Privacy policy

WP Alpha Privacy Policy

1 1:2

1. Who we are

1.1 This policy is issued by Robotmedia Pty Ltd (ABN 85 134 420 867) trading as WP Alpha, of Unit 11/76 Township Drive, Burleigh Heads QLD 4220, Australia (“WP Alpha”, “we”, “us”, “our”). We provide managed WordPress hosting and related services to customers in Australia, the United Kingdom, the United States and elsewhere.

1.2 We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (“APPs”). Where we handle personal data of people in the United Kingdom, we also comply with the UK General Data Protection Regulation and the Data Protection Act 2018 (“UK GDPR”). Where we handle personal information of residents of US states with comprehensive privacy laws, we aim to meet the obligations of those laws that apply to us. 1:2

1.3 Our privacy officer can be contacted at questions@wpalpha.com (see clause 16).

2. What this policy covers

2.1 This policy explains how we collect, use, store and share personal information about:

(a) visitors to wpalpha.com and our other websites;

(b) people who contact us by email, live chat, support ticket or phone;

(c) our customers and the people who act for them (account holders, billing contacts, technical contacts); and

(d) prospects and subscribers who receive our marketing.

2.2 It also explains, in clause 9, the different role we play for the data inside the websites we host for customers. For that data our customer decides what is collected and why; we store and process it on their instructions.

2.3 This policy does not cover third-party websites linked from our site, or the privacy practices of our customers’ own websites.

3. Personal information we collect

3.1 1 When you create an account, place an order, request support or contact us, we collect:

(a) name, email address, phone number and business name;

(b) billing address and country;

(c) account login details for the Customer Portal (we store passwords in hashed form only);

(d) the content of your support requests, chat messages and emails, which may include login details for your website or other services that you choose to share with us so we can help you; and

(e) any other information you choose to provide.

3.2 1 Payments are processed by Stripe, PayPal and GoCardless through our billing platform, Upmind. We do not store full card numbers or bank account details on our own systems. We receive confirmation of payment, the payment method type, the last four digits of a card, and the transaction reference.

3.3 1 When you use our websites or the Customer Portal we collect technical information including IP address, browser type and version, device type, operating system, pages visited, time on page, referring URL and the date and time of each request. Some of this is collected through cookies and similar technologies (see clause 6).

3.4 1 To operate the hosting platform we collect server logs for each hosted site, including visitor IP addresses, requested URLs, response codes and user agents, and security logs such as failed login attempts and blocked requests. We use these to keep the platform secure and to diagnose problems.

3.5 1 We may receive information about you from our payment processors (payment status, fraud signals), from our analytics and chat providers, and from publicly available sources such as domain registration records.

3.6 We do not deliberately collect sensitive information (such as health, religious or political information) and ask you not to send it to us.

4. How we collect it

4.1 We collect personal information directly from you when you fill in forms on our site, sign up through the Customer Portal, email us, use live chat, or speak to our support team.

4.2 We collect technical information automatically through our web servers, our hosting platform and the tools listed in clause 6.

4.3 Where it is reasonable and practical, we collect personal information directly from you rather than from third parties.

5. Why we use personal information, and our legal basis

5.1 We use personal information to:

(a) set up and run your account, host your website, and provide support;

(b) take payment, issue invoices and manage billing;

(c) communicate with you about your account, outages, security issues and changes to our services;

(d) keep our platform secure, detect abuse and fraud, and enforce our Terms of Service;

(e) improve our websites and services, including by analysing how people use them;

(f) send marketing about our services where you have agreed to receive it or where the law otherwise allows (see clause 13); and

(g) comply with legal obligations, including tax, accounting and law enforcement requests.

5.2 1 Where UK GDPR applies, we rely on the following lawful bases:

(a) performance of a contract, for (a) to (c) above;

(b) our legitimate interests in running, securing and improving our business, for (d) and (e) above, and for marketing to existing business customers;

(c) consent, for non-essential cookies and for marketing where consent is required; and

(d) legal obligation, for (g) above.

