Privacy Notice
How F13 Limited collects, uses and protects personal information
Last updated: 16 July 2026
F13 Limited uses personal information to answer enquiries, provide and support services, register and manage domains, bill customers, maintain security, prevent abuse and meet legal and regulatory obligations. We do not sell personal information. This Notice also explains when F13 acts as a processor for customer-controlled data.
1. About this Privacy Notice
1.1 This Privacy Notice explains how F13 Limited collects, uses, shares and protects personal information when you visit our website, contact us, request a quotation, purchase or use our services, manage a domain name, use a customer portal, raise a complaint or otherwise deal with us.
1.2 It applies to Consumers, sole traders, business contacts, employees or representatives of customers and suppliers, domain name registrants, website visitors and other individuals whose personal information we process.
1.3 This Notice should be read with our Cookie Policy, customer terms, Domain Registration Terms, Acceptable Use and Abuse Policy, Customer Service and Complaints Procedure and any service-specific privacy information provided at the point we collect personal information.
1.4 We may provide additional or shorter privacy information in forms, portals, contracts, quotations or service interfaces. That information supplements this Notice and should be read with it.
2. Who we are
2.1 F13 Limited is the controller of the personal information described in this Notice, except where we explain that we act as a processor on behalf of a customer or another organisation.
2.2 F13 Limited is a private limited company registered in England and Wales under company number 17045453. Our registered office is the current address shown on the public Companies House register. Business and correspondence address is Unit 1, Whittington Moor Business Park, Sheffield Road, Chesterfield, S41 8LF.
2.3 You can contact us about privacy or data protection by emailing office@f13.co.uk with “Data Protection” in the subject line, telephoning +44 (0)114 361 0113, using the contact details at https://f13.co.uk/contact/, or writing to our registered office marked for the attention of Data Protection.
2.4 F13 has not appointed a statutory Data Protection Officer. Data protection enquiries are handled by the director or member of staff responsible for privacy and compliance.
3. When F13 is a controller and when it is a processor
3.1 We act as a controller when we decide why and how personal information is used, including for customer administration, billing, domain registration, service management, security, fraud prevention, complaints, legal compliance and our own business communications.
3.2 When we host websites, provide email, manage networks, store backups, support customer systems or otherwise handle personal information solely on a customer’s documented instructions, the customer will normally be the controller and F13 will act as its processor.
3.3 Where we act as a processor, the customer is responsible for providing appropriate privacy information to the individuals concerned and for ensuring that its instructions to us are lawful. Our processing obligations are set out in the applicable contract or data processing terms.
3.4 We may nevertheless act as a controller for limited processing connected with a processor service, such as account administration, service security, abuse prevention, billing, legal compliance and defending legal claims.
4. Personal information we may collect
4.1 Identity information, such as your name, title, date of birth where required for verification, signature and evidence of authority to act for an organisation or registrant.
4.2 Contact information, such as your postal address, email address, telephone number and preferred contact method.
4.3 Organisation and professional information, such as your employer, business name, company number, job title, department, role, authorised users and relationship with a customer, supplier or partner.
4.4 Account and authentication information, such as customer or portal identifiers, usernames, password hashes, multi-factor authentication details, access permissions and security questions. We do not store passwords in readable form where our systems support secure hashing.
4.5 Order and service information, such as quotations, contracts, service addresses, installation details, equipment, network diagrams, service configurations, support entitlements, renewal dates and service history.
4.6 Financial and transaction information, such as billing addresses, payment status, bank details where supplied, transaction references, invoices, credit notes and records needed for accounting and debt recovery. Payment card information may be processed directly by a payment provider rather than stored by F13.
4.7 Domain registration information, such as registrant name, organisation, address, email, telephone number, domain name, registration and renewal dates, nameservers, registrar information, validation status and evidence used to verify identity, authority or data accuracy.
4.8 Technical, network and usage information, such as IP addresses, device identifiers, browser information, timestamps, authentication logs, DNS records, mail logs, traffic and performance data, security events, network device information, service usage and diagnostic data.
4.9 Communications and support information, such as emails, portal messages, support tickets, complaint records, call notes, meeting notes, instructions, attachments and feedback. If a call is recorded, we will tell you where required.
4.10 Website and cookie information, such as pages visited, referring pages, consent choices and analytics identifiers, as further explained in our Cookie Policy.
