These terms set out what is included in your monthly plan, what is not, and the conditions that apply. Your plan covers two things: hosting your website, and maintaining it.
If you have a Web Design Agreement with us, these terms sit alongside it. Where your agreement says the maintenance package may be modified or updated (Section 3.10) and that pricing may change on 30 days' notice (Section 4.1), these terms are the current, published description of that package. They replace the summary list in Section 3 of your agreement.
If we took your website over from another provider and you do not have a Web Design Agreement with us, these terms, together with the plan you signed up to, are the whole of our agreement about your plan. Section 12 applies to you.
Section 13 and its two schedules are the terms under which we handle personal data on your behalf. They apply to every plan.
If anything here conflicts with a specific written agreement you hold with us, that agreement takes precedence. The one exception is section 13: where it gives your website's visitors or you more protection than an older agreement does, section 13 applies.
There are two plans. They are identical in every respect except storage.
| Plan | Storage | Monthly | Annually |
|---|---|---|---|
| Managed | 10 GB | £55 | £605 |
| Managed Premium | 25 GB | £85 | £935 |
All prices exclude VAT, which is added at the prevailing rate. Monthly plans are billed monthly in advance. The annual option is twelve months for the price of eleven.
Section 3.3 explains what happens if your website outgrows its storage allowance.
We review pricing periodically. Any increase is notified at least 30 days in advance under section 10.
Your website is hosted in a UK data centre, on servers managed by us.
Your plan includes the storage set out in section 2. In practice a business website uses a small fraction of it - it is media libraries, not page content, that grow.
We monitor usage and will contact you before your website reaches its limit. If your website needs more storage than your plan includes, you move to the plan above.
We do not suspend a website or delete files without speaking to you first.
Backups are stored separately and do not count towards your allowance.
Your website files and database are backed up daily and retained for 14 days. Backups are held off-site, with a separate provider on separate infrastructure in Europe, so they survive a failure of the hosting platform itself rather than sitting on the same machine as the thing they protect.
WordPress core, plugins and themes are kept updated. Core security releases are applied automatically. Plugin and theme updates are applied on a regular cycle and are tested for obvious breakage before being left in place.
This applies only to software we can update. See section 5.
We run active protection on your site, comprising:
What this does not mean. No hosting provider, security product or maintenance plan can guarantee that a website will never be compromised. Monitoring and hardening substantially reduce the risk. They do not eliminate it. Where a compromise does occur despite these measures, section 6 sets out what we do about it.
If your website is compromised while your plan is active and current, we will clean it up at no additional charge, subject to section 6. Previously this was chargeable, typically £700 to £1,000 per incident.
Email accounts are not part of the standard plan.
Where we currently provide an email account for you, that continues unchanged. If that ever needs to change we will contact you about it separately and well in advance.
Section 13 covers any such email account, as well as your website.
Up to 20 minutes per month of minor content amendments are included. This covers changes such as replacing an image, editing existing text, or updating contact details.
Unused time does not roll over.
Minor amendments do not include structural changes, new pages or sections, new functionality, redesign work, or content writing. See section 8.
Your plan includes your website's privacy policy page, cookie policy page and cookie consent banner.
What we do:
What stays with you:
If you would rather use your own policies, for example ones written by your own adviser, tell us. We will publish them as supplied and tell you whenever we make a change to the website that they should reflect. Their content is then your responsibility.
Responsibility for compliance:
Where your website keeps a copy of form submissions, such as enquiries, we delete those stored copies automatically once they are 12 months old. This does not affect the copies sent to your email. Tell us if you need a different period for your website.
Your plan includes our licences for the following, which we keep current and updated:
These are provided for use on your website for as long as your plan is active. They are licensed to us, not to you, and do not transfer to you if the plan ends.
Some websites, particularly those we have taken over from another provider, run premium plugins or themes licensed directly to you rather than to us.
These remain your responsibility to keep current. We will tell you when one is due for renewal or has lapsed. We cannot update software whose licence has expired, because the vendor will not release updates to an unlicensed installation.
A lapsed licence means the plugin stops receiving security patches. That is a real and growing risk, and it is why section 6.3 excludes it from cover.
If you would prefer us to hold and manage a licence on your behalf, we can usually do this and rebill it. Ask us.
If your website is compromised, we will:
Cover applies only where all of the following are true:
Cover is intended for genuine incidents. It provides for one cleanup in any rolling 12-month period as standard. If a site is compromised repeatedly, we will review the cause with you before carrying out further work, and we may require specific remedial steps as a condition of continued cover.
We aim to begin work on a suspected compromise within one working day of it being reported or detected.
Routine requests, including content amendments, are typically actioned within three working days.
These are targets, not contractual guarantees, and we do not operate a 24/7 service. The data protection commitments in section 13.8 are separate from these targets.
The following fall outside the plan and are quoted or charged separately at £70 per hour, excluding VAT:
Moving a website to us when you join a plan is free (section 12.2).
