Privacy & GDPR

Who we are

Company
Webfuel Ltd
Registered in
England & Wales, no. 06312575
Registered office
13 Woodroffe Way, East Leake, Loughborough, LE12 6AL
ICO registration
ZC149355
Email
info@webfuel.com
Phone
01509 852188

This website

At Webfuel we are strongly committed to protecting the privacy of users of this website, and we do all that we can to protect user information.

Information we collect from visitors

We collect information from visitors in two ways:

  • Feedback submitted to us
  • Anonymous site analytics

Feedback submitted to us

If you provide feedback through a contact form or email address we will only use this information for the purposes intended. You will not receive any subsequent unsolicited communication. We do not pass on any supplied personal information to third parties or maintain email marketing lists.

Anonymous site analytics

We use Cloudflare Web Analytics to count visits and see which pages are read, so we can tell whether the site is meeting visitors' needs and how we could make it better. It is designed for privacy: it sets no cookies, does not fingerprint your browser and does not follow you across other websites. It records only general details, such as the page you viewed, the site that linked you here, your browser and type of device, and your country. Your IP address is not stored, so none of this information can be used to identify who you are.

Cookies

This site does not use cookies. If you switch between the light and dark themes, your choice is remembered in your own browser's storage, so the site looks the same next time; it is never sent to us.

GDPR compliance statement

The EU General Data Protection Regulation (GDPR) came into force on 25th May 2018 and impacts every organisation which processes personal data of EU/UK citizens. It introduces new responsibilities, empowers businesses to be accountable for their processing of personal data as well as enabling EU/UK citizens to protect their privacy and control the way their data is processed.

If you are an existing Webfuel customer and your organisation's Data Controller this statement should go some way to explaining our approach to GDPR compliance as a Data Processor and assist you with ensuring you meet your own organisation's obligations under GDPR.

This statement does not provide specific advice on how to meet any other obligations you may have as a Data Controller and we recommend you seek expert legal opinion in relation to these questions.

Data protection definitions

  • Personal data is any information that relates to a living individual. It also includes any data that can be used with other sets of data to identify an individual. Typical examples of personal data are: name, identification number, location data, online identifier, email address, etc.
  • Processing relates to any operation carried out on personal data including collection, recording, organising, structuring, storing, using, etc. Processing also doesn’t have to be by automated means which means that processing includes paper-based, non-digital systems.
  • A Data Subject is the individual whose personal data is being processed.
  • A Data Controller is the organisation which determines how personal data is processed.
  • A Data Processor is an organisation which processes data on behalf of a Controller. This typically means a third party who is used by the Controller to process their data (e.g. a marketing company used to send out marketing materials).

For detailed information about the GDPR and data protection, visit the Information Commissioner’s Office website.

Your GDPR responsibilities

When you use our services to store or process your personal data (including customer’s or user’s data), you are the Data Controller and we are a Data Processor. This will be true for any personal data you place on our servers either directly, via a hosted website or by use of any of our other services.

The GDPR requires you, as a Data Controller, to ensure that any Data Processor services you use to process personal data are GDPR compliant. This means that when you use any of our services to process your personal data you need to carry out due diligence on our services and ensure certain contractual terms are in place.

This GDPR statement is our way of helping you meet these GDPR regulatory requirements and to offer you assurance that we take GDPR and the security of your personal data as part of the everyday running of our services.

Our GDPR commitment

As a UK company, Webfuel Limited are committed to ensuring our business, services and internal processes are GDPR compliant. As a consequence we have:

  • Updated internal policies relating to data protection and responsibilities within our businesses for ongoing GDPR compliance
  • Checked all our systems, processes and services to ensure they meet the requirements of GDPR, particularly around security of data and our use of any external third party services

Our services are compliant because:

  • We have fully assessed our own GDPR compliance both in terms of the services we offer to our customers and in terms of our own internal policies and procedures.
  • We have appropriate technical and personnel protocols in place to ensure the security of your data.
  • We carry out due diligence against any sub-processors or other third party processors we use to ensure their GDPR compliance (such as data centres).
  • We only allow specific members of staff access to our servers and what access that is available, is limited to specific circumstances.
  • We do not transfer your data outside the UK/EEA (except where explicitly directed to do so by a Data Controller).

Our role as a Data Processor

You are the owner of the data you or your customers or users submit to our services (whether they are hosted on your premises or on our servers).