4.11 Marketing and preference information, such as whether you wish to receive service updates, offers or newsletters and records of consent, objection or unsubscribe requests.
4.12 Compliance, fraud and abuse information, such as reports of unlawful or prohibited activity, evidence supplied with abuse reports, sanctions or fraud screening results, correspondence with regulators or law enforcement, and records of investigations or enforcement action.
4.13 We do not ordinarily seek special category or criminal offence information. We may receive it incidentally in a complaint, support request, legal matter or abuse report. Where this happens, we will process it only where a lawful basis and any additional legal condition apply.
5. How we collect personal information
5.1 Directly from you when you contact us, use a form or portal, create an account, place an order, register or manage a domain, pay an invoice, request support, attend a meeting, make a complaint or report abuse.
5.2 From the organisation you work for, another authorised contact, a reseller, introducer, agent, domain portfolio manager or person asking us to provide services for you or an organisation you represent.
5.3 From domain registries, registrars, registration agents and related providers, including Nominet for .UK domains and sponsoring registrars or registry operators for other domains.
5.4 From suppliers and service partners, including carriers, wholesale connectivity providers, data centres, cloud providers, payment providers, security providers and installation partners.
5.5 Automatically from websites, portals, networks, devices, servers, email systems and security tools when you use or interact with our services.
5.6 From public sources where appropriate, such as Companies House, professional websites, public registers, public DNS or domain information and information you have made publicly available.
6. Why we use personal information and our lawful bases
We use personal information only where a lawful basis applies. The main purposes and bases are:
| Purpose | Information used | Main lawful basis |
|---|---|---|
| Responding to enquiries and preparing quotations | Identity, contact, organisation, project and communication information | Taking steps at your request before entering a contract; legitimate interests in responding to enquiries and developing our business |
| Opening and managing accounts and providing services | Identity, contact, account, order, technical and service information | Performance of a contract; legitimate interests in administering business-customer relationships |
| Registering, renewing, transferring and managing domains | Registrant, contact, verification, domain and transaction information | Performance of a contract; legal and registry obligations; legitimate interests in maintaining accurate and secure registration records |
| Billing, payments, accounting and debt recovery | Contact, financial, transaction, contract and communication information | Performance of a contract; legal obligations; legitimate interests in receiving payment and managing finances |
| Support, maintenance, fault handling and service improvement | Account, service, technical, network, usage and communication information | Performance of a contract; legitimate interests in operating, supporting and improving reliable services |
| Security, fraud prevention, monitoring and abuse handling | Technical, authentication, network, account, compliance and communication information | Legitimate interests in protecting customers, systems and the internet; legal obligations; establishment, exercise or defence of legal claims |
| Complaints, disputes, legal and regulatory compliance | Identity, contact, service, complaint, evidence and correspondence information | Legal obligations; performance of a contract; legitimate interests in resolving complaints and protecting legal rights |
| Direct marketing | Contact, organisation, service history and preference information | Consent where required; otherwise legitimate interests and permitted electronic marketing rules |
| Non-essential cookies and analytics | Cookie, device, browser and website usage information | Consent where required |
| Business administration and corporate transactions | Customer, supplier, contact, contract and financial information | Legitimate interests in managing, financing, insuring, reorganising or transferring our business; legal obligations |
Where more than one basis is listed, the basis used depends on the circumstances. We document our assessment where required.
7. Domain name registration and management
7.1 To register or manage a domain, we must provide required registration information to the relevant registry, sponsoring registrar, registry service provider or other authorised supplier. The recipient may act as an independent controller under its own terms and privacy notice.
7.2 For .UK domains, F13 provides relevant registration information to Nominet, which operates the .UK registry. Nominet may validate registrant information, maintain the register, operate the WHOIS service, handle disputes, prevent abuse and disclose information where permitted or required.
7.3 The .UK WHOIS does not ordinarily display a registrant’s name or postal address unless permission has been given, although registration status and other domain information may be publicly visible. Other registries and RDAP or WHOIS services may apply different publication and disclosure rules.
7.4 Registration data may be disclosed to people or organisations with a legitimate and lawful reason, including for domain disputes, enforcement of legal rights, fraud prevention, cybersecurity, law enforcement or compliance with registry rules.
7.5 You must ensure that registration information is accurate and that you have authority to provide information about any other person. If you provide another person’s information, you should make this Notice available to them.
