Privacy policy

We collect personal data necessary for providing our hosting and infrastructure services. The categories of data collected include:

• -Account creation and management
• -Providing and maintaining hosting services
• -Payment processing and transaction execution
• -Issuing invoices and accounting documents
• -Providing technical support
• -Infrastructure security monitoring, fraud and abuse detection and prevention
• -Managing commercial relationships with legal entity clients
• -Marketing communications to individuals (B2C)
• -Commercial communications to legal entities (B2B)
• -Responding to contact form enquiries

Each processing activity is associated with a distinct legal basis under Art. 6 GDPR:

Legitimate interest (Art. 6(1)(f)) — The processing of technical and security data, as well as the contact data of representatives of corporate clients, is based on the legitimate interest of the controller in securing infrastructure, preventing abuse, and maintaining commercial relationships. This interest has been assessed and does not override the fundamental rights and freedoms of data subjects. Data subjects have the right to object to this processing (Art. 21 GDPR).

Contact form (Art. 6(1)(f)) — When you submit the contact form, your name and email address are processed on the basis of our legitimate interest in responding to pre-contractual and general enquiries. You may request deletion of this data at any time by contacting [email protected].

Consent (Art. 6(1)(a)) — Marketing communications addressed to individuals are sent solely on the basis of explicit consent, which may be withdrawn at any time without affecting the contracted services.

B2B marketing — Commercial communications addressed to legal entities are sent on the basis of legitimate interest, with the possibility to opt out at any time.

We do not sell your personal data. Data may be shared with:

• -Payment processors (Stripe, Paysafecard) — solely to complete transactions
• -Infrastructure providers — to operate services (data centres, networks)
• -Competent authorities — when required by law or court order

Some service providers may process data outside the European Economic Area (EEA). Where such transfers occur, we ensure that appropriate safeguards are in place, including standard contractual clauses approved by the European Commission.

• -TLS/SSL encryption for all data in transit
• -Bcrypt hashing for passwords
• -IDS/WAF systems for intrusion detection & prevention
• -Continuous access logging and monitoring
• -Regular security audits
• -Role-based access control (RBAC)

We retain personal data for as long as necessary for the purpose for which it was collected:

• -Account data — for the duration of account activity and 90 days after closure
• -Unverified accounts — deleted automatically 30 days after registration if the email address is never confirmed, which also frees the address for re-registration
• -Security logs — up to 12 months from the time of recording
• -Accounting and tax records — 10 years under Romanian law
• -Policy acceptance records — retained for as long as the related order and accounting records, as proof of the agreement you entered into
• -Business verification documents — retained only as long as needed to verify the business, then deleted unless accounting law requires otherwise
• -Communication data (support) — 24 months from the last interaction
• -Contact form submissions — 12 months from the date of submission, or until the enquiry is resolved, whichever is sooner

A distinction worth stating plainly: for your account — your name, billing details, invoices, support tickets — we decide why and how the data is processed, and we are the controller.

For whatever you place on the servers you rent — your websites, databases, game server data, and any personal data of your own users — you remain the controller and we act only as a processor. We process that content solely to run the service, on your instructions. We do not inspect, access or use it for any other purpose, except where strictly necessary to investigate a reported abuse, resolve a support request you raised, or comply with a legal obligation.

If you process personal data of others on our infrastructure, you are responsible for having a lawful basis to do so. Business customers requiring a written data processing agreement under Art. 28 GDPR can request one at [email protected].

Backups exist so that data can be restored after failure, and they necessarily contain copies of personal data as it stood when the backup ran.

When you ask us to erase data, we remove it from live systems immediately. Copies held in backups are not individually edited — doing so would compromise the integrity of the backup — and instead age out on the ordinary backup rotation, after which the deletion is complete. In the meantime those copies are not used for any purpose other than disaster recovery.

If a personal data breach occurs, we notify the supervisory authority (ANSPDCP) without undue delay and, where feasible, within 72 hours of becoming aware of it, in accordance with Art. 33 GDPR.

Where a breach is likely to result in a high risk to your rights and freedoms, we will also inform you directly and without undue delay, describing what happened, the likely consequences and the measures taken (Art. 34 GDPR).

We do not carry out automated decision-making that produces legal effects concerning you, nor do we profile you in that sense (Art. 22 GDPR).

Automated systems are used only for security and abuse prevention — rate limiting, anti-bot checks and intrusion detection — and for applying the resource limits of the plan you purchased. Where such a system restricts your access, you can contest it and obtain a human review by contacting support.

This site uses cookies and browser storage entries (localStorage and sessionStorage). Each one is described individually — name, purpose, type, lifetime and legal basis — in our Cookie policy.

Storage that is strictly necessary for the site to work does not require consent. Everything else, including analytics and the anti-bot check, is activated only after you explicitly accept it, and consent can be withdrawn at any time from the cookies page. On withdrawal, data stored on the basis of consent is deleted from your browser.

As a data subject, you have the right to:

• -Access — request a copy of the personal data we hold
• -Rectification — request correction of inaccurate or incomplete data
• -Erasure — request removal of data, subject to legal obligations
• -Restriction — limit how we process your data
• -Portability — receive your data in a structured, machine-readable format
• -Objection — object to processing based on our legitimate interest

To exercise these rights, contact us using the details listed in section 01 above.

You have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP) if you believe the processing of your data infringes applicable regulations.

ANSPDCP — www.dataprotection.ro