1:2

6. Cookies, analytics and support tools

6.1 We use cookies and similar technologies on wpalpha.com and the Customer Portal. The tools we currently use are:

1:2

1:2

6.2 1 Our websites and the Customer Portal set cookies that are needed to log you in, keep you logged in, remember your cart and protect against cross-site request forgery. These cannot be switched off.

6.3 1 Where consent is required (for example for visitors from the UK), we ask for it through a cookie banner before non-essential cookies are set, and you can change your choice at any time using the cookie settings link in our site footer. 1:2 You can also block or delete cookies in your browser settings, and you can opt out of Google Analytics using Google’s browser add-on. Blocking essential cookies may stop parts of our site working.

6.4 1 1:2

7. Who we share personal information with

7.1 We share personal information only as needed to run our business and provide the services. We do not sell personal information and we do not share it with third parties for their own marketing.

7.2 1 We use the following categories of providers, who process personal information on our behalf under contract:

7.3 1 If you buy this add-on, we configure PixelYourSite and CallRail on your website. PixelYourSite sends events from your site to the advertising platforms you connect (for example Google and Meta). CallRail provides tracking phone numbers and records call details, and may record calls where you enable that feature. For that data you are the controller and CallRail and PixelYourSite are your processors; we act on your instructions. You are responsible for disclosing call recording and advertising tracking to your own visitors and callers. 1:2

7.4 1 We may also disclose personal information:

(a) to our professional advisers (lawyers, accountants, insurers);

(b) to law enforcement, regulators or courts where required by law or to protect our rights, our customers or the public;

(c) to a buyer or prospective buyer if we sell or restructure our business, under confidentiality obligations; and

(d) with your consent.

8. Where your data is stored and international transfers

8.1 1 Your website files, databases and backups are stored in the data centre region you choose when you order: Sydney, Melbourne, London or Chicago. We do not move hosted data between regions without telling you.

8.2 1 Our account records, support tickets, billing data and analytics are held by the providers in clause 7.2, some of which are located outside Australia, including in the United Kingdom, the United States and the European Union. By providing your personal information you understand that it may be transferred to and stored in those locations.

8.3 1 Under APP 8, before we disclose personal information overseas we take reasonable steps to ensure the recipient handles it in line with the APPs, usually through our contract with the provider. 1:2

8.4 1 Where we transfer personal data of people in the UK outside the UK, we rely on UK adequacy regulations where they exist (for example for the European Union), and otherwise on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses with the receiving provider. The transfer of your data to our systems in Australia is covered by these safeguards. 1:2

8.5 1 Your personal information is processed in Australia and in the other locations listed above. Those locations may have different privacy laws from your home state.

9. Data inside the websites we host

9.1 The websites we host often contain personal information about our customers’ own visitors, users and customers: contact form submissions, user accounts, order records, comments, email, analytics and more. For that information:

(a) our customer is the controller (or, in Australian terms, the APP entity that collected it) and decides what is collected and why;

(b) we are a processor or service provider and store and process it only to provide the hosting services, on our customer’s instructions, and as required by law;

(c) we do not access it except to provide support that the customer has requested, to deal with a security incident, to perform malware cleanup, or where the law requires;

(d) we do not use it for our own purposes and never sell it; and

(e) we delete it when the customer’s plan ends, on the schedule in our Terms of Service.

9.2 If you are a visitor to a website hosted by us and you want to exercise privacy rights over your data on that site, please contact the website owner directly. If you cannot identify them, contact us and we will pass your request on where we are able to.

9.3 Customers who need a written data processing agreement for their own compliance can request one at questions@wpalpha.com. 1:2

10. How long we keep personal information

10.1 We keep personal information for as long as we need it for the purposes in clause 5, and then delete or de-identify it. In general:

11. Security and data breaches

11.1 We protect personal information with technical and organisational measures that are reasonable for the size of our business and the sensitivity of the data, including encrypted connections (TLS), firewalling, access controls, hashed passwords, malware scanning and two-hourly backups kept for 30 days. No system is completely secure and we cannot guarantee that unauthorised access will never occur.