8. Hosting, email, connectivity and managed services
8.1 Our systems may generate and retain technical logs needed to deliver, secure, troubleshoot and maintain hosting, email, connectivity, DNS, Wi-Fi, network and managed services.
8.2 Depending on the service, logs may include source and destination IP addresses, timestamps, authentication events, email routing information, device identifiers, traffic volumes, system events and security alerts. We do not routinely inspect the content of customer communications or hosted data unless necessary to provide support, investigate security or abuse, comply with law, or act on the customer’s instructions.
8.3 Where F13 supplies connectivity through an upstream carrier or wholesale provider, we may share customer, installation, technical and fault information with that provider to provision, support, maintain and bill the service.
8.4 When carrying out site surveys, installations or consultancy, we may collect contact details, access information, photographs, plans, equipment records and notes that incidentally identify staff, contractors or visitors. We use this information only for project delivery, safety, support and record-keeping.
9. Cookies and similar technologies
9.1 We use cookies and similar technologies to operate our websites and portals, remember preferences, maintain security and, where enabled, understand how visitors use our services.
9.2 We use strictly necessary cookies where required to provide a service or secure the website. We seek consent before using non-essential analytics, advertising or similar technologies where consent is required.
9.3 Our Cookie Policy explains the cookies in use, their purposes, durations and how you can change your choices.
10. Direct marketing and service communications
10.1 We may send operational messages about orders, service availability, security, renewals, invoices, support, policy changes and other matters necessary to manage your service. These are not marketing messages.
10.2 We may send relevant business-to-business marketing where we have a legitimate interest and electronic marketing rules allow it. For Consumers, sole traders and some individual subscribers, we will rely on consent or another permitted basis such as the existing-customer “soft opt-in” where its conditions are met.
10.3 You can object to direct marketing or unsubscribe at any time using the link in a message or by contacting us. We may retain a minimal suppression record so that we continue to respect your choice.
11. Who we share personal information with
11.1 Domain registries, sponsoring registrars, registration agents, escrow providers and domain service suppliers where needed to provide domain services.
11.2 Connectivity carriers, wholesale providers, data centres, cloud, hosting, email, DNS, software, monitoring, cybersecurity and technical support suppliers.
11.3 Payment processors, banks, accountants, auditors, insurers, debt recovery providers and professional advisers.
11.4 Installation contractors, consultants and other delivery partners where they need information to provide an authorised service.
11.5 Courts, regulators, law enforcement, government bodies, dispute-resolution providers and other authorities where disclosure is required or permitted by law, necessary to protect rights or safety, or needed to investigate fraud, security incidents or abuse.
11.6 A buyer, investor, lender or professional adviser in connection with an actual or proposed sale, transfer, financing, reorganisation or acquisition of all or part of our business, subject to appropriate confidentiality and data protection safeguards.
11.7 We require service providers acting as processors to protect personal information and use it only for authorised purposes. Some recipients, such as registries, banks, regulators and professional advisers, may act as independent controllers.
12. International transfers
12.1 Some registries, sponsoring registrars, cloud providers, software suppliers or support providers may be located outside the United Kingdom or may allow access to personal information from another country.
12.2 Where a restricted international transfer occurs, we use a lawful transfer mechanism where required, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses, or another permitted safeguard or exception.
12.3 You may contact us for further information about the safeguards relevant to a particular transfer, subject to confidentiality and security limitations.
13. Information security
13.1 We use technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, loss or destruction. Measures may include access controls, authentication, encryption where appropriate, backups, monitoring, logging, patching, network security and staff or contractor confidentiality obligations.
13.2 No internet, email or storage system can be guaranteed completely secure. You are responsible for protecting your own passwords, devices and access credentials and for telling us promptly if you suspect unauthorised access.
13.3 Where a personal data breach creates a legal notification obligation, we will notify the ICO and affected individuals as required by applicable law.