When your data is placed on our servers, you are the Data Controller and Webfuel Limited, the Data Processor. Any processing (as a Data Processor) is only in terms of the hosting services we provide to you. We do not use your data for any processing of our own.

We do not share or provide access to any of your data with third parties unless required to do so by law. Where law enforcement or other authorised parties request access to our servers, we follow strict internal policies for dealing with such requests in line with existing UK law. Furthermore, the third parties are required to demonstrate they have a lawful reason to access the data and under what authority.

Hosting providers

Your data is stored on cloud hosted servers which we lease in Microsoft Azure cloud data centres within their European zone. We have contracted with Microsoft on the basis of their standard Azure subscription terms and conditions.

We do not enter into any form of bespoke agreements with Microsoft in relation to our work with individual clients.

Our contract with Microsoft is purely for the leasing of hardware (cloud based storage and compute resources). Microsoft have no responsibility for what data is stored, and how that data is processed. These decisions are all directed by our Data Controllers.

Microsoft Azure is a top tier data centre which runs a huge number of secure web applications. Azure is the second largest data centre provider in the world (second only to Amazon). Further details on the wide range of security certifications which Azure hold can be found in the Azure Trust Center.

At least once a year Azure data centres are audited for compliance with ISO 27001 and ISO 27018 by an accredited third party certification body. These audits are published on the Microsoft Azure website. We rely upon this formal certification to give us the assurances we need that they are storing your data securely. These audit reports can be found on the Microsoft Service Trust Portal. Downloading these audit reports is free however you may need to sign up with a Microsoft account to gain access.

Email providers

Email sent by your website or application is delivered through an established email delivery service, which we agree with you. Where your organisation uses Microsoft 365, we can send it from your own mailboxes instead.

Maintaining security

All key employees keep up to date with all technical aspects of security and ensure the ongoing security of our servers and systems. This means that any security patches are applied to our systems as a matter of priority and any changes or updates to our own systems are done so, always, with data protection and privacy in mind and where appropriate, in discussion with our customers. Where we have an agreement in place with our customers to do so, we also maintain the security of our customer’s own servers or hosted applications.

Access to servers

Remote admin access to our servers is strictly restricted to key personnel within our Technical Support team.

Strict protocols are in place regarding data centre staff access to Azure servers. The data centres we use hold ISO 27001 certification and have high security access controls.

Third party services

Other than the data centres which host our servers and the email delivery services described above, Webfuel Limited does not use any third party suppliers or services that would have access to, or process, any data you process on our servers.

Data backup

This section covers backup of all data which we may hold on your behalf, not just personal data. We store 3 different types of data and the backup process for each is described below.

  • Files (e.g. images, documents) are held on Microsoft Azure Storage accounts, specifically Zone Redundant Storage (ZRS). In summary this means that data is replicated across 3 physically separate storage clusters within the European zone. This ensures data is preserved in the case of normal outage/failures and natural disaster. More about Azure Storage redundancy.
  • Databases (all other structured data): we use Microsoft Azure databases, both managed SQL and Postgres databases. Databases are backed up to encrypted backups automatically by Microsoft using Zone Redundant Storage. More about Azure SQL backup and Azure PostgreSQL backup.
  • Source code: the source code that runs your application is held locally at Webfuel and backed up to private source code repositories with GitHub, a leading online source code repository used by millions of developers worldwide. The data held by GitHub is only source code and does not include any personal data. More about GitHub security.

Changes to our approach

Should our approach to any aspect covered by this statement change we will make sure, where your data is impacted, that we notify you within a reasonable timeframe and in line with any contractual terms in place between us.

Data breaches

In the unlikely event of a breach occurring (as defined in the GDPR) we will notify you within 48 hours of the breach coming to our attention. This will be enough time for you to consider your requirements, under GDPR, for reporting the breach to the ICO and Data Subjects.

We help you to comply with GDPR

Our approach to our own compliance also helps you comply with your own GDPR compliance requirements. Furthermore, if required we will assist you or the Information Commissioner’s Office with any query relating to the GDPR compliance of our services.

Data protection contact

Any questions, queries or requests for further information regarding our privacy policy or GDPR compliance should be sent to James Gaunt, Webfuel Limited, 13 Woodroffe Way, East Leake, Loughborough, LE12 6AL, or info@webfuel.com.

Someone mentioned us? Let's have a chat.

No technical brief needed. Just tell us what your team is trying to do, or what isn't working, and we'll take it from there.