Privacy Policy

Who looks after your information

Plenty Host Inc. is responsible for the personal information we handle through plenty.host, our regional sites, the Control Panel, billing and support. This policy applies when you browse our sites, ask for information, open an account, order services or contact us. We follow applicable privacy laws, including Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) where it applies.

What we collect and why

What we collect depends on the services you choose. Information can come from you, people you authorize to use your account, the systems you use to reach us or providers such as our payment processor and domain registrar.

Account, billing and orders

When you open an account or place an order, we handle your name, organization, contact and billing details, selected services, account identifiers, invoices, payment status and transaction references. We use these to manage your account, fulfil orders, handle billing and refunds, verify identity, prevent fraud and keep required records.

Domain registration

We collect the domain name, registrant details, other required contacts and any verification or proof of eligibility the extension requires. We use that information for registrations, renewals, transfers and disputes.

Support and service operations

When you contact us, we receive what you send by ticket, email, live chat or contact form, including any relevant logs or files you provide. We use that information and relevant account or service details to answer your request, diagnose problems, migrate or restore data and keep services secure. Leave passwords, card details and unrelated sensitive information out of tickets and chats. If we need something sensitive, ask us how to share it safely.

Website and Control Panel activity

Our systems record information such as IP addresses, browser or device details, the pages you request and when, session identifiers, sign-ins and security events. We also record service actions such as firewall changes, backup jobs and reinstalls. We use relevant records to run our sites, investigate incidents, enforce service limits and diagnose problems. These records may be linked to an account or identify someone in context.

Marketing preferences

If you sign up for updates, we keep your email address, sign-up and opt-out records and anything else you choose to provide when subscribing. We use them to send requested updates or other permitted messages and to honour your choices.

We use personal information for the reasons described here or for another purpose we explain when we ask for it. We ask for consent where required. If you choose to withhold information we need for an order, verification or service request, we may be unable to complete it. You can buy hosting regardless of your optional marketing choices.

Our accounts and ordering services are intended for people who can enter into a contract. If you think a child gave us information without the necessary permission, contact our Privacy Officer so we can review what happened and take appropriate action.

Card payments and domain registration

Stripe handles the card details you enter in its payment interface. It gives us information about the transaction, which can include the reference, amount, status, card brand and last four digits. We use that information for invoices, authorized renewals, fraud checks, disputes and refunds. Stripe also uses information for its own payment, security and legal purposes under its privacy policy.

When you register or manage a domain, we send the required registration and verification information to the registrar, registry and their service providers. Registrars and registries may have separate legal or policy responsibilities. Depending on the domain extension, type of registrant and applicable rules, some details may be hidden, appear in a registration data lookup or be disclosed in response to a lawful request or a request under registry or registrar policy. Ask us for the registrar’s terms or how a particular extension handles public registration details.

Information stored on websites and servers

Websites, databases, mailboxes, server disks, snapshots and backups can contain other people’s personal information. Our customers generally decide what to store in those systems and why. If we handle that data for a customer, we use it to provide and protect the service, carry out authorized support, backup, restore or migration work, or comply with law. Staff access is limited to what those tasks require.

Customers are responsible for their own privacy notices and permissions, user access and appropriate security inside their applications or self-managed servers. If one of our customers holds your information, send your request to that customer. Where appropriate, we’ll help them respond under our agreement or applicable law. Business customers who need a data processing agreement can discuss their requirements with our Privacy Officer.

Cookies, live chat and marketing emails

Our sites and the Control Panel use cookies or similar storage to keep you signed in, protect sessions, run checkout and remember settings such as currency and cookie preferences. If you clear or block cookies in your browser, you may be signed out, lose items in your cart or need to set your preferences again.

Pages with the Tawk.to chat widget may connect to that provider as soon as they load. Tawk.to may receive technical details such as your IP address, browser and page information. If you start a chat, the provider and our staff can receive what you enter and the conversation. You can also reach us by email, phone or ticket. The site’s cookie preferences apply to the functions they control. Other connections depend on your browser settings and the provider’s controls.

The public website still references an older Google Analytics tag. When the site requests that tag, it may share technical connection information with Google. See Google’s privacy policy for how it handles that information.