We may update these terms. Any change that reduces what is included, or increases what you pay, will be notified to you by email to your account contact at least 30 days before it takes effect, in line with Sections 3.10 and 4.1 of your Web Design Agreement where you have one.
Changes are never applied retroactively.
Changes to the list of providers in Schedule 2 follow section 13.7 instead.
The current version is always published at this page, with the version number and effective date at the top and a changelog at the foot.
If you have a Web Design Agreement, after the initial 12 month period set out in it, either party may end the plan with 30 days' written notice. If you do not have one, your plan is rolling monthly and either party may end it at any time with 30 days' written notice (section 12.4).
On cancellation:
This section applies where we did not build your website and you do not have a Web Design Agreement with us: typically a site moving to us from another host or developer, or one we have cleaned up after a compromise.
When you join a plan, we move your website to our hosting at no charge. That covers:
It does not cover:
If your website is showing signs of a compromise before it joins, we investigate it for free and tell you what we found. We then quote for the cleanup. Nothing is cleaned, and nothing is charged, until you have agreed the quote. If the site cannot be recovered, we will tell you plainly and quote separately for a rebuild.
Once the site is clean and on our hosting, malware cover under section 6 applies from then on.
Your plan is rolling monthly. There is no minimum term: either of us may end it at any time with 30 days' written notice. If you chose the annual option, it runs to the end of the year you have paid for.
The rest of these terms apply to you in full. Where they refer to a Web Design Agreement, that reference does not apply to you.
Your website collects personal information about the people who use it: enquiries sent through its forms, and the technical information any website receives about its visitors. We host that website, back it up, relay its notification emails, protect it, and set up its analytics and cookie consent. That makes us your "processor" under UK data protection law, and the law requires a written contract between us setting out how we handle that information. This section, together with Schedules 1 and 2, is that contract. It applies for as long as we handle personal information for you.
You are the controller. You decide why and how your website's visitors' information is used. We handle it only to provide your plan. We do not use it for our own purposes, sell it, or combine it with information from other clients.
Schedule 1 sets out what we handle, whose information it is, what we do with it and for how long.
These terms, the plan you have chosen and any written requests you make to us (email is fine) are your instructions. We handle personal information only on those instructions, including when it is transferred outside the UK (section 13.10), unless the law requires us to do something else. If it does, we will tell you first, unless the law forbids that.
If we think an instruction you give us would break data protection law, we will tell you straight away and need not carry it out until we have discussed it. You are responsible for having a lawful basis for the information your website collects, and for your instructions to us being lawful.
Only people who need access to provide your plan have it. Everyone at Bulldogs Digital, and any contractor we use, is bound to keep your information confidential.
We protect your website and its data with the measures in sections 3.2, 4.1 and 4.3 and Schedule 1, part E, and we keep them appropriate to the risk. We review them when our set-up changes and after any incident.
We use a small number of other providers to deliver your plan. They are listed in Schedule 2, and by agreeing to these terms you authorise us to use them.
If we become aware of a breach of security affecting personal information we handle for you, we will tell you without undue delay, and we aim to do so within 48 hours of confirming it. We will give you what we know about what happened, what information and how many people may be affected, the likely consequences, and what we have done and propose to do, and we will add to it as we learn more.
Deciding whether to report a breach to the regulator or to the people affected is yours, as controller. Where a report is required, you have 72 hours from becoming aware of the breach to make it, so please read our notice promptly. We will give you the information we hold about the breach, such as what happened, what was affected and what we did about it, for you to use in any report.
A malware compromise of your website is investigated in this way as well as being cleaned up under section 6.
Where you need it to meet your data protection obligations, we will provide the information we hold and carry out the technical work on your website:
We do not give legal or regulatory advice, and we do not prepare reports, responses or correspondence with the regulator on your behalf.
This work is charged at £70 per hour excluding VAT, and we will tell you before we start. It is not charged where the need arises from our own failure to meet this section.
We transfer personal information outside the UK only to the providers in Schedule 2, and only where the transfer is permitted by UK data protection law: to a country the UK recognises as providing adequate protection (which includes the European Economic Area), to a US organisation certified under the UK Extension to the EU-US Data Privacy Framework, or under approved contract terms such as the UK's International Data Transfer Agreement or Addendum. Schedule 2 states which applies to each.
When your plan ends, we will return a copy of your website's files and database if you ask for it within 30 days. We then delete your website, its database and any email account we provide for you from our server. Copies in our backups are deleted as the backups expire, within a further 14 days. We keep only what the law requires us to keep, such as our own invoices, and nothing from your website.
We will give you the information you reasonably need to show that we meet this section, on request. If that is not enough, you, or an auditor you appoint who is bound by confidentiality, may inspect how we handle your information, once a year on at least 30 days' notice, during working hours, and in a way that does not expose other clients' information. Further inspections are possible after a breach affecting you, or if the regulator requires one. Time we spend on an inspection is charged at £70 per hour excluding VAT, except after a breach caused by our failure to meet this section.