11.2 1 If a data breach is likely to result in serious harm to any individual, we will notify the Office of the Australian Information Commissioner and the affected individuals as required by the Privacy Act.

11.3 1 Where UK GDPR applies and a breach is likely to result in a risk to individuals, we will notify the Information Commissioner’s Office within 72 hours of becoming aware of it, and the affected individuals where the risk is high.

11.4 1 If we become aware of unauthorised access to a customer’s hosted data on our platform, we will tell that customer without undue delay so they can meet their own obligations.

12. Your rights

12.1 1 You can ask us to:

(a) tell you what personal information we hold about you and give you a copy;

(b) correct information that is inaccurate or out of date;

(c) delete your personal information, subject to records we must keep by law;

(d) stop sending you marketing; and

(e) explain how we have handled your information.

12.2 1 Under APP 12 and APP 13 you have the right to access and correct the personal information we hold about you. If you have a complaint about how we have handled your information, contact our privacy officer first (clause 16). We will acknowledge your complaint within [BRENDAN/LAWYER: 7?] days and aim to resolve it within 30 days. If you are not satisfied you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

12.3 1 Under UK GDPR you have the rights of access, rectification, erasure, restriction, data portability and objection, and the right not to be subject to solely automated decisions that have a legal or similarly significant effect on you. We do not make such decisions. Where we rely on consent you can withdraw it at any time. We will respond within one month, which we may extend by a further two months for complex requests. You can also complain to the Information Commissioner’s Office at ico.org.uk.

12.4 1 If you live in a state with a comprehensive privacy law (including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others), you may have the right to know what personal information we collect, to access, correct and delete it, to obtain a portable copy, and to opt out of the sale of personal information, targeted advertising and certain profiling. We do not sell personal information and we do not use it for targeted advertising. 1:2 We will not discriminate against you for exercising your rights. You may use an authorised agent to submit a request. We will respond within 45 days and may extend by a further 45 days where reasonably necessary. 1:2

12.5 1 Email questions@wpalpha.com with the subject “Privacy request”. We will need to verify your identity, usually by confirming the email address on your account or asking you to submit the request from the Customer Portal. There is no fee unless a request is clearly excessive, in which case we may charge a reasonable fee or decline, and we will tell you why.

13. Marketing communications

13.1 We send marketing emails about our services to customers and to people who have subscribed. Every marketing email includes an unsubscribe link, and you can also ask us to stop by emailing questions@wpalpha.com. We comply with the Spam Act 2003 (Cth), the UK Privacy and Electronic Communications Regulations and the US CAN-SPAM Act.

13.2 Unsubscribing from marketing does not stop service emails such as invoices, outage notices, security alerts and renewal reminders, which we need to send to run your account.

14. Children

14.1 Our services are for businesses and adults. We do not knowingly collect personal information from anyone under 18, and the Customer Portal is not for use by children. If you believe a child has given us personal information, contact us and we will delete it.

15. Changes to this policy

15.1 We may update this policy from time to time. We will post the current version on our website with its effective date, and for material changes we will email customers or notify them through the Customer Portal before the change takes effect.

16. Contact us and complaints

16.1 Our privacy officer handles all questions, requests and complaints about personal information:

Privacy Officer

Robotmedia Pty Ltd trading as WP Alpha

Unit 11/76 Township Drive, Burleigh Heads QLD 4220, Australia

Email: questions@wpalpha.com

16.2 If you are in the UK and are not satisfied with our response you can contact the Information Commissioner’s Office (ico.org.uk). If you are in Australia you can contact the Office of the Australian Information Commissioner (oaic.gov.au). If you are in the US you can contact your state Attorney General.

1:2

*End of draft. Last updated 10 October 2026.*