14. How long we keep personal information
We keep personal information only for as long as reasonably necessary for the purpose collected, including legal, accounting, security and dispute requirements. There are no universal retention periods; the following are our normal working periods:
| Record type | Normal retention approach |
|---|---|
| Enquiries and quotations that do not proceed | Normally up to 24 months after the last substantive contact, unless a longer period is justified by an ongoing opportunity, dispute or legal requirement. |
| Customer accounts, contracts and service records | For the duration of the relationship and normally six years afterwards, or longer where needed for legal claims or a specific regulatory obligation. |
| Invoices, payment and accounting records | Normally six years after the end of the relevant accounting period or transaction, subject to tax and company-law requirements. |
| Domain registration and transaction information | For the registration or management period and normally six years afterwards, subject to registry, sponsoring-registrar, dispute, fraud-prevention and legal requirements. |
| Support tickets and routine communications | Normally three years after closure. Material contractual, design, security, complaint or dispute records may be retained for up to six years or longer where necessary. |
| Network, authentication and security logs | Retention varies by system and purpose. Logs are commonly retained for up to 12 months, with shorter or longer periods where operational, security, legal or regulatory needs justify it. |
| Complaints, disputes and abuse reports | Normally six years after closure, or longer where litigation, regulatory action or a continuing risk requires it. |
| Marketing records | Until you opt out, consent is withdrawn, or the information is no longer needed. A minimal suppression record may be retained to respect an objection or unsubscribe request. |
| Cookie and analytics data | As set out in the Cookie Policy and consent interface. |
| Customer-controlled hosted content and backups | As set out in the applicable contract, service specification and backup cycle. Following termination, data is deleted or rendered inaccessible in accordance with the service process, subject to backup rotation, legal holds and security requirements. |
We may retain information for a longer or shorter period where the purpose, law, registry rules, security needs, legal claims or a preservation request requires it. When information is no longer needed, we delete, anonymise or securely dispose of it.
15. Your data protection rights
15.1 Depending on the circumstances, you may have the right to be informed about our processing and to request access to your personal information.
15.2 You may ask us to correct inaccurate or incomplete information, erase information, restrict its use, provide certain information in a portable format, or stop processing in particular circumstances.
15.3 You have an absolute right to object to personal information being used for direct marketing. You may also object to processing based on legitimate interests, although we may continue where we have compelling legitimate grounds or need the information for legal claims.
15.4 Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.
15.5 These rights are not absolute. We may need to verify your identity and may refuse or limit a request where the law permits. We will explain our decision where required.
15.6 To exercise a right, email office@f13.co.uk with “Data Protection Request” in the subject line or use the contact details in section 2. Please describe the information or service concerned so we can respond efficiently.
16. Automated decision-making
16.1 We do not currently make decisions about individuals based solely on automated processing that produce legal effects or similarly significant effects.
16.2 We may use automated tools to identify suspicious logins, spam, malware, abuse, fraud, payment risk or service faults. Significant actions are reviewed by a person where appropriate or where required by law.
17. Children
17.1 Our commercial services and online ordering are generally intended for people aged 18 or over and for organisations. We do not knowingly market services directly to children.
17.2 If you provide personal information about a child, you must have an appropriate lawful basis and authority to do so. Contact us if you believe we hold a child’s information inappropriately.
18. Data protection complaints
18.1 You may raise a data protection complaint by emailing office@f13.co.uk with “Data Protection Complaint” in the subject line, by telephone, through our complaints route, or in writing to our registered office.
18.2 We will acknowledge a data protection complaint within 30 days of receipt. We will take appropriate steps to investigate it without undue delay, keep you informed where appropriate, and tell you the outcome.
18.3 You also have the right to complain to the Information Commissioner’s Office (ICO). The ICO can be contacted through https://ico.org.uk/, by telephone on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would welcome the opportunity to address your concern first.
19. Third-party websites and services
19.1 Our websites or communications may link to third-party websites or services. Those organisations are responsible for their own privacy practices. You should read their privacy information before providing personal information.
20. Changes to this Privacy Notice
20.1 We may update this Notice to reflect changes in our services, suppliers, systems, legal obligations or regulatory guidance. The current version will be published on our website with its last-updated date.
20.2 Where a change is material and we have suitable contact details, we may also notify affected customers by email, portal message or another appropriate method.
21. Contact details
21.1 F13 Limited, registered in England and Wales under company number 17045453.
21.2 Email: office@f13.co.uk (please use “Data Protection” in the subject line).
21.3 Telephone: +44 (0)114 361 0113.
21.4 Website and contact form: https://f13.co.uk/contact/.
21.5 Post: our registered office address as shown on the Companies House public register, marked for the attention of Data Protection.