Last updated 19 October 2026.
Who we are
WPops Land Ltd is the data controller for the personal data described here. The company is registered in England and Wales, company number 17526619, with its registered office at 18 Chippendale Close, High Wycombe HP13 6BT. It is registered with the Information Commissioner’s Office under number ZC277393.
Christian Ashby runs the company and is responsible for data protection. You can reach him through the contact page, by phone on 020 3422 9767, or by post at the registered office.
Visitors to wpops.land
When you visit this site, the web server records your IP address, the page you asked for, the time and your browser’s details. I use these logs to keep the site running and to spot attacks.
A cookie banner (WPConsent) asks before any analytics cookies are set. If you agree, Google Tag Manager loads Google Analytics, which records the pages you view, how you arrived and roughly where you are. If you decline, no analytics cookies are set. You can change your choice at any time from the cookie icon at the bottom of each page.
Cookies on this site
The list below is kept up to date by the cookie banner plugin and shows every cookie this site can set, what it is for and how long it lasts. You can open your preferences from the button under it.
If you use the contact form, I receive the name, email address, website and message you type in. Google reCAPTCHA checks the form for spam, which sends Google information about your device and how you use the page. Your message reaches my mailbox by email, delivered through Brevo. I use it to reply to you and, if you become a customer, to set up your account.
Customers
For customers I hold your name, organisation, email address, phone number, billing address and a record of invoices and payments. WPops Land Ltd invoices monthly, and you can pay by bank transfer or by card. Card payments are taken through Stripe, which sees your card details; WPops Land Ltd never stores them. Account and billing records and support tickets are kept in Zoho CRM. Emails with me are kept in the company’s Google Workspace mailbox.
You and the people you add sign in to the dashboard and to WordPress with a Google account. Google tells the platform which email address signed in; the platform never sees your password. The platform records sign-ins and admin actions to protect your site. If you turn on the activity report for a site, a record of who did what in WordPress is kept for 12 months.
The dashboard uses Google Analytics to measure how it is used, but only if you allow it. You are asked the first time you sign in, and you can change your answer at any time from Privacy in the dashboard footer. If you allow it, your email address is turned into a one-way code in your browser before anything is sent to Google.
The AI assistant in the dashboard sends your questions, and the parts of your site’s logs, database and settings it reads to answer them, to an AI model provider (currently Anthropic). It has read-only access to your own site and cannot see other customers’ data. The platform keeps a log of each conversation so I can follow up a problem. Anthropic processes this text in the United States. Its terms say it may not train its models on what we send, and it deletes the questions and answers within 30 days unless its safety systems flag them for breaking its usage policy.
Visitors to your site
When I host your site, you are the controller of your visitors’ personal data and WPops Land Ltd is your processor. That covers the web server and load balancer logs (IP address, page, time, browser details), the database and files that hold whatever your site collects, such as orders, form entries, comments and user accounts, and the nightly backups of all of it. Google’s content delivery network keeps cached copies of your public files at its edge locations so pages load quickly.
Mail your site sends, such as form notifications and order confirmations, goes out through Brevo. Contact forms on static sites are checked with Google reCAPTCHA, and the entries are stored for you in the dashboard. I handle this data only to run your site, as the terms of service set out.
For domains whose DNS I host, mail providers send DMARC aggregate reports. These list the servers that sent mail using your domain and whether that mail passed its checks. They contain no message content and no recipients. The reports arrive through Amazon SES in Ireland and are stored in Google BigQuery in the EU.
If you use the send-as-your-domain relay, the messages you send, with their content and recipients, pass through Amazon SES in London on their way out.
Lawful bases
I hold customer data to perform the contract with you: hosting, support and billing. Server logs, sign-in records, spam checks and replies to enquiries rely on legitimate interests: keeping the platform secure and answering people who write to me. Analytics on wpops.land relies on your consent, which you can withdraw at any time. Accounting records are kept because the law requires it.
