Privacy Policy

This is a courtesy English translation. The German version is legally binding; in case of any discrepancy, the German text prevails.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

A data protection officer has not been appointed, as the legal requirements for this (§ 38 BDSG, German Federal Data Protection Act) are not met.

2. Principles of data processing

We process personal data on the following legal bases:

• Art. 6(1)(a) GDPR — consent, where we expressly ask for it (such as the Discord notification, section 9c)
• Art. 6(1)(b) GDPR — performance of a contract and pre-contractual measures (registration, ordering, support)
• Art. 6(1)(c) GDPR — compliance with legal obligations (tax and commercial law, GoBD, Digital Services Act)
• Art. 6(1)(f) GDPR — legitimate interests (IT security, abuse prevention, operational stability)

3. Provision of the website and server log files

Every time you access our website and customer area, we automatically collect technical information: IP address, date and time, requested URL, HTTP status code, user agent and referrer. This processing serves to deliver the page, defend against attacks and investigate cases of misuse (Art. 6(1)(f) GDPR). These web server access logs are deleted after 30 days at the latest, unless a security-relevant incident requires longer retention. What our application itself logs is set out in section 11.

You reach the website, the customer area and the programming interface via the network ofCloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). Cloudflare protects them against overload attacks (DDoS) and establishes the encrypted connection. For this, all requests pass through Cloudflare's servers, including your IP address and the content you enter or retrieve in the customer area. Cloudflare processes this data on our behalf (Art. 28 GDPR) and only to forward it to us and to fend off attacks. The basis is Art. 6(1)(f) GDPR (availability and security of the service). On the transfer to the USA see section 10a. The traffic of the servers you book does not pass through Cloudflare.

4. Registration and customer account

A customer account is required to use our server and domain products. For this we process: username, email address, password (as a hash, never in plaintext), and — when ordering paid services — billing address including country and order data; optionally also phone number and Discord name. The basis is Art. 6(1)(b) GDPR.

For login we additionally offer two-factor authentication (TOTP) and passkeys (WebAuthn). Passkey key material stays on your device or in your password manager; we only store the public key for verification, no third parties are involved.

4a. Screening against sanctions lists

The sanctions regulations of the European Union prohibit making services or funds available to listed persons and organisations. We therefore screen the names and companies you enter as contact or billing details against the EU consolidated sanctions list, and again whenever the list is updated. The screening runs exclusively on our systems; your data is not transmitted to anyone for it. The legal basis is Art. 6(1)(c) GDPR in conjunction with the EU sanctions regulations.

An entry is only created on an exact name match: the name that triggered it, the list concerned and later the outcome of the review. A human always decides on a match; there is no automatic blocking. Decided entries are deleted five years after the decision; for that long we must be able to show that we met our obligations.

4b. Withdrawal, termination and notices of illegal content

If you declare a withdrawal or a termination, whether in the customer area or via the forms on this website, we store your details, the time of receipt and, for 90 days, your IP address, so that we can prove receipt of the declaration (§ 356a(4), § 312k(4) and (5) BGB). We store notices of illegal content under Art. 16 DSA with name, email address (optional for reports of child sexual abuse material), reported address and reasoning, in order to handle them and to inform you of the decision; we do not pass your details on to the reported person unless the law requires it. The legal basis in each case is Art. 6(1)(c) GDPR.

We delete these entries three years after the end of the year in which the declaration was received or the decision on the notice was taken; claims arising from them can be asserted for that long (§§ 195, 199 BGB).

5. Payment processing

We process balance top-ups through our payment service provider Mollie B.V., Keizersgracht 313, 1016 EE Amsterdam, Netherlands. In doing so, we transmit to Mollie the amount, the chosen payment method and a payment reference containing your customer number; you enter your payment data (such as card or account details) directly on Mollie's page, and it does not reach us. The basis is Art. 6(1)(b) GDPR. A data processing agreement pursuant to Art. 28 GDPR is in place. More information:mollie.com/en/privacy.

If you top up balance by bank transfer to our business account, our account-holding bank tells us, for each incoming payment, the name and shortened IBAN of the payer, the amount, the payment reference and the time. We credit the amount to your account based on the customer number in the payment reference; without a recognisable customer number we assign the payment by hand or transfer it back. The basis is Art. 6(1)(b) GDPR, and for retention as an accounting record Art. 6(1)(c) GDPR in conjunction with Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB) (up to ten years). The bank acts as an independent controller.