If you sign up for our newsletter, we send the address you enter to Mailchimp. We send promotional messages when we have the required permission. Use the unsubscribe link or contact our Privacy Officer to stop marketing emails. You may still receive messages you need about your account, invoices, service, renewals or security.

Who we share information with

We share information as needed with providers that help us run our infrastructure, data centres, backups, account systems, payments, fraud checks, domains, certificates, support and communications. For example, we may give the certificate authority the contacts it needs to validate a certificate order. We share only what the purpose calls for and require providers acting for us to protect the information through appropriate agreements and safeguards.

We may also share relevant information when the law requires or allows it, for example to respond to a valid order, investigate fraud, address a serious security incident or protect someone from harm. We assess each request and limit what we disclose to what the circumstances and law allow. If a business transaction is proposed or completed, we share information only when the legal conditions are met and protections are in place for confidentiality and how the information can be used.

Where we and our providers handle information

Plenty Host is based in Canada. We offer VPS hosting in Canada, the United States, the United Kingdom and Australia, and your choice determines where we deploy your primary server. Support, account and billing systems, domain registrars, backup services and other providers may handle information in Canada or elsewhere, including outside the province or country where you live or host a server.

Information handled abroad is subject to local law, which may allow authorities there to access it lawfully. We remain accountable when a provider handles personal information on our behalf and use appropriate safeguards. We follow any requirements for assessments, agreements or other safeguards when transferring information. Ask our Privacy Officer where information for your service is handled or what safeguards apply.

How long we keep information

We keep personal information as long as reasonably necessary for the reason we collected it and to meet any tax, accounting, domain, security, dispute or legal obligations. We may keep account and billing records after your service ends. We keep support and service records as needed to manage requests, investigate incidents and establish what happened. We may keep a record that you unsubscribed so we can honour your choice.

Export your hosted files, email and other data before your service ends. We may delete active copies when it ends, while backup copies may remain until their scheduled rotation or longer if the law requires us to preserve them. Once we no longer need to keep personal information, we delete, destroy or de-identify it as appropriate. Registrars, registries and payment processors may keep their own records for their own purposes after you close your account.

How we protect information and respond to incidents

We protect information according to its sensitivity, including by controlling staff access and using secure connections for account activity. You can help by protecting your credentials and recovery details, turning on multi-factor authentication where available and securing the apps and operating systems you manage.

If a privacy incident occurs, we assess what happened and take steps to contain it and reduce harm. We keep records and notify affected people, customers and regulators as required. Under PIPEDA, we report and give notice when a breach of security safeguards creates a real risk of significant harm. If you suspect an incident involving your account or data, email privacy@plenty.host.

Access, corrections and other privacy choices

Ask our Privacy Officer what personal information we hold about you and how we’ve used or shared it. You can also request access or correction, withdraw consent or raise a concern. Depending on the law that applies, you may also be able to ask us to delete or transfer your information, restrict its use, consider an objection or review a decision. Withdrawing consent may affect a service that needs the information and is subject to legal or contractual restrictions.

We may ask for enough information to verify your identity and find your records. We’ll respond by the deadline set by law and explain any permitted extension or restriction. For example, we may withhold details that would reveal another person’s protected information or that fall under another legal exception. You can also complain to the Office of the Privacy Commissioner of Canada or the relevant provincial or other privacy regulator.

Where the EU or UK GDPR applies, we use personal information to take steps you request before entering a contract, to carry out a contract or to meet legal obligations. We also rely on legitimate interests such as keeping services secure, preventing fraud and handling support requests where your rights do not override those interests. We ask for consent where required, including for optional marketing or tracking when applicable. You can withdraw consent at any time. That does not change whether earlier processing was lawful. You can also complain to the data protection authority responsible for your case.

Updates and how to reach us

We publish the date of each revision to this policy. We give notice of material changes as required and ask for consent if a new use or disclosure requires it.

Email privacy@plenty.host or write to the Privacy Officer, Plenty Host Inc., Box 11311, Station H, Ottawa, ON K2H 7V1, Canada. For service questions, see our Terms & Conditions or contact support.