Who processes data for us
| Provider | What for | Where the data is held |
|---|---|---|
| Google Cloud | Hosting, databases, files, backups, logs, the dashboard and uptime history | London; dashboard settings, DMARC and activity records in the EU; cached public files at edge locations worldwide |
| Google Cloud | Uptime checker that loads your home page every 5 minutes | United States (it stores results in London) |
| Google Workspace | Company email and the Google groups that control who can sign in | Google’s data centres, including the US |
| Google Analytics, Tag Manager and reCAPTCHA | Site analytics with consent; spam checks on forms | United States and Google’s data centres worldwide |
| Brevo | Email sent by hosted sites and by the wpops.land contact form | EU (France and Belgium) |
| Zoho | Customer, billing and support ticket records | EU (Amsterdam and Dublin) |
| Amazon Web Services (SES) | Send-as-your-domain relay; receiving DMARC reports | London (relay); Ireland (reports) |
| Stripe | Taking card payments; it sees your card details, which WPops Land Ltd never stores | Ireland (Stripe Payments Europe) and the United States |
| Anthropic | AI model for the dashboard assistant | United States |
| UptimeRobot | External uptime checks and public status pages | Slovakia (EEA); its suppliers may be outside the EEA |
International transfers
Your site and its backups stay in London. Data held in the European Economic Area (EEA) is covered by the UK’s adequacy regulations for the EEA. For each provider outside the UK:
- Google LLC (Google Cloud, Google Workspace, Google Analytics, Tag Manager and reCAPTCHA) is certified under the EU-US Data Privacy Framework, including its UK Extension, which the UK recognises as adequate.
- Anthropic PBC is not certified under the Data Privacy Framework. Transfers to it rest on its data processing addendum, which includes the standard contractual clauses with the UK Addendum.
- Brevo SAS is based in Paris and hosts its platform in France and Belgium. Brevo is certified under the Data Privacy Framework, including the UK Extension, for any data that reaches its US company.
- Zoho holds our EU account in its data centres in Amsterdam and Dublin. Where Zoho processes that data outside the EEA, it relies on standard contractual clauses.
- Stripe: card payments are processed by Stripe Payments Europe in Ireland, with some processing in the United States under the standard contractual clauses in Stripe’s data processing agreement.
- Amazon Web Services keeps the SES content in the region we choose: London for the relay and Ireland for DMARC reports. Its UK GDPR addendum includes the UK’s International Data Transfer Addendum.
- UptimeRobot s. r. o. is a Slovak company. Slovakia is in the EEA, so the UK’s adequacy regulations cover it. Its own suppliers may be outside the EEA, under UptimeRobot’s contractual safeguards.
How long data is kept
- Backups: 28 days.
- Server and platform logs: 30 days (Google’s default for the log bucket).
- Uptime history: 90 days.
- WordPress activity reports, where switched on: 12 months.
- Analytics on wpops.land: event data for two months and user-level data for 14 months, the Google Analytics defaults.
- Enquiries that don’t lead to business, customer account, billing and support records (held in Zoho) and AI assistant conversation logs: 12 months after the enquiry or our relationship ends, unless the law requires longer. Tax and audit records, such as invoices, are kept for six years.
- DMARC report data: while I host your domain’s DNS.
- Your site when you leave: deleted within 30 days of the end of the service, with the last backups expiring 28 days later.
Your rights
You can ask for a copy of your data, ask me to correct it, delete it or restrict how it is used, object to its use, or ask for it in a portable format. Where I rely on consent, you can withdraw it at any time. Use the contact page and I’ll reply within one month.
If you were a visitor to a site I host, contact the owner of that site first, since they decide how its data is used. I help them answer your request.
If you are unhappy with how your data has been handled, please tell me first. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Children
The service is for organisations, and this site is not aimed at children. I don’t knowingly collect personal data from anyone under 16.
Some of the sites and apps I host do handle data about children, for example a school’s registers or a club’s membership list. For that data the customer is the controller and WPops Land Ltd is the processor: the customer decides what is collected, holds the lawful basis and any parental consent that is needed, and answers requests from the people the data is about. My part is to hold that data securely on the customer’s instructions, as described in the processor section above and in the terms. If you have a question about data that a hosted site holds about you or your child, that site’s own privacy notice says who to contact.
Changes to this notice
When this notice changes, the date at the top changes too. If a change affects customers in a meaningful way, I email them before it takes effect.