5a. Identity verification for payouts

If you ask us to pay out balance, we generally refund via the payment methods you used to top up — no additional data is collected in that case. Only if this is no longer possible and there are reasonable doubts as to whether the payout is going to the entitled person (for example because the stated account holder differs from the data you have on file) do we ask you for proof of identity.

The sole purpose is to avoid paying out your balance to an unauthorised person: we are only discharged from our obligation if we perform to the person actually entitled (§ 362 BGB, German Civil Code). The legal basis is Art. 6(1)(b) GDPR (fulfilment of the repayment claim) and Art. 6(1)(f) GDPR (legitimate interest in fraud prevention). We are not subject to a statutory identification obligation under the German Anti-Money Laundering Act (Geldwäschegesetz) — we are not among the obliged entities listed there.

For this we only need your name, address, date of birth and the validity of the document.Black out all other information, in particular the ID card number and serial number as well as the card access number; under § 20(2) of the German Identity Card Act (Personalausweisgesetz) we are not permitted to use these in any case. We delete the proof immediately after the check — it is not an accounting record; the payout itself is documented by the amount, date and bank transfer. We only record that and when a check took place.

6. Domain registration

When you order a domain, we transmit the holder and contact data required for registration (Whois data) to our domain registrar service provider (DomainRobot / InterNetX GmbH) as well as to the registry responsible for the chosen domain extension. These entities process the data as independent controllers in accordance with their own registration terms. The basis is Art. 6(1)(b) GDPR.

The registries operate public directory services (WHOIS or RDAP). Depending on the extension and your role as holder, your name, address, email address and telephone number may be publicly retrievable there; for .de, holder data is currently not displayed publicly but can be retrieved where there is a legitimate interest. The scope and duration are determined by the requirements of the respective registry and ICANN — we have no influence on this. The information is mandatory for registration; without it, a domain cannot be registered (Art. 6(1)(b) GDPR).

Anyone who registers or resells domains must keep the registration data accurate and complete and give legitimate access seekers, such as law enforcement and cybersecurity authorities, access on a reasoned request (Art. 28 of Directive (EU) 2022/2555, NIS 2, and the German implementing provisions). We answer such requests only to the extent provided by law. The legal basis is Art. 6(1)(c) GDPR.

7. Bot and spam protection (Cloudflare Turnstile)

To protect login, registration and forms from automated abuse, we use Cloudflare Turnstile, a service provided by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. This processes your IP address and browser characteristics to distinguish automated access from human use. The basis is Art. 6(1)(f) GDPR (protection against abuse). On the transfer to the US, see section 10a. More information:cloudflare.com/privacypolicy.

8. Email delivery

We send transactional and support emails (order confirmations, invoices, security notices, ticket replies) through a mail server that we operate ourselves. It runs on a leased server at a hosting provider in the European Union that acts as our processor (Art. 28 GDPR; name on request, see section 9). We do not pass data on to email marketing providers.

9. Server and hosting infrastructure

We operate the servers you book in the SkyLink data centre in Eygelshoven (Netherlands). The website, the customer area and our database run on a leased server at a hosting provider in the European Union; the backups of that server, including the database, are kept at a further hosting provider in the European Union. Both act as our processors (Art. 28 GDPR). We will tell you the names of these providers on informal request to the address given in section 12. You, as the customer, are responsible under data protection law for any content you store yourself on a booked server; we process this content solely to provide the hosting service.

9a. Technical access to your servers and deletion

You receive full administrator access (root) on booked servers. So that a server can be provided at all, we generate an initial password and store it in encrypted form; you can change it at any time. Beyond that, there is a technical possibility of accessing the server via the virtualisation layer (Proxmox/QEMU Guest Agent) — this is the case with every form of virtual hosting and cannot be switched off.

We use this access exclusively for provisioning, maintenance and troubleshooting, to defend against abuse, or on the basis of a legal obligation. Access by our staff is logged. We do not routinely look at the contents of your virtual machine in the process; anyone processing particularly sensitive data should additionally encrypt it themselves.

When a server ends, the virtual machine, the associated storage volumes and the backups on the storage system are deleted and the occupied storage area is released for reuse. The assignment of the server to your account that we keep is retained as an accounting record (§ 147 AO, German Fiscal Code), without technical access data.

Separately, we record which IP addresses your server had and from when to when. After a server ends, its IP addresses are passed on to other customers, but abuse reports and requests from authorities often concern a point in the past. Without this history we could not attribute them to the right contract, and the current holder of the same address would come under suspicion wrongly. We store only the address, the server, the customer account and the two points in time. The legal basis is Art. 6(1)(f) GDPR. We delete the entry one year after the address was released, even if you delete your customer account before then (Art. 17(3)(e) GDPR).

