet Security Research Group (Let's Encrypt) - certificate issuance for HTTPS on container domains, which involves sharing the requested hostname.
• PostHog (PostHog, Inc.) - website analytics, hosted in the EU (Section 4.10).
• Datacentre and network providers, including Path.net for DDoS protection - physical hosting, network connectivity and attack mitigation. They process network-level data such as IP addresses and traffic patterns, and do not access your data.
• Legal authorities - if we are required to disclose data by law, court order or regulatory request, or to protect our legal rights. We will tell you about such requests where the law allows.

A list of the sub-processors we use for your hosted data is in Section 8.5 of our Terms of Service.

7. Data Retention

We keep personal data only for as long as we need it. These are our retention periods:

We may keep specific data for longer where it is needed for a legal claim, a dispute or chargeback, a fraud investigation, or a request from the police or a court, and only until that matter is resolved.

When personal data is no longer required, it is securely deleted or anonymised so that it can no longer be associated with you.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage, in accordance with Article 32 of the UK GDPR. These measures include:

• Encryption of data in transit using TLS across all our websites and services.
• Passwords stored only as one-way hashes (scrypt), and optional two-factor authentication on every account.
• Encryption at rest of sensitive data we hold, such as stored server credentials and copies of the emails we send.
• Role-based access controls limiting staff access to personal data on a strict need-to-know basis, with staff actions recorded in the account activity log.
• DDoS mitigation and network-level security measures.
• Regular security updates and patching of our infrastructure and software.
• Physical security at our datacentre facilities, including access controls, CCTV, and environmental monitoring.
• Incident response procedures for identifying, reporting, and managing personal data breaches.

While we take all reasonable precautions, no system is 100% secure. If you become aware of a security incident affecting your account, please open a support ticket promptly.

9. Data Breach Notification

In the event of a personal data breach (as defined in Article 4(12) of the UK GDPR) that is likely to result in a risk to your rights and freedoms, we will:

• Notify the Information Commissioner's Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware of the breach (in accordance with Article 33 of the UK GDPR).
• Notify affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms (in accordance with Article 34 of the UK GDPR).
• Take reasonable steps to contain, investigate, and mitigate the breach.
• Document the breach, its effects, and the remedial actions taken.

Where we act as a data processor for your hosted data, our breach notification obligations to you (as data controller) are set out in Section 8.6 of our Terms of Service.

10. Where Your Data Is Stored and International Transfers

Your account data is stored on our servers in the United Kingdom. Virtual servers are hosted in the UK. Some game servers, containers and backups (Hetzner), and our website analytics (PostHog), are hosted in the EU, which the UK recognises as providing adequate protection for personal data.

Some providers in Section 6 process data outside the United Kingdom, including Stripe, Microsoft, Google, GitHub, Apple, Cloudflare and, for network-level data during attack mitigation, Path.net. Restricted transfers are protected by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where a US recipient is certified) or appropriate contractual safeguards such as the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, in accordance with Chapter V of the UK GDPR.

11. Your Rights Under UK GDPR

Under the UK GDPR, you have the following rights regarding your personal data. These rights apply to data for which we act as data controller (as described in Section 3.1):

• Right of access (Article 15): You can request a copy of the personal data we hold about you (a Subject Access Request). We will provide it in a commonly used electronic format.
• Right to rectification (Article 16): You can request correction of inaccurate or incomplete data. You can also update most account information yourself in your client area.
• Right to erasure (Article 17): You can ask us to erase your personal data. Once you have no active services and nothing is owed, we will erase your account, sign-in details, support history and copies of our emails to you. Invoices and payment records are kept for 6 years as UK tax law requires, without your name or contact details.
• Right to restrict processing (Article 18): You can request that we limit how we process your data in certain circumstances, for example while we verify the accuracy of data you have contested.
• Right to data portability (Article 20): You can request your personal data in a structured, commonly used, machine-readable format (JSON), and have it transmitted to another controller where technically feasible.
• Right to object (Article 21): You can object to processing based on our legitimate interests. We will stop unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms. You can object to upgrade offer emails at any time, and we will stop sending them.
• Right to withdraw consent: Where we process data based on your consent, you may withdraw that consent at any time - for analytics cookies, with "Cookie settings" at the bottom of every page. Withdrawal does not affect processing carried out before it.
• Rights related to automated decision-making (Article 22): You can ask for a person to review any decision made by our automated fraud checks (see Section 5).

Exercising Your Rights

To exercise any of these rights, open a support ticket headed "Data Protection Request" or write to our registered office. We may ask you to verify your identity before processing your request. We will respond within one calendar month of receiving your request, as required by Article 12(3) of the UK GDPR. This period may be extended by a further two months where necessary, taking into account the complexity and number of requests. We will inform you of any such extension within one month of receipt.

There is no fee for exercising your rights unless the request is manifestly unfounded or excessive (Article 12(5)), in which case we may charge a reasonable fee or refuse to act on the request.

Right to Complain

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your personal data in accordance with Data Protection Legislation:

• Website: ico.org.uk
• Phone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

You may also raise a concern with us through a support ticket or by writing to our registered office.

12. Children's Privacy

Our services are not directed to children under the age of 16, and you must be at least 16 to create an account. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data, please write to our registered office or use a support ticket if you have an account.

13. Third-Party Links

Our websites may contain links to third-party sites, such as payment processor portals and upstream provider status pages. We are not responsible for the privacy practices of those sites. This policy covers personal data processed by Falcon Hosting Ltd on both falconhosting.co.uk and awakenode.co.uk.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Material changes will be communicated via email to your registered address and/or a prominent notice on our website at least 14 days before the changes take effect. The "Last updated" date at the top of this page indicates when the policy was last revised.

We encourage you to review this page periodically.

15. Contact Us

If you have questions about this Privacy Policy, how we handle your personal data, or wish to exercise any of your rights under Data Protection Legislation, contact us:

• Support ticket: Open a ticket
• Post: Falcon Hosting Ltd, Anglo Dal House, 5 Spring Villa Park, Spring Villa Road, Edgware, Middlesex, HA8 7EB, United Kingdom
• Websites: falconhosting.co.uk and awakenode.co.uk
• Billing portal: Your billing account
• Terms of Service: Read the terms

Falcon Hosting Ltd
Company No. 15676555
Registered in England and Wales
Registered office: Anglo Dal House, 5 Spring Villa Park, Spring Villa Road, Edgware, Middlesex, HA8 7EB, United Kingdom
ICO registration number: ZB377567