Privacy Policy
Last updated:
This policy explains how we process personal data when you visit php2shellfix.co.uk, use the online site check or send us a request, in accordance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (“PECR”).
1. Who we are
AVS Technology Ltd, the data controller for this website
Registered in England and Wales, company no. 09405935
VAT no. GB229467871
Registered office: 66a High Street, Rainham, Gillingham, Kent, ME8 7JF
Email: [email protected]
We have not appointed a Data Protection Officer (DPO), as this is not mandatory in our case. For any question about your data, please email us at the address above.
2. What data we process, why and on what lawful basis
| Situation | Data | Purpose | Lawful basis | Retention |
|---|---|---|---|---|
| Contact form | Name, company, email, phone (optional), website address, hosting type, requested service, urgency, message, online check result (if you ran one) | To answer you and prepare the contract, NDA and quote | Art. 6(1)(b) UK GDPR: steps taken at your request before entering into a contract. For company representatives, Art. 6(1)(f): our legitimate interest in communicating with clients | 12 months from submission if no contract is concluded. Deletion is automatic. |
| Online site check | The website address you enter, your IP address (pseudonymised only) | Real-time analysis of the given site and abuse prevention (limiting the number of checks) | Art. 6(1)(f) UK GDPR: our legitimate interest in providing the service and protecting it against abuse | The website address is not stored. The IP is kept only as a keyed cryptographic hash and deleted after at most 24 hours. |
| Web server technical logs | IP address, date and time, page accessed, browser type | Security and operation of the site, incident investigation | Art. 6(1)(f) UK GDPR: our legitimate interest in keeping the site secure | At most 30 days |
| Client contracts | Identification and contact details of the client and contact persons, billing data | Performing the contract, invoicing, accounting records | Art. 6(1)(b) and (c) UK GDPR: performance of the contract and legal obligations (tax and company law) | For the duration of the contract and then for six years after the end of the financial year, as required by HMRC and the Companies Act 2006 |
Providing the form data is voluntary. Without an email and the website address we cannot answer your request.
3. Data on client servers (contract, NDA and DPA)
Before any check on your servers, any access to them or any intervention, we sign with you:
- a service agreement, setting out what we do, when and within which limits;
- a non-disclosure agreement (NDA), covering any information we have access to, including the vulnerabilities identified;
- a data processing agreement (DPA) under Art. 28 UK GDPR.
During the intervention we may have access to personal data of your customers or users (for example in the site's databases). For this data you are the controller and AVS Technology Ltd acts as a processor. We process it only on your documented instructions and only to the extent needed for the intervention. We do not copy it off the server unless you explicitly ask us to, and we delete any temporary copy when the work is finished. If we discover a personal data breach, we inform you without undue delay so you can assess whether it must be reported to the Information Commissioner's Office (ICO) within 72 hours.
4. Cookies and similar technologies
php2shellfix.co.uk does not use analytics or marketing cookies: no Google Analytics, no tracking pixels, no advertising networks. Fonts and all other resources are hosted on our own server, so your visit sends no data to third parties.
We use a single, strictly necessary item stored in your browser, which is exempt from consent under regulation 6(4) of PECR:
| Name | Type | Purpose | Duration | Category |
|---|---|---|---|---|
php2shell_consent | Local storage (localStorage) | Remembers your cookie choice so we don't ask you on every visit | 6 months | Strictly necessary |
The optional categories (analytics and marketing) are switched off by default and currently contain no services. If we ever introduce such tools, we will add them to the table above and enable them only after you give your consent through the cookie banner. You can withdraw or change your consent at any time, as easily as you gave it.
You can delete stored data at any time from your browser settings (the “Privacy” or “Site data” section).
5. Who has access to the data
We do not sell or rent your data. It may only be received by:
- our web hosting and email providers, as processors, under contracts compliant with Art. 28 UK GDPR;
- our accountants and legal advisers, when necessary and under a duty of confidentiality;
- public authorities such as HMRC, only when required by law.
6. International transfers
Data is stored and processed in the United Kingdom or the European Economic Area, which benefits from UK adequacy regulations. We do not transfer your data to other countries. If such a transfer becomes necessary, we will only make it with the safeguards required by the UK GDPR (for example the ICO's International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses) and we will inform you.
7. Your rights
Under the UK GDPR, you have the following rights:
- right of access: to find out what data we hold about you and receive a copy (Art. 15);
- right to rectification: to correct inaccurate data (Art. 16);
- right to erasure: to request deletion of your data (Art. 17);
- right to restriction of processing (Art. 18);
- right to data portability: to receive your data in a structured format (Art. 20);
- right to object: to object to processing based on legitimate interests (Art. 21);
- rights related to automated decision-making (Art. 22). We make no such decisions: the online check only provides indicative information, with no legal or similarly significant effects on you.
To exercise your rights, email us at [email protected]. We reply free of charge, within one month of receiving your request. We may ask for additional information to confirm your identity.
If you are unhappy with how we handle your data, please contact us first so we can try to resolve it. You also have the right to complain to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, helpline 0303 123 1113, ico.org.uk/make-a-complaint.
8. How we protect data
- the site is available exclusively over HTTPS;
- requests are stored outside the site's public directory, with restricted access;
- we collect only the data we need: we do not store the IP address with your request, and for abuse prevention we only use a keyed hash;
- we automatically delete data when the retention period expires;
- access to client systems happens only after the contract, NDA and DPA are signed, through secure and logged channels.
9. Children
Our services are aimed at businesses and individuals who manage websites or servers. They are not directed at children and we do not knowingly collect data about anyone under 18.
10. Changes
We may update this policy when our services or the law change. The date of the last update is shown at the top of the page. Significant changes will be announced on the site.