Privacy Policy

Last updated: 26 October 2026

This notice explains how Simifran (UK) Ltd (“we”, “us”, “our”), trading as FBC iBusiness, collects and uses personal data.

It covers our website fbcbusiness.uk, our Client Area, billing, hosting and domains, support, and related tools we use to look after your WordPress site.

We wrote it in plain English. If you only read one part, read Who we are, How we use your data, Who we share it with, and Your rights.

We do not sell your personal data.

1. Who we are

The data controller is:

Simifran (UK) Ltd
Registered in England and Wales, company number 09318164
Registered office: 20 Wenlock Road, London, England, N1 7GU
Trading as FBC iBusiness

Privacy requests: hello@fbcbusiness.uk
(Please put “Privacy” in the subject so we can treat it as a rights or complaints request.)

We have not appointed a Data Protection Officer. Privacy requests are handled by the directors.

If you are unhappy with how we use your data, you can complain to us first (see Complaints) and you can also complain to the UK Information Commissioner’s Office (ICO): https://ico.org.uk/make-a-complaint/.

2. What this notice covers

This notice applies when you:

visit our website fbcbusiness.uk
send an enquiry (Contact, Get Started, Quick Fix, Web Design)
create or use a Client Area account — including any legacy account at accounts.fbcbusiness.uk
buy or use Website Partner Plans (Care, Partner, Complete), Web Design, Quick Fix, domains, hosting, email, or related services
open a support ticket or otherwise ask us for help
pay an invoice

It also explains our role when we host or look after your website (including backups and security checks). In that case we are usually processing data for you, not using it for our own marketing.

This notice does not apply to other people’s websites that we link to. They have their own policies.

3. Two roles: your account with us, and data on your website

Like other hosting and web-care providers, we act in two different ways.

When we are the controller
We decide how to use data about you as our customer or enquirer: your name, company, contacts, invoices, tickets, login, and the domain names you register through us.

When we are the processor
If we host your site, look after WordPress, store offsite backups, or connect a monitoring plugin, we process the content of that site and related mailboxes on your instructions to deliver the service. You remain the controller of your own visitors’, customers’, and staff data. You must have a lawful basis and your own privacy information for that data.

If you give us personal data about someone else (for example a domain registrant, a staff contact, or content you upload), you must be allowed to do so.

4. Personal data we collect

What we hold depends on how you deal with us.

You give us

Identity and contact: name, email, phone, business name, postal address if you supply it
Enquiry details: website URL, what you need (plan, fix, design), message, how you prefer to be contacted
Account and billing: company details, invoice history, payment status, plan and domain records
Support: ticket content, files you send us, and notes of calls or emails (we do not record phone calls)
Domain data: the domain name and registrant / admin contact details required by the registry
Login credentials for the Client Area (we store passwords in hashed form, not in plain text)

We create or log

Technical data: IP address, browser type, device, pages viewed, referral source, approximate location from IP, and server/security logs
Service data: which sites and packages are linked to your account, invoice mappings, uptime and security checks on plan sites (Site Connector)
Records needed for tax, fraud prevention, and dispute handling

Others may give us data

Payment providers (for example PayPal) tell us whether a payment succeeded or failed and may provide limited payment-method details, such as card type and last four digits
Our hosting infrastructure tells us the status of hosting packages, email, SSL, DNS, and domains
You or another contact on the same company account may add colleagues
Public sources: for business outreach, we collect business contact details from Companies House, the business’s own website and public registers (see section 5A)

Payment cards
Invoices may be paid by PayPal, card, Direct Debit, or another payment method shown on the invoice. Full card numbers are collected and handled by the payment provider, not by us. Our Client Area may display limited payment information supplied by the provider, such as the card type and last four digits, so that you can identify a saved payment method.

Information we need from you
We need enough identity, contact, billing, service, and—where relevant—domain registrant information to respond to you, enter into a contract, provide the service, and meet our legal obligations. If you do not provide required information, we may be unable to open an account, register a domain, or provide the requested service. Information marked optional on a form does not have to be provided.

We do not collect licence keys, public comments, or “member profiles” of the kind described on older versions of this page. We do not intentionally collect children’s data for our own account administration or marketing; see Children for data we may process on a client’s behalf.

5. How we use your data, and our lawful bases

UK GDPR requires a lawful basis for each use. These are the bases we rely on.

