Privacy policy

Last updated: 30 September 2026

Introduction

Crown Hosting Data Centres Limited and our group companies (collectively “CHDC”, “we”, “us”) take the security and privacy of data seriously. We need to collect and use certain information about you in order to manage our relationship with you. We are also required to comply with UK data protection law, including the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (“PECR”) and the Data (Use and Access) Act 2025.

This Privacy Notice explains who we are, how we collect, share and use personal data about you, and how you can exercise your privacy rights. It applies to visitors to our website, people who contact us or sign up to our updates, our customers’ and suppliers’ contacts, and external visitors to the data centre facilities where our services are delivered.

If you have any questions or concerns about our use of your personal data, please contact us using the details at the bottom of this Privacy Notice.

What do we do?

CHDC provides data centre services in data centres which are operated and managed by Ark Data Centres Limited (“Ark”). Ark’s data centres are secure facilities for our clients to host servers for the operation of their IT infrastructure. Security is therefore essential to the operation of Ark’s facilities, and Ark must operate comprehensive security and monitoring systems in order to protect their facilities and our clients.

What data is collected and why?

CHDC and Ark will collect, process and retain information about you that you provide voluntarily, that is collected automatically, and that is obtained from third party sources, such as your employer. In general, the personal data that is collected from you is only used for the purposes described in this Privacy Notice, or for purposes that will be explained to you at the time your personal data is collected. However, your personal data may be used for other purposes that are compatible with the purposes that we have disclosed to you, if and where this is permitted by data protection law.

Data collected by CHDC

Customer details

If you are a customer of CHDC, we will process your identity and contact details, such as your name, email address, position and telephone number, for the purpose of managing our relationship with you.

Website visitors

If you visit our website, the personal data that we process may include:

• information that you give us through the forms on our website. Our contact form asks for your name, email address, organisation and message, so that we can respond to your enquiry or arrange a site visit. Our newsletter form asks for your email address, so that we can send you news and updates you have asked for;
• technical information that is collected automatically when your device connects to our website, such as your IP address, browser type and the pages you request. Our website host uses this information to deliver the website to you and to keep it secure; and
• information collected by the spam protection on our forms (Cloudflare Turnstile), which checks signals from your browser and device to confirm that a form is being completed by a person rather than an automated program.

Our website loads its fonts from Google Fonts, which means your browser sends your IP address to Google when a page loads. We do not currently use analytics or advertising tools on our website. If this changes, we will update this Privacy Notice and our Cookie Policy first.

Sales, marketing and customer relationship management

If we obtain your personal data for sales and marketing purposes, or for the purposes of managing our relationship with one of our clients or suppliers, the personal data that we process may include your identity and contact details, including your name, position, email address and telephone number, and information about whether or not you have opted out from receiving any of our correspondence. We use this information for sales and marketing purposes, and for the purposes of managing our contracts and relationships with our clients and suppliers.

Employees and contractors

If you are one of our employees or contractors, or if we need to vet you for security reasons, then you should read our Privacy Notice for Employees. Please contact us using the details below to request a copy.

Emergency contacts (CHDC)

If you are listed as an emergency contact for one of our clients, the personal data that we process will include your identity and contact details, including your name, position, email address and telephone number. We will use your contact details to get in touch with you where there is an emergency, where our contract with the client or supplier you represent requires us to do so, or where we have other legitimate reasons for doing so relating to the operation of our data centre facilities.

Data collected by Ark

Site visitors

If you visit Ark’s data centre campuses, the personal data that will be processed will include:

• identity and contact details, such as name, address, telephone number and vehicle registration number;
• CCTV footage and images of persons at Ark premises;
• location information for persons at Ark premises, including without limitation access logs from card readers and other access control devices at Ark premises;
• information that identifies persons and/or devices making use of Ark networks, including IP address, MAC address, device IDs or “fingerprints”, usage information (such as the time, duration and location where you used our networks) and administrative information (for example, to obtain assistance or help with technical difficulties); and
• biometric fingerprint data for the operation of our security systems for access to data centre buildings and data halls, where you have given your explicit consent for us to enrol and use your biometric fingerprint data on access cards that we may issue to you.

