Website and customer privacy notice

Last updated: 9 October 2026.

This notice explains what Web and Cloud Innovation Ltd ("we") collects about you through the websites at yourpremises.com and premises.ph — when you create an estate, raise a support ticket or talk to the concierge — and what we hold about the administrators and billing contacts of the businesses that subscribe to the Service.

For that information we decide what is collected and why, so we are its controller: under the General Data Protection Regulation (EU) 2016/679 (the "GDPR"), which applies to us because we are established in Malta; under the UK GDPR and the Swiss Federal Act on Data Protection, where we offer the Service to people there; and under the Data Privacy Act of 2012 of the Philippines for the people it protects.

It does not cover the records a business keeps in its own workspace about its tenants, owners, staff and visitors. The business is the controller of those, and we process them only on its instructions. The Data privacy notice and the Data processing agreement describe that.

1Who We Are

Web and Cloud Innovation Ltd, a company registered in Malta under number C106789, of 30/1 Kenilworth Court, Sir Augustus Bartolo Street, Ta' Xbiex XBX 1093, Malta.

Our privacy contact is privacy@premises.ph. It reaches the person we have designated to act as our Data Protection Officer, and it is where any request or question about this notice should go.

2What We Collect, And Why

When you create an estate: your name, email address and mobile number, your role, the name and kind of your estate, its size, the web address you choose for it, and the network (IP) address the form was sent from. We use them to set up the workspace you asked for, to reach you about it, and to keep a record of who asked for it.

When you raise a support ticket: your name, email address, phone number if you give it, your message, and the network address it was sent from. We use them to answer you and to keep a record of what was asked and answered.

When you talk to the concierge: the messages you type, the answers you are given, and the network address they came from. If you choose to leave an email address or a name in the chat so that a person can follow up, we keep it with the conversation. We use all of this to answer your question, to follow up where you asked us to, to keep the chat from being abused, and to find where its answers fall short. You are talking to an AI model, not a person, until a person writes back to you.

When you administer or pay for a subscription: the names, email addresses and phone numbers of the business's administrators and billing contacts; the business's billing name, address and tax number; the invoices we issue and the payments we receive; and the record of who accepted which version of our terms, and when. We use them to provide the Service, to bill for it, and to keep the accounting and contract records the law requires.

When you open any page: our web server keeps an ordinary log of each request, with the network address, the time, the address asked for, the answer given, and what the browser says about itself. We use it to keep the site working and secure, and to investigate abuse.

We use no advertising trackers, no analytics service and no social-media pixels, and we build no profile of any visitor. The Cookie notice lists everything the websites store in a browser.

Giving us your details is your choice, but we cannot create an estate, answer a ticket or bill a subscription without the details that step needs.

3The Lawful Basis

• Creating an estate, and running a subscription: the steps you ask us to take before a contract, and the performance of that contract (GDPR Article 6(1)(b)).
• Invoices, payments and the acceptance record: our legal obligations under tax and accounting law (Article 6(1)(c)), and the contract.
• Support tickets and the concierge: our legitimate interest in answering the people who write to us, balanced against yours (Article 6(1)(f)).
• A name or email address you leave in the chat: your consent to be contacted (Article 6(1)(a)), which you may withdraw at any time.
• Server logs and protection against abuse: our legitimate interest in keeping the site and the people who use it safe (Article 6(1)(f)).

The UK GDPR uses the same bases under the same numbers.

4Who Receives It

We never sell personal information, we never share it for cross-context behavioural or targeted advertising, and we never share it for anybody's marketing. Inside the company, only the people whose work needs it can see it. Outside, these services process it for us:

• Hetzner Online GmbH, in Germany, hosts the servers the websites and their databases run on.
• Anthropic PBC, in the United States, provides the AI model that writes the concierge's answers. It receives the messages typed into the chat in order to answer them, and under the terms we use it on it does not train its models on them.
• Telegram, and the email provider that carries our mail, deliver the internal alert that tells us a sign-up or a ticket has arrived. The alert carries the details you entered in the form.
• The same email provider delivers the replies and confirmations we send you.
• Where you pay us, the bank or payment service you choose to pay through sees the payment.

Beyond them, information is disclosed only to professional advisers who owe us a duty of confidence, and to authorities where the law requires it.

5Transfers Abroad

We are in Malta and our servers are in Germany, both inside the European Economic Area, which the United Kingdom and Switzerland recognise as giving adequate protection. The concierge's provider is in the United States, and Telegram may process its messages outside the European Economic Area.

Where personal information leaves the European Economic Area, we rely on the safeguards the GDPR recognises: an adequacy decision where one covers the destination — for the United States, the EU-US Data Privacy Framework where the recipient is certified under it — and otherwise the European Commission's Standard Contractual Clauses. For information protected by the UK GDPR or the Swiss law we use the United Kingdom's Addendum to those clauses and the Swiss adaptations. You may ask us for a copy of the safeguards.

6How Long We Keep It

• A concierge conversation in which no email address or name was left: twelve (12) months from its last message, then deleted.
• A concierge conversation in which an email address or a name was left: twenty-four (24) months from its last message, then deleted.
• A support ticket: twenty-four (24) months from when it was raised, then deleted.
• A sign-up that did not become a customer: twenty-four (24) months from when it was made, then deleted.
• A customer's records, invoices and acceptance record: for the life of the subscription, and afterwards for as long as tax, accounting and contract law require.
• Server logs: only for as long as they are needed for security and fault-finding, then deleted.

7Your Rights

Under the GDPR and the UK GDPR you may: be told how your information is used, which is what this notice is for; see what we hold about you and have a copy; have it corrected or completed; have it deleted, or its use restricted, where the law allows; object to processing that rests on our legitimate interests; withdraw a consent at any time, without affecting what was done before; and receive what you gave us in a portable form. The Swiss law gives you the same in substance.

If a United States state privacy law applies to us and to you, you have the rights it gives: to know what we collect, use and disclose, to delete it, to correct it, and not to be treated differently for asking. We do not sell or share personal information, as those laws use the words, and we do not use sensitive personal information to infer anything about you, so there is nothing to opt out of; if you send a Global Privacy Control signal, we honour it all the same.

Write to privacy@premises.ph. Asking costs nothing. We may need to confirm who you are before we answer. We answer without undue delay, and within the period the law sets: under the GDPR that is one month, which may be extended where a request is complex, in which case we will tell you.

8Complaints

If you are not satisfied with how we have handled your information, you may complain to Malta's Information and Data Protection Commissioner (idpc.org.mt), which is our lead supervisory authority, or to the supervisory authority where you live or work in the European Union; in the United Kingdom, to the Information Commissioner's Office (ico.org.uk); in Switzerland, to the Federal Data Protection and Information Commissioner; and in the Philippines, to the National Privacy Commission (privacy.gov.ph). We would like the chance to put it right first, but you do not have to ask us before you complain.

9Security

Every page and form travels encrypted. The sign-up, ticket and chat records are kept in databases that no web address reaches, and the inbox that reads them is behind its own password.

10Children

The websites and the Service are made for businesses and the people who run them. They are not directed at children, and we do not knowingly collect information about anyone under sixteen (16). If you believe we have, write to us and we will delete it.

11Changes

When this notice changes, the date at the top changes with it, and so does the fingerprint shown beside it.