9b. Security notifications

For security-relevant events on your account — sign-in from a new device, password change, creation of an API key — we send you a notification stating the time and IP address of the event. This serves your own oversight and is based on Art. 6(1)(f) GDPR (security of processing, Art. 32 GDPR). The underlying log entries are subject to the period stated in section 11.

9c. Traffic measurement for your server

We measure the data volume transferred for every server. We record only the totals of inbound and outbound bytes per server and billing period, together with the time of measurement.For this purpose we do not analyse the contents, destinations or remote endpoints of your connections — the figures come from the hypervisor's counters, not from the traffic itself. For the detection of attacks originating from a server, see section 9d.

The measurement serves the performance of the hosting contract: it evidences your consumption against an agreed traffic quota and is the basis for any throttling. The legal basis is Art. 6(1)(b) GDPR. The measurement runs on our own infrastructure (section 9); no external service provider is involved.

Counters are reset at the start of each billing period. Records of when a traffic threshold was reached and what was done in response are deleted after 90 days.

Consumption on withdrawal. If you withdraw from a server contract, we record before deletion how much data was transferred in the period used and how much of it corresponds pro rata to that period. If consumption is considerably higher, the case is flagged and reviewed by a member of staff (section 8c of our Terms); a human always decides, and compensation for value remains pro rata. Such a review may result in a block on further orders. The legal basis is Art. 6(1)(f) GDPR (protection against abuse of the right of withdrawal). We delete the data three years after the end of the year in which it was collected — the same period as for the withdrawal notice itself (section 11).

Discord notifications (optional). In your server's settings you may store a Discord webhook address. If you do, we transmit your server's name, the measured consumption and any throttling to Discord (Discord Netherlands B.V., Amsterdam; parent company in the USA) when a traffic threshold is reached. This transfer happens solely because you bring it about yourself by storing the address — the legal basis is your consent under Art. 6(1)(a) GDPR. You can remove the address at any time, which ends the transfer going forward. Without a stored address, no transfer takes place.

9d. Detection of attacks originating from your server

To prevent attacks on third-party systems from originating from our servers, a monitoring program runs on every virtualisation node. Every 30 seconds it counts the packets and bytes each server sends and receives, and it evaluates the node's connection table: destination IP address, destination port, whether a connection was established and how many packets it carried; for requests sent to your server via UDP, also the sender address. We do not analyse the contents of your connections. The evaluation is automatic. Data is only stored when a pattern indicating an attack is detected — a denial-of-service (DoS) attack, the use of an open service on your server as an amplifier, a port scan, mass login attempts (brute force), bulk email sending or signs of crypto mining (connections to mining pools, but only together with near-full processor utilisation over a sustained period from the measurement in section 9e). In that case we store the measured values, the main target affected (IP address and port), the time period and the reasoning.

The purpose is the security of our network and the protection of third parties. The legal basis is Art. 6(1)(f) GDPR — preventing denial-of-service attacks is a recognised legitimate interest (Recital 49 GDPR) — and the enforcement of section 8 of our Terms (Art. 6(1)(b) GDPR). We process the IP addresses of attacked systems on the same basis.

Depending on the location, a detected attack may automatically lead to us blocking your server's outgoing traffic, disconnecting it from the network, stopping it or temporarily locking its management (section 8 of our Terms), and to us contacting you by email or opening a ticket about it in your customer account. Signs of crypto mining never lead to an automatic block, only to a notice to you. Insofar as this constitutes an automated decision within the meaning of Art. 22 GDPR, it is necessary for the performance of the contract (Art. 22(2)(a) GDPR): it ends an ongoing attack before third parties suffer harm and the data centre disconnects our network. You are notified without undue delay with a statement of reasons, and you may at any time request that a member of staff reviews the block, express your point of view and contest the block (Art. 22(3) GDPR) — most easily via a support ticket.

Findings are deleted one year after the last detection; measurements without a finding are not stored. The evaluation runs on our own infrastructure; no external service provider is involved.

9e. Measuring your server's utilisation

Every five minutes we automatically record how heavily your server uses its allocated resources: CPU and memory utilisation, disk usage, and the amount of data transferred and read or written. The values come from the hypervisor's counters. We do not record what runs on your server or what content it processes.

The measurement serves the stable operation of the shared hardware and as evidence if a use under § 8c of our T&Cs impairs other customers; on request we show you the values. The legal basis is Art. 6(1)(b) GDPR (performance of the hosting contract) and Art. 6(1)(f) GDPR (undisturbed operation for all customers). Individual measurements are deleted after 48 hours, the hourly values derived from them after 90 days. The measurement runs on our own infrastructure.