Ark will collect and use this data for the purposes of:

• operating and managing Ark’s data centre facilities and our group’s data centre business;
• ensuring that Ark’s data centre facilities are kept secure;
• enabling us to respond to incidents and alerts relating to the security or operations of our data centre facilities;
• detecting and preventing breaches of policy or procedure or criminal activity, and reporting on such breaches or criminal activity to those affected by it;
• complying with the Crown Hosting framework agreement, and the terms of each Call-Off Agreement and Service Request with our clients who host their servers at Ark’s data centre facilities;
• protecting your vital interests and ensuring your health and safety when you are visiting Ark’s data centre premises, including for emergency roll-calls and reporting to emergency services;
• statistical analysis and reporting on the use of Ark’s premises; and
• complying with applicable laws, regulations, industry codes of practice and good industry practice.

Further details on how Ark will process this information can be found in Ark’s Privacy Notice at www.ark-d-c.com/legal/privacy-policy.

Emergency contacts (Ark)

Ark may also process your personal data if you are listed as an emergency contact for one of our clients. This data will be collected and used for the same purposes as CHDC, as explained under the heading “Emergency contacts (CHDC)” above.

Cookies and similar technologies

For information about the cookies and similar technologies used on our website, why they are used and how you can control them, please see our Cookie Policy.

Who do we share your personal data with?

We may disclose your personal data to the following categories of recipients:

• our group companies, data centre occupiers, and third party contractors, service providers or suppliers who provide data processing services to us (for example, to host our website and store form submissions, to protect our forms from spam, to manage our customer relationships, or to provide security services for the management of our data centres), or who otherwise process personal data for purposes that are described in this Privacy Notice or notified to you when we collect your personal data;
• Ark, for the purpose of securing and operating their data centre facilities;
• the Framework Authority, for the purpose of entering into Call-Off Agreements and Service Requests, or other matters permitted under the Crown Hosting framework agreement;
• any competent law enforcement body, regulator, government agency, court or other third party where we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights, or (iii) to protect your vital interests or those of any other person; and
• any other person with your consent to the disclosure.

We do not sell your personal data.

Legal basis for processing your personal data

Our legal basis for collecting and using the personal data described above will depend on the personal data concerned and the specific context in which we collect it.

However, we will normally collect personal data where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms. Our legitimate interests include:

• the need to keep the data centre facilities secure and to manage them properly;
• keeping our website and its forms secure and free from spam;
• responding to enquiries sent through our website;
• marketing our services to prospective clients;
• managing our supply chain;
• performing contracts with our clients; and
• our group accounting and audit purposes.

We take measures to ensure that your personal data is kept secure and to limit our processing activities to what is necessary for our legitimate interests. You also have the right to object to processing that we undertake for our legitimate interests (please see the section “Your data protection rights” below). Please note that if you object to some of our processing activities, we may need to restrict your access to Ark’s data centre facilities.

Where you sign up to receive our news and updates by email, we rely on your consent, which you can withdraw at any time using the unsubscribe link in any email we send.

In some cases, we may also have a legal obligation to collect personal data from you, or may otherwise need the personal data to protect your vital interests or those of another person (for example, to contact emergency services in the event of an accident at our facilities). We will ask for your explicit consent where we need to process special category data (including biometric data) for the operation of the security systems at Ark’s premises.

If we ask you to provide personal data to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and tell you whether providing your personal data is mandatory or not (as well as the possible consequences if you do not provide it).

If you have questions about the legal basis on which we collect and use your personal data, please contact us using the details under the “How to contact us” heading below.

Who will process your personal data and where will it be processed?

Your personal data may be processed by CHDC and by the categories of third parties to whom we are entitled to disclose it. Some of these third parties are located, or process data, outside the United Kingdom. The laws in those countries may differ from UK data protection law.