Purpose	Lawful basis
Reply to an enquiry and recommend a plan, Quick Fix, or design project	Legitimate interests (responding to someone who asked us to), and steps toward a contract if you then buy
Set up and run your Client Area, Partner Plan, hosting, email, SSL, DNS, and domains	Contract
Raise and collect invoices; keep accounting records	Contract, and legal obligation (tax / company law)
Support tickets, changes to a plan, cancellations, extra hours	Contract
Domain search, registration, and renewal (including passing registrant data to the relevant domain registry)	Contract, and legal / registry obligation
Security, fraud prevention, keeping the site and hub working	Legitimate interests (ours and our customers’ — a safe service)
Administer accounts, retain important service correspondence, and establish or defend legal claims	Contract and legitimate interests (running the service and protecting legal rights)
Service emails: invoices, tickets, renewals, security or downtime that affects your account	Contract, and legitimate interests
Process payments and receive fraud or payment-status information from payment providers	Contract and legitimate interests (preventing fraud and confirming payment)
Analytics and advertising cookies / pixels	Consent (PECR and UK GDPR)
hCaptcha on forms	Legitimate interests (stop spam and abuse); hCaptcha also has its own notice
Load website fonts supplied by Google	Legitimate interests (presenting our website consistently)
Administer an agreed affiliate referral and calculate commission	Legitimate interests (operating and checking the referral arrangement)
Improve our services using aggregated or non-identifying insights	Legitimate interests
Share data if the law requires it	Legal obligation

Legitimate interests. Where we rely on this, we have considered your rights. You can object (see Your rights). We do not use legitimate interests for optional advertising cookies.

Consent. You can withdraw cookie consent at any time via the cookie settings on our site (or by changing your browser, which may also delete the consent cookie). Withdrawing consent does not affect processing that already happened.

Marketing emails. We do not send newsletters or promotional mailing lists. We do send a small number of one-to-one emails to limited companies and LLPs to offer a free website audit. Section 5A explains how.

Automated decisions. We do not make solely automated decisions that have a legal or similarly significant effect on you (for example, auto-refusing a contract without a human). Payment providers may run their own fraud checks.

5A. Business outreach emails

Sometimes we email businesses that have not contacted us first, to offer a free website audit and, if they want it, our WordPress care services. This section explains what we hold, where it comes from and how to stop us.

Who we are

Simifran (UK) Ltd (company number 09318164), trading as FBC iBusiness, is the controller for this data. Outreach emails come from Brendon Francis at brendon@fbcbusiness.uk. For privacy requests, email hello@fbcbusiness.uk with “Privacy” in the subject, or reply to any of our emails.

Who we email

We email limited companies and limited liability partnerships (LLPs) only, and we check this on Companies House before we write. We do not send outreach emails to sole traders or ordinary partnerships. We do not buy email lists.

What data we hold

The contact’s name and role (for example a director listed on Companies House)
A work email address published by the business
Company details from Companies House: name, number, registered address, industry code and filing dates
Observations from the public parts of the business’s website, such as the WordPress, plugin or PHP versions it shows, security certificate status and page speed. We only look at what any visitor can see. We never log in, test passwords or submit forms.
Our own notes: when we emailed, any reply, and whether you asked us to stop

We do not collect sensitive (special category) data for outreach.

Where it comes from

Companies House, the business’s own website (for example its contact, team or legal pages), and public professional registers such as the Solicitors Regulation Authority register or the Care Quality Commission website.

Why we use it, and our lawful basis

We use this data to send a short email that points out a specific issue we found on the business’s website and offers a free, no-obligation audit, and to follow up if the business is interested.

Our lawful basis is legitimate interests (UK GDPR Article 6(1)(f)). Our interest is telling small businesses about website problems we can help fix. We have weighed this against your interests and rights: we email only work addresses, send a small number of messages, use no tracking pixels and give a way to opt out every time. Our written assessment is available on request.

Under the Privacy and Electronic Communications Regulations (PECR), marketing emails to limited companies and LLPs do not need prior consent. We always say who we are and give an easy way to opt out.

How many emails

At most one first email and up to three short follow-ups in the same thread. We stop straight away if you reply, ask us to stop, or the email bounces.

How to object or opt out

You have an absolute right to object to direct marketing (UK GDPR Article 21). Reply “stop” to any of our emails, or email hello@fbcbusiness.uk. We will act on it within one business day and will not email you again.

Our do-not-contact (suppression) list

When someone opts out, objects or their email bounces, we add the email address (and, where relevant, the company) to a suppression list so that we never contact them again, even if their details turn up in a future search. We keep only the email address, the date and the reason.

How long we keep it

Outreach records are kept for 12 months after our last contact, then deleted, unless you become a customer (then the rest of this notice applies). Suppression entries are kept indefinitely so that your opt-out keeps working.

Who we share it with

We do not sell outreach data or share it for anyone else’s marketing. It is stored on our own systems and with our UK/EEA email and hosting provider, which acts on our behalf. Details of the providers we use are available on request.

Your other rights

You can ask to see, correct, delete or restrict the data we hold about you (see section 11). If you ask us to delete it, we will still keep a minimal suppression entry so that we do not contact you again, unless you tell us you do not want that.