See section 14.
Since June 2026, every business that decides how personal information is used must give people a way to complain about it, acknowledge a complaint within 30 days, look into it without undue delay, keep the person informed and tell them the outcome. For your website, that duty is yours, as the controller.
What we provide:
What stays with you: reading and acknowledging complaints, deciding the response, keeping the complainant updated, and keeping a record of them. Make sure the address your privacy policy gives for complaints is one someone at your business reads.
A. Subject matter and duration. Hosting, backing up, securing and maintaining your website, and setting up its analytics and cookie consent, as described in these terms, for as long as your plan runs and then until deletion under section 13.11.
B. Nature and purpose. Storing your website and its database; making daily backups; relaying the website's notification emails; filtering and logging requests to protect the site; scanning for and cleaning up malware; applying updates; installing and configuring the analytics, cookie consent and other services on your website; providing any email account covered by section 4.5; and helping you under sections 13 and 14.
C. Types of personal information.
D. Whose information it is. Visitors to your website; people who contact you or apply to you through it; your customers, members or users where your website has accounts; your staff who use the website or an email account we provide.
Special categories. Your website is not designed to collect health, criminal-record or similarly sensitive information. If it does, for example a counselling enquiry form, or it is aimed at children, tell us, because it needs additional safeguards.
E. Security measures (section 13.6)
Last updated: 22 September 2026. Changes are notified under section 13.7.
| Provider | What they do | Where the information is processed | Safeguard for transfers outside the UK |
|---|---|---|---|
| Clouvider Ltd | The server your website runs on | UK | Not needed |
| Enix Limited (trading as Brixly) | Hosting for the websites still to be moved to our own server | UK | Not needed |
| Hetzner Online GmbH | Storage for daily backups | Germany | UK adequacy regulations (EEA) |
| Cloud Linux Software, Inc. (Imunify360) | Malware scanning and firewall on our server; suspicious files are sent to it for analysis | United States | UK Extension to the EU-US Data Privacy Framework; UK Addendum to the EU standard contractual clauses |
| Amazon Web Services EMEA SARL (Amazon SES) | Relays your website's notification emails, such as form enquiries | UK | Not needed |
| Plus Five Five, Inc. (Resend) | Relays notification emails for any website not yet moved to Amazon SES | United States | UK Extension to the EU-US Data Privacy Framework |
| Cloudflare, Inc. | Domain name (DNS) service, and for some websites traffic protection, performance and email forwarding | Worldwide, including the United States | UK Extension to the EU-US Data Privacy Framework |
| Google Ireland Limited and Google Cloud EMEA Limited | Google Analytics, Tag Manager, Maps and reCAPTCHA, where they are set up in an account we manage for your website; Google Workspace, for notification emails sent through our Google account and any email account under section 4.5 | Worldwide, including the United States | UK Extension to the EU-US Data Privacy Framework (Google LLC) |
| Version | Date | Change |
|---|---|---|
| 1.0 | Per agreement | The maintenance summary set out in Section 3 of each signed Web Design Agreement. Never published as a standalone document. |
| 2.0 | 1 Oct 2026 | First published version. Supersedes the summary in Section 3 of your agreement. Adds malware cleanup cover (4.4), previously chargeable at £700 to £1,000 per incident. Adds a full description of the hosting (section 3), which was not previously set out anywhere. Defines the scope of security monitoring (4.3). Sets out the split between licences we provide and licences you provide (section 5). States both plans, their storage allowances and the annual option (section 2). Increases the Managed plan price from £35 to £55 per month excluding VAT. The 20 minute monthly content allowance is unchanged. |
| 2.1 | 1 October 2026 | Adds terms for websites we take over (section 12): moving your site to us is free when you join a plan, and without a Web Design Agreement the plan is rolling monthly with 30 days' notice and no minimum term. Minimum terms under existing Web Design Agreements are unchanged. Adds data processing terms (section 13, Schedules 1 and 2), including the providers we use, how we tell you about a breach, and what information we provide for requests from individuals. Adds your website's privacy policy, cookie policy and cookie consent banner as a named part of the plan (4.7). Adds what we provide for data protection complaints about your website, and what stays with you (section 14). Corrects the description of where your website is hosted (3.1). Changes: a final copy of your site must be requested within 30 days of the plan ending (section 11); work under section 13 is chargeable at the standard rate (13.9); inspections are limited to once a year on 30 days' notice (13.12). Malware cover for a site joining after this date starts once it is clean (6.2). Prices are unchanged. |
Bulldogs Digital Ltd
Bank House Southwick Square, Southwick, Brighton, BN42 4FN
woof@bulldogsdigital.com
Version 2.1. Effective 1 October 2026.