Specifically:

• Ark will process the personal data described in the section “Data collected by Ark” above. For further information on how Ark processes this data, please see Ark’s Privacy Notice at www.ark-d-c.com/legal/privacy-policy;
• our website is hosted by Webflow, Inc., which stores form submissions and processes website data in the United States;
• the spam protection on our forms is provided by Cloudflare, Inc., which operates a global network;
• our website fonts are provided by Google Fonts (Google LLC);
• we use Salesforce, which operates data centres across the Americas, Asia Pacific and Europe;
• our group companies operate in the United Kingdom; and
• the information and communications systems that we use to operate and manage our data centre facilities (including our security systems and wireless networks) are located in the United Kingdom.

Where we transfer your personal data outside the United Kingdom, we make sure it remains protected in line with this Privacy Notice and UK data protection law. We do this by relying on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, where the recipient is certified under it) or by putting in place appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses.

How do we keep your personal data secure?

We use appropriate technical and organisational measures to protect the personal data that we collect and process about you. The measures we use are designed to provide a level of security appropriate to the risk of processing your personal data. Specific measures we use include encryption, anonymisation (where practicable), document classification, and all relevant controls from ISO 27001, the internationally recognised information security standard.

How long will we retain your personal data?

We retain personal data that we collect about you where we have an ongoing legitimate business need to do so (for example, to maintain the security of our data centre facilities or to comply with applicable legal, tax or accounting requirements).

Where we have no ongoing legitimate business need to process your personal data, we will either delete or anonymise it or, if this is not possible (for example, because your personal data has been stored in backup archives), we will securely store your personal data and isolate it from any further processing until deletion is possible.

In general, CHDC will keep your personal data for the following periods:

• identity and contact details: for as long as you hold an Ark access card;
• emergency contact details: for as long as you hold an Ark access card;
• website enquiries: for as long as we need to respond to your enquiry and manage any relationship that follows from it;
• newsletter sign-ups: until you unsubscribe; and
• contact details for sales and marketing: until you unsubscribe or otherwise object to or opt out of our sales and marketing information (in which case we will still retain some basic details on a suppression list, so that we can respect your wishes).

Information about how long Ark will keep your personal data is available at www.ark-d-c.com/legal/privacy-policy.

Your data protection rights

Under UK data protection law, you have the following rights:

• You can ask for access to the personal data we hold about you, and ask us to correct, update or delete it, at any time.
• You can object to our processing of your personal data, ask us to restrict it, or ask us to transfer personal data you have given us to another organisation (data portability) where this applies.
• You can opt out of marketing communications we send you at any time, by clicking the “unsubscribe” link in any marketing email we send you. To opt out of other forms of marketing (such as postal marketing or telemarketing), please contact us using the details below.
• Where we or Ark process your personal data with your consent (for example, for your newsletter subscription, or the enrolment and use of your biometric fingerprint data for your security access card), you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing carried out before you withdrew it, nor processing carried out on lawful grounds other than consent.
• We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

To exercise any of these rights, please contact us using the details under the “How to contact us” heading below. We respond to all requests in accordance with UK data protection law, normally within one month.

Please note that if you exercise your data protection rights in a way that affects the normal operation of our data centre facilities, we may need to restrict your access to those facilities.

How to make a complaint

If you are unhappy with how we have used your personal data, please contact us first using the details below so that we can put things right. We will acknowledge your complaint within 30 days, investigate it, and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator. You can contact the ICO at ico.org.uk/make-a-complaint or on 0303 123 1113.

Updates to this Privacy Notice

We may update this Privacy Notice from time to time in response to changing legal, technical or business developments. When we update our Privacy Notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make. We will obtain your consent to any material Privacy Notice changes if and where this is required by data protection law.

You can see when this Privacy Notice was last updated by checking the date at the top of this page.

How to contact us

If you have any questions or concerns about our use of your personal data, please contact us using the following details:

Email GDPR@ark-d-c.com or write to the Legal Director at the address below.

The data controller of your personal data (excluding personal data listed under the heading “Data collected by Ark”) is Crown Hosting Data Centres Limited, Spring Park, Westwells Road, Corsham, Wiltshire SN13 9GB.

The data controller of your personal data listed under the heading “Data collected by Ark” is Ark Data Centres Limited, Spring Park, Westwells Road, Corsham, Wiltshire SN13 9GB.