9f. Downloading ISO files

If you add an ISO file via a link in the customer area, our system does not download it directly but through an intermediate proxy server. This way the remote site learns neither your server's address nor that of our infrastructure. The proxy operator sees which address is requested; for encrypted https:// links only the server name. They do not learn who you are. Besides our own proxies we use publicly available proxy servers of third parties, which may be located outside the EU; through these we load encrypted links only.

We store the link together with the ISO file and delete it with the file. The legal basis is Art. 6(1)(b) GDPR. Do not enter links that contain credentials or personal identifiers; links with a user name and password are not accepted.

9g. Game servers

If you book a game server, it runs in an isolated container on one of our game hosts in the same data centre as our other servers (section 9). To operate it we store in our database the assignment to your customer account, name, game and variant, host and ports, the booked limits, the term and, where applicable, a reason for suspension, as well as the start parameters you set. The contents of the server — files, game worlds, console output — are stored only on the game host. Backups are stored there too, unless the backups page in the customer area names a separate S3 storage; its provider is listed among the subprocessors (DPA § 7). The legal basis is Art. 6(1)(b) GDPR.

Activity log. For each game server we keep a log that you can view in the customer area: starting and stopping, console commands sent, file and SFTP actions, backups, changes to settings and sub-users — each with the time, the account that triggered it and, for logins and file actions, the IP address. If our staff act on your server, it shows "Support". The purpose is to make changes traceable for you and for us and to prevent abuse; the legal basis is Art. 6(1)(f) GDPR. Entries are deleted after 90 days.

Sub-users. If you invite another person to your game server, they need their own customer account; you see their username and e-mail address, and they see the game server with the permissions you grant. The legal basis is Art. 6(1)(b) GDPR (your contract and the use by the invited person). The invitation ends when you remove it, the person leaves or the game server ends.

Access and databases. For SFTP you set a separate password per server; we store it only as a hash, and your account password does not work there. MySQL databases you create are stored on a database server in the game host's network; we store their credentials encrypted. Technically, we can access the files and console of your game server via the host's management software (Pterodactyl Wings); as described in section 9a we use this only for provisioning, maintenance, troubleshooting, preventing abuse or on a legal basis.

You process the data of players who connect to your game server (such as player names or IP addresses in your server logs) as the controller; we store it for you as a processor (data processing agreement). If a game server ends when its term expires, it is stopped and deleted together with its files, backups and databases after seven days; on withdrawal, termination with refund or deletion of the customer account it is deleted immediately.

9h. DNS and reverse DNS

If your domain uses our name servers, we store the DNS records you set in the customer area and distribute them to our name servers; the same applies to the reverse DNS name (PTR) you set for an IP address of your server. These records are public by design: anyone can look them up in the DNS. Before we accept a PTR, we check that the name points to the same address; for this we look up the name via Cloudflare's DNS service (only the name is transmitted). The legal basis is Art. 6(1)(b) GDPR.

A PTR only applies while your server holds the address — afterwards it is no longer served and is deleted. If your domain moves away from our name servers or the contract ends, the zone remains available for another two days (so your domain stays reachable during the switch) and is then deleted.

Dynamic DNS. If you set it up for a hostname, we set the IP address your router reports (or calls us from) as that name's DNS record — like any DNS record it is then publicly retrievable. We store the time of the last update and the access password only as a hash. Once you remove the entry, the password no longer works.

Redirects and MTA-STS. If you set up a redirect or MTA-STS, our name server hosts answer requests for these names and redirect them or serve the policy; we keep no access log. For HTTPS we obtain a certificate from Let's Encrypt; the hostname is transmitted and — like every public certificate — listed in the public Certificate Transparency logs.

10. Cookies and local storage

We use one cookie and a few entries in your browser's local storage (LocalStorage). All of them are technically necessary or store a setting you made yourself; no consent is required for them (§ 25(2) No. 2 TDDDG).

We do not use any cookies or storage entries beyond those listed above. There are no analytics, reach-measurement or marketing services. Because all storage is technically necessary (§ 25(2) No. 2 TDDDG, German Telecommunications Digital Services Data Protection Act), no consent is required for it; the notice on your first visit serves solely to inform you. Should we use reach measurement in the future, we will obtain your consent for it beforehand and add it to the table above.

10a. Transfers to third countries

Our servers and the services we use to process your data are located in the European Union as a rule. A transfer to a country outside the EU and the EEA only occurs where we use a service whose provider is established in a third country. This concerns above allCloudflare, Inc. (USA) for protecting the website (section 3) and for bot protection (section 7).

