This policy describes how Panellicense Ltd (“we”, “us”) handles personal data we collect from visitors to panellicense.com, from customers using our billing portal, and from people who contact us. It is separate from data we process on your behalfas your processor — that is covered in the data processing addendum.
1. Who we are
Panellicense Ltd, registered in England & Wales, is the data controller for the personal data described in this policy. You can reach our privacy team at privacy@panellicense.com.
2. What we collect
- Account data— name, business name, email, billing address, VAT/tax ID, phone (optional).
- Payment data— processed by our PCI-DSS compliant payment provider; we receive only a token, the last four digits of the card, the card brand, and the expiry month.
- License operations data— the IP addresses you bind licenses to, key issuance and rebinding history, server hostname where you ask us to assist with installation.
- Support data— the contents of tickets, emails, and chats you send us, plus diagnostic information you choose to attach.
- Site analytics— pseudonymised page views, referrer, approximate region, browser and OS family. See section 8.
3. Why we use it (legal basis)
- Contract performance— to issue and renew licenses, bill you, and respond to support requests.
- Legal obligation— to keep tax records, respond to lawful authority requests, and comply with anti-fraud rules.
- Legitimate interest— to detect abuse, secure our systems, measure aggregate site usage, and send transactional notices.
- Consent— for marketing emails (you opt in, and can opt out from any message).
4. Who we share it with
- Upstream vendors— cPanel L.L.C., WebPros (Plesk), LiteSpeed Technologies, CloudLinux Inc., Softaculous Ltd. — receive the minimum data needed to issue and bind your license keys (typically: account ID, bound IP, license tier).
- Payment processor— Stripe Payments Europe Ltd.
- Infrastructure providers— hosting, email, monitoring, and ticketing vendors bound by data-processing agreements.
- Authorities— when compelled by valid legal process.
We do not sell personal data and do not share it for cross-context advertising.
5. International transfers
Some of the vendors and processors above are located outside the UK and EEA. Where they are, transfers are protected by the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or an adequacy decision, as applicable. A list of sub-processors and their locations is available on request.
6. Retention
- Account data — while your account is open, plus 90 days.
- Invoices and tax records — 7 years (UK statutory).
- License operations logs — 24 months.
- Support tickets — 36 months from last update.
- Site analytics — 14 months, pseudonymised.
7. Your rights
Under UK and EU GDPR you have the right to access, correct, delete, restrict, or port the personal data we hold about you, and to object to processing based on legitimate interest. You may also withdraw consent and lodge a complaint with a supervisory authority (in the UK, the Information Commissioner's Office, ico.org.uk). Email privacy@panellicense.com and we will respond within 30 days.
8. Cookies and analytics
We use a single strictly-necessary session cookie for the billing portal and a privacy-preserving analytics provider that does not set advertising cookies and does not track across sites. No consent banner is required for these, under UK PECR and GDPR. If we ever add non-essential cookies, we will ask for consent first.
9. Security
Data in transit is encrypted with TLS 1.2+. Account passwords are hashed with Argon2id. Production access is restricted to named engineers with hardware MFA, and is logged. We run quarterly third-party penetration tests on the billing portal. If we ever suffer a breach affecting your data, we will notify you and the relevant supervisory authority within 72 hours of becoming aware.
10. Children
The Service is not directed at children under 18 and we do not knowingly collect their data. If you believe a child has provided personal data to us, contact privacy@panellicense.com and we will delete it.
11. Changes
Material changes will be announced by email to the address on your billing account at least 30 days before they take effect. Minor changes (clarifying language, adding a sub-processor) take effect on posting.
12. Contact
Panellicense Ltd — registered in England & Wales.
Privacy: privacy@panellicense.com
See also: Service agreement · Data processing addendum