--- /legal-archives/privacy-2013-11-02
+++ /privacy (2018-03-27)
@@ -1,8 +1,72 @@
+We are IRCCloud Ltd, a limited company registered in England and Wales, with company number 07417638. We are registered with the Information Commissioner’s Office, with registration number [ZA090318](https://ico.org.uk/ESDWebPages/Entry/ZA090318).
+
 We take privacy and security very seriously at IRCCloud. In this policy, we aim to be explicit about how we store your personal data, particularly passwords and other credentials.
 
 We operate a [responsible disclosure program](/whitehat) which offers cash rewards to security researchers who responsibly report security issues in IRCCloud.
 
 Please send an email to [team@irccloud.com](mailto:team@irccloud.com) if you have any questions.
+
+[How and why we process personal data](#personal-data-processing)
+----------------------------------------------------------------
+
+We process your username, email address, password, and records of your communications, to provide the service to you.
+
+We process your payment information to bill you for the service, and we keep records of payments as required by law. (We do not store your payment information; this is kept by our payment service providers.)
+
+If you contact us (e.g. our support team, or via social media), we’ll use your information to answer your questions, and for the legitimate interests of maintaining and improving our service.
+
+We use your IP address for the legitimate interest of securing and protecting our services.
+
+We analyse website traffic, for the legitimate interests of monitoring performance and optimising our site.
+
+You are not required to provide any data to us but, if you do not, you will not be able to use service.
+
+[Recipients of personal data](#personal-data-recipients)
+--------------------------------------------------------
+
+We rely on a number of third parties to help us provide the service. This includes payment processors and hosting providers.
+
+Except for these, we will not reveal user data to a third party unless:
+
+*   We are compelled to by law, or
+*   We believe it is necessary to prevent death or serious physical harm to someone.
+
+If we believe a legal request to be too broad, we will seek to narrow it. Where appropriate, we will notify users about a legal request for their data unless we are prevented from doing so by law.
+
+[Transfers of personal data outside the EEA](#personal-data-transfers)
+----------------------------------------------------------------------
+
+We transfer your personal data to a number of providers in the USA. These include providers of hosting services, payment processing services and various administrative services.
+
+The majority of these are self-certified under the “[Privacy Shield](https://www.privacyshield.gov/welcome)” framework. Others are reliant on the European Commission’s [model contract clauses](https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/model-contracts-transfer-personal-data-third-countries_en).
+
+PayPal, one of our payment services providers, is based in the EEA, but may transfer personal data outside the EEA to provide its service. It uses binding corporate rules for transfers between PayPal-related companies. You can find more information [here](https://www.paypal.com/uk/webapps/mpp/ua/privacy-prev#7).
+
+For more information, please email [team@irccloud.com](mailto:team@ircclod.com).
+
+[Storage period](#storage-period)
+---------------------------------
+
+We keep logs of your IRC communications until you delete your account with us, or a connection, or channel. This means that, even if you stop using IRCCloud for a while, when you next log in, it will be as if you never went away.
+
+When you delete your account, a connection, or channel, your logs are purged from our active data store within 7 days, and from all backups after a maximum of 60 days. You can delete it any time [from your settings](/?/settings=account) on the web site.
+
+We keep website analytics information for approximately a week.
+
+We keep records of your payments indefinitely, to resolve disputes and for our accounting records.
+
+[Your rights](#your-rights)
+---------------------------
+
+You have the right to
+
+*   request from us access to and rectification or erasure of your personal data;
+*   restriction of processing or to object to processing; and
+*   request data portability.
+
+If you have any questions, please send an email to [team@irccloud.com](mailto:team@irccloud.com).
+
+We hope you will never need to use it, and we will deal promptly and effectively with any complaints you might have, but you also have the right to lodge a complaint with a data protection supervisory authority, such as the Information Commissioner’s Office.
 
 [Your account password](#password)
 ----------------------------------
@@ -55,20 +119,8 @@
 
 Our staff will ask your permission if they need to access your logs, typically to assist with technical support. We may access your account and view your history without asking your permission when investigating abuse or misuse of the service, in accordance with our [abuse policy](/abuse).
 
-If you delete your account, a connection, or channel, your logs are purged from our active data store within 7 days, and from all backups after a maximum of 60 days.
-
-[Legal Demands for Data](#legal-demands)
-----------------------------------------
-
-We will not reveal user data to a third party unless:
-
-*   We are compelled to by law, or
-*   We believe it is necessary to prevent death or serious physical harm to someone.
-
-If we believe a legal request to be too broad, we will seek to narrow it. Where appropriate, we will notify users about a legal request for their data unless we are prevented from doing so by law.
-
-[Legal Jurisdiction](#legal-jurisdiction)
------------------------------------------
-
-*   We are a UK Limited Company, with an office in London.
-*   Our website is hosted in California, USA.
