Privacy Policy

This policy explains what personal data WEBX (“WebX”, “we”, “us”) collects when you visit this website or use our services, why we collect it, who we share it with, and what you can ask us to do with it.

We are the data controller for that information. Our registered address and contact details are at the end of this page.

Information you give us

• Account details — name, email address, phone number, and where applicable your company name and address.
• Billing details — billing address, invoice history, and the transaction reference for each payment.
• Domain registrant details — the contact information a registry requires in order to register a domain in your name.
• Support correspondence — tickets, emails, and chat transcripts, including any information you choose to include in them.

Information collected automatically

• Server and access logs — IP address, timestamp, requested URL, referrer, and user agent, recorded for security and diagnostics.
• Service telemetry — resource usage, error rates, and uptime data for the services on your account.
• Cookies and similar technologies, as described below.

What we do receive and retain is the outcome of each transaction: the amount, the currency, the date, a transaction reference, the payment method type, and — where the gateway provides it — the last four digits of the card and its brand. We keep this to reconcile payments, issue invoices, process refunds, and meet our tax and accounting obligations.

Your relationship with the payment gateway is also governed by their own privacy policy, which applies to the data you enter on their payment page.

• To provide the services you have ordered, and to give you access to and support for them.
• To take payment, issue invoices and renewal notices, and process refunds.
• To register and administer domain names on your behalf.
• To secure the platform — detecting abuse, fraud, and attacks, and investigating incidents.
• To communicate about your account: service notices, maintenance windows, security alerts, and changes to our terms. These are operational messages and are not marketing, so you cannot opt out of them while you hold an account.
• To send marketing about our own services, where you have asked for it or where you are an existing customer and have not objected. Every marketing email carries a one-click unsubscribe link.
• To meet our legal, tax, and regulatory obligations.

We rely on one of the following grounds for each use:

• Performance of a contract — providing the services you ordered and taking payment for them.
• Legal obligation — retaining accounting records and responding to lawful requests from authorities.
• Legitimate interests — keeping the platform secure, preventing fraud and abuse, and improving our services, balanced against your rights.
• Consent — optional analytics cookies and marketing to people who are not already customers. You can withdraw consent at any time.

We do not sell your personal data, and we do not rent or trade mailing lists. We share data only with parties who need it to deliver something you have asked for:

• Payment gateway and banks — to take payment and process refunds.
• Domain registrars and registries — registrant details must be passed on to register a domain, and may appear in public WHOIS or RDAP records unless the registry redacts them or you have bought privacy protection.
• Certificate authorities — where an SSL certificate is issued for your domain.
• Infrastructure and tooling providers — data centres, backup storage, email delivery, and helpdesk software, each acting on our instructions under a written agreement.
• Professional advisers and authorities — where we are legally required to disclose, or need to establish or defend a legal claim.

This website uses a small number of cookies and equivalent browser storage:

• Strictly necessary — session, security, and load balancing. The site does not work without them, so they are set without consent.
• Preference — remembering choices you have made, such as dismissing a promotional banner.
• Analytics — aggregate statistics about which pages are visited, set only with your consent where consent is required.

You can clear or block cookies in your browser settings. Blocking the strictly necessary ones will break parts of the client portal.

• Account and billing records — for the life of the account and then for as long as tax and company law requires us to retain financial records.
• Support tickets — up to 3 years after they are closed.
• Server and access logs — typically 90 days, longer where a log is part of an active security investigation.
• Content on terminated services — deleted from live systems 30 days after termination, and from backups as those rotate out.
• Marketing contact data — until you unsubscribe or ask us to erase it.

We encrypt traffic in transit with TLS, restrict administrative access to named staff on a least-privilege basis, require multi-factor authentication on internal systems, patch on a defined schedule, and keep encrypted, access-controlled backups. No system is perfectly secure, but if a breach affects your personal data and is likely to put your rights at risk, we will notify you and the relevant authority without undue delay.

You can ask us to:

• Give you a copy of the personal data we hold about you.
• Correct anything inaccurate or incomplete.
• Delete data we no longer have a lawful reason to keep — noting that we must retain financial records for a statutory period.
• Restrict or object to a particular use, including any use based on our legitimate interests.
• Export your data in a portable, machine-readable format.
• Withdraw consent, where consent is what we relied on.

Email [email protected] and we will respond within 30 days. We may need to verify your identity first, so that we do not disclose your data to someone else.

We operate primarily from Bangladesh. Some providers we rely on — registries, certificate authorities, email delivery, and certain data centre regions — are located elsewhere, so your data may be processed outside the country. Where that happens we use providers who offer protections comparable to those described in this policy and contract with them accordingly.

Our services are sold to adults and are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

Our site and emails may link to services we do not operate. This policy does not cover them, and we are not responsible for their handling of your data — please read their own policies before using them.

We update this policy when our practices or the law change. The “last updated” date at the top of the page always reflects the current version, and we notify account holders by email before a material change takes effect.

For any question about this policy or about your personal data, reach us at:

• Email: [email protected]
• Phone: +880 1817 394 826 (Sunday – Thursday, 10:00 – 18:00 (GMT+6))
• Registered address: Level 5, Navana HR Tower 1, 205, 1 Bir Uttam Mir Shawkat Sarak, Dhaka, Bangladesh

See also our Terms and Conditions and Return and Refund Policy.