In addition, a transfer to a third country can occur in two cases that you trigger yourself: when an ISO file is downloaded through a proxy server outside the EU (section 9f; only the name of the requested server is transmitted, not your identity), and with the optional Discord notification (section 9c), whose provider belongs to a US group. The basis there is Art. 49(1)(b) GDPR (performance of the operation you requested) or your consent.

Cloudflare is certified under the EU-US Data Privacy Framework. That transfer is therefore covered by an adequacy decision of the European Commission of 10 July 2023 (Art. 45(1) GDPR); alongside an adequacy decision, no additional safeguard is required. In addition, and in case the certification lapses or the decision is annulled, we have agreed the European Commission's Standard Contractual Clauses with Cloudflare (Implementing Decision (EU) 2021/914) — Art. 46(2)(c) GDPR.

Which further providers we use, in which country they process, and what any third-country transfer is based on, can be found at any time in the list of subprocessors in thedata processing agreement; it is kept up to date.

11. Retention periods

We retain our accounting records (ledger, orders) for ten years, invoices and other accounting vouchers for eight years (§ 147(3) AO, § 257(4) HGB, § 14b UStG), and business correspondence including the sent-email archive for six years (§ 257(4) HGB), each from the end of the calendar year. We also retain logs of interventions by our staff (changes to accounts, bookings, permissions and settings) for 10 years so that changes to accounting-relevant data remain traceable (§ 146(4) AO), and delete them automatically afterwards.

Irrespective of these periods, we delete additional personal information earlier as soon as its purpose has been fulfilled (Art. 5(1)(e) GDPR):

• IP addresses and device identifiers in log and booking data areautomatically deleted after 90 days. This also applies to the IP address recorded with an order or payment: the record itself is retained for the statutory period, the IP address is not.
• Top-ups that were never paid (cancelled or expired) are not accounting records and are deleted after 90 days.
• Application logs, the action logs of your servers (start, stop, reinstallation and the like) and the activity logs of your game servers(section 9g) are deleted after 90 days, change logs for domains, system events, findings of the attack detection (section 9d) and messages in the customer area after one year, the history of IP assignments (section 9a) one year after the address was released. Utilisation measurements (section 9e): individual values after 48 hours, hourly values after 90 days. Decided matches of the sanctions screening(section 4a) after five years; withdrawal and termination declarations and DSA notices (section 4b) three years after the end of the year of receipt or decision.
• The security log of your account (sign-ins, password and two-factor changes, see section 9b) and the records of the notice on your first visit are deleted after three years — the period in which claims arising from unauthorised access can be asserted (§ 195 BGB). The IP address and device identifier in them are removed after 90 days already.
• Closed support tickets are deleted as soon as the regular limitation period has expired — three years from the end of the year of the last processing (§ 195 in conjunction with § 199(1) BGB). Open tickets are not deleted automatically.
• When you delete your customer account, we remove or anonymise your personal data immediately, including the ticket texts you wrote. Only the data subject to a statutory retention obligation is retained, until their periods expire the withdrawal and termination declarations (sections 4b and 9c) and the findings of the attack detection without any link to your account (section 9d), as well as the history of IP assignments (section 9a).

12. Your rights

Under the GDPR you have the following rights:

• Access to the personal data stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR), unless a retention obligation applies
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of a given consent with effect for the future

You can correct your contact details and your email address yourself in the customer area under Account. We change your username for you on request by email.

A direct export tool for your account data is available in the customer area under Account → Privacy; it provides your master, order, invoice and log data as a JSON file. You can also delete your account yourself there, provided no domain is still active and no amount is outstanding. We pay out any remaining balance and paid remaining term on request beforehand; alternatively you expressly waive it in the deletion dialog.

You exercise all other rights — in particular restriction of processing under Art. 18 GDPR and objection under Art. 21 GDPR — informally by email; we implement them manually and reply to you within one month (Art. 12(3) GDPR). This also applies to the deletion of a suspended account: a suspension prevents login and thus self-deletion — your right to erasure remains unaffected; simply write to us.

On request, in addition to the copy of your data, you will receive the information under Art. 15(1) GDPR in text form: purposes of processing, categories of data, recipients, envisaged storage period and the source of the data.

For all of this you can reach us at:

Email:

13. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. Generally, this is the authority in your habitual place of residence or the authority responsible for us:

Note: Provider address and supervisory authority are still placeholders — please complete them in the admin panel under company settings.