Complaints

Please tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator: https://ico.org.uk/make-a-complaint/

6. Who we share data with

We share personal data only where it is needed to run the service, required by law, or you have asked us to. Account data we hold ourselves is described first; it is not a transfer to a CRM vendor.

Hosting, email, and domains
We use a hosting and email infrastructure provider in the UK/EEA, acting on our behalf, for hosting, SSL, DNS, email, the website control panel, and domain registration and renewal. For website and mailbox content, that provider and we typically act as processors for you. We remain responsible to you for that processing. Domain registration data is also sent to the relevant registry (for example Nominet for many .uk names) and may appear in WHOIS or equivalent public records as the registry rules require.

Our Client Area
Account, invoice, ticket, and Services records are stored in our Client Area. We host it in the United Kingdom, on the same infrastructure as our website. It is our system, not a separate third-party platform. Some legacy accounts still use a Client Area at accounts.fbcbusiness.uk while those accounts are migrated.

Payments
PayPal and/or other card processors connected to the Client Area. They are controllers or processors of payment data under their own notices.

FBC Storage (offsite backups)
Offsite backups of plan sites are stored with a backup provider, acting on our behalf, in the UK or EU. A backup can include personal data from your site (for example shop customers or form entries). That provider is used only to provide the backup service. Staff retrieve a backup when needed for restore or support. Clients do not receive backup download passwords in the Client Area. We remain responsible to you for that processing.

Site Connector
A WordPress plugin we install on plan sites so we can check uptime, updates, and a security baseline, and so backups can run. It sends health and security metadata to our hub. It is a staff operations tool, not a public analytics product.

Form and bot protection — hCaptcha
Contact and similar forms are protected by hCaptcha (Intuition Machines). That service may process your IP address and device data. See hCaptcha’s privacy policy.

Analytics and advertising
Where you consent, we use Google Analytics 4 to understand how our website is used. If we enable Google Ads conversion measurement, it will also run only after the required consent. Those services are provided by Google and may combine data with other information Google holds. You can refuse or withdraw consent in the cookie banner. We do not currently use Meta (Facebook) advertising pixels on our website.

Affiliates
We do not run an open affiliate programme with self-serve signup. Where we work with an affiliate, it is case by case under terms we agree with them. We may share limited account or referral information needed to calculate and pay commission, under that agreement. We do not sell your data to affiliates for their own marketing.

Fonts
Our website (fbcbusiness.uk) loads fonts from Google Fonts, which may process your IP address when a page loads.

Professional advisers and legal
Accountants, insurers, or lawyers where needed. Courts, regulators, or law enforcement if required or permitted by law.

Staff and contractors
People who work for us, bound to keep your information confidential, including when they log into WordPress, the hosting control panel, or Google Business Profile to deliver the work you asked for.

We require providers who process data for us to treat it as confidential and to use it only on our instructions (or yours, where we are the processor). If you ask, we will tell you the names of the hosting and backup providers we use.

We do not sell personal data. We do not share it with third parties for their marketing.

7. International transfers

Most of our own systems run in the United Kingdom, including our Client Area. Some providers process data outside the UK:

Hosting and email infrastructure is stored primarily in the UK/EEA. Domain registration sometimes requires sending data to a registry outside the UK/EEA.
PayPal and hCaptcha may process data in the United States.
Offsite backups (FBC Storage) are stored in the UK or EU.
Google (Analytics, Ads, Fonts) may process data in the US and elsewhere.

Where a restricted transfer is made to a country that the UK does not treat as providing an adequate level of protection, we use the transfer mechanism applicable to that provider and transfer, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK–US data bridge where the recipient is certified. We assess and document restricted transfers where the law requires it. You can ask us for more information about the safeguard relevant to your data.

8. Cookies and similar technologies

Cookies are small files stored on your device. UK law (PECR) treats analytics and advertising cookies as requiring consent, except those that are strictly necessary to provide a service you asked for.

Strictly necessary (no consent required)

Security and load-balancing
Remembering cookie-consent choices
Client Area login session
hCaptcha / spam protection on forms

Analytics (consent)

Google Analytics 4 — helps us understand which pages are used and whether the site works.

Advertising / measurement (consent)

Google Ads — when we run ads, helps us measure campaigns and conversions. These cookies may track you across other sites.

How to control cookies

Use the cookie settings control on our website (where shown) to accept or reject optional cookies.
You can also block cookies in your browser. If you block all cookies, login and some forms may not work.
Browser “Do not track” is not consistently honoured; the cookie banner is the control we provide.

