Privacy Policy

Who is responsible?

HostingGY processes personal data to deliver the website-as-a-service, manage customer accounts, create invoices and provide support.

The data controller is Mitoxsa Design SL, trading as HostingGY, located at PCA Casa Nova 11, 03649 Monovar, Alicante, Spain. CIF/VAT: ESB72524275. For privacy questions, email [email protected].

What data do we process?

• Name, company name and contact details
• Email address, account data and login status
• Invoice data, payment status and administration data
• Domain data, DNS settings and hosting data
• Support messages and communication
• IP addresses, server logs and security logs
• Website content uploaded or added by the customer

Why do we process data?

• Manage accounts and the customer area
• Provision the WordPress website and temporary URL
• Register free domains on .be, .com, .co.uk, .de, .es, .eu, .nl and .org and connect customer-owned domains when requested
• Process billing and payments
• Provide support
• Security, logging and abuse prevention
• Register and manage domains
• Meet legal administration duties

Legal bases

• Performance of the contract
• Legal obligation, such as administration
• Legitimate interest, such as security and abuse prevention
• Consent, only if optional analytics or marketing cookies are added later

Processors and subprocessors

• Stripe for payments
• Cloudflare for DNS, CDN and security
• RunCloud for provisioning and server management
• Blesta for customer administration, billing and the client area
• Openprovider for domain registration
• Hetzner for European hosting infrastructure, with data location in Germany/Europe
• TODO: add Netim as a subprocessor when this supplier becomes active

Retention

We do not keep data longer than needed for the purposes for which it was collected, unless legal duties require a longer retention period.

Invoice and administration data is kept as long as required for tax and administration duties. Account, support, domain and hosting data is kept while the customer relationship exists and afterwards as needed for handling, security, evidence or legal duties.

Backups are made daily and kept for 7 days. After termination, a service may be deleted under the termination policy in the terms.

International transfers

Some suppliers may process data outside the European Economic Area. In that case, appropriate safeguards must apply, such as standard contractual clauses or other GDPR mechanisms.

TODO: legally review international transfers per supplier, including Stripe, Cloudflare, RunCloud, Blesta, Openprovider and future subprocessors.

Customer rights

• Access personal data
• Correct inaccurate data
• Delete data where legally possible
• Restrict processing
• Object to certain processing
• Data portability where applicable
• File a complaint with the relevant privacy authority

Security and contact

HostingGY uses appropriate measures such as HTTPS, access control, server security, DNS/CDN security and logging.

DNS, CDN and security run through Cloudflare. Provisioning and server management run through RunCloud. Hosting infrastructure runs on Hetzner in Germany/Europe. Backups are made daily and kept for 7 days. Restore is best effort on request; restore is free after a platform fault, while customer-caused restore work may involve support costs.

For support and privacy questions, contact [email protected].