We do not use WordPress “Remember me for two weeks” cookies on our website unless you log into WordPress itself (staff only). Client Area login cookies are set by the Client Area you actually use (the current hub or the legacy login at accounts.fbcbusiness.uk).

9. How long we keep data

We keep personal data only as long as we need it for the purpose, including legal minimums. Typical periods:

Type of data	How long we keep it
Enquiries that do not become a customer	Up to 24 months after the last meaningful contact, then delete or anonymise
Routine customer account and support-ticket data	For the life of the account, then normally up to 24 months after closure
Contracts, accepted quotes, significant project correspondence, and records relevant to legal claims	Normally up to 6 years after the relevant contract or project ends, or longer while a dispute is active
Invoices, payments, and accounting records	Normally 6 years after the end of the relevant accounting period, or longer where the law requires
Domain registration data	For the registration term, plus records we must keep for registry or tax reasons
Server and security logs	Typically up to 12 months, unless needed for an incident
Hosted website and email data after service ends	Normally available for up to 30 days after the service end date, after which we may delete it from live systems
FBC Storage backups	For the backup rotation operated on your plan. After live data is deleted, residual backup copies expire according to that rotation and are not retained as a customer archive
Cookie / consent logs	For the life of the consent, or as needed to show we asked
Business outreach records	12 months after our last contact, then deleted. Do-not-contact (suppression) entries: kept indefinitely so your opt-out keeps working

If the law requires a longer period, or we need data for a dispute, we keep it until that is resolved.

When a hosting or plan service ends, we may delete website files and mailboxes from live systems after the 30-day period described in our terms. Take your own backup before you leave. We do not guarantee that data will remain recoverable during that period. Residual copies can remain in protected backups until those backups expire.

10. Security

We use technical and organisational measures appropriate to a small UK web-care business. That includes access control (staff only see what they need), TLS on our sites and hub, hashed Client Area passwords, and processor contracts with infrastructure and backup providers.

Site Connector pairing keys and backup-provider credentials are not shown in the Client Area.

No method of transmission or storage is perfectly secure. You must keep your Client Area password and any control-panel or WordPress logins confidential.

11. Your rights

You have rights under UK GDPR, including:

Access — a copy of personal data we hold about you
Rectification — correct inaccurate data
Erasure — in some cases, to be forgotten
Restriction — pause certain uses
Objection — including to processing based on legitimate interests, and to any direct marketing, including our business outreach emails (see section 5A)
Portability — receive data you provided to us in a commonly used format, where the basis is contract or consent and the processing is automated
Withdraw consent — where consent is the basis (cookies). Other processing (for example invoices we must keep) may continue

Some rights are limited. For example we cannot delete invoices we are legally required to keep, and we cannot erase website content that you still instruct us to host.

If your request concerns personal data contained in a website, mailbox, or backup that we process for one of our clients, that client is normally the controller responsible for the request. We will refer you to the client or assist the client as required.

To use these rights, email hello@fbcbusiness.uk with “Privacy” in the subject. We will need to verify that the request comes from you (or from someone who can act for your company). We will respond within one month, or tell you if we need more time (up to two further months for complex requests).

Logged-in contacts can also update many account details in the Client Area.

12. Complaints

If you are unhappy with how we have used your personal data:

Email hello@fbcbusiness.uk with “Privacy complaint” in the subject.
We will acknowledge a complaint sent by email promptly, and usually within 5 working days.
We will look into it and tell you the outcome, without undue delay. If the complaint is also a rights request, we will handle that part within the timescale in Your rights.
If you are still unhappy, you can complain to the ICO: https://ico.org.uk/make-a-complaint/ Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Helpline: 0303 123 1113.

You can complain to the ICO without complaining to us first, but it usually helps if we can try to put it right.

13. Children

Our Client Area accounts and contracts are for people aged 18 or over. We do not intentionally collect children’s personal data for our own account administration or marketing. Data we process for a client may include children’s data if it is contained in that client’s website, mailbox, or backup. In that situation, the client decides why and how the data is collected and remains responsible for providing appropriate privacy information. If you believe a child has given personal data directly to us, contact us and we will investigate and delete it unless we must keep it.

14. Links to other sites

Our site and Client Area may link to webmail, the hosting control panel, PayPal, or other tools. Those services have their own privacy notices. This notice only covers data we are responsible for.

15. Changes

We will update this page when our services or the law change. The Last updated date at the top will change. If we start using your data for a new purpose that you would not reasonably expect, we will tell account holders (usually by email) before we start.

Please check this page from time to time.

16. How to contact us

Simifran (UK) Ltd (FBC iBusiness)
20 Wenlock Road, London, N1 7GU
Email: hello@fbcbusiness.uk

For ordinary support (a broken site, an invoice, a plan change), use the Client Area ticket if you have an account — it is faster than a privacy email.