At a glance
If you only read one section, read this:
- We collect the minimum data needed to run our hosting service and bill you.
- We never sell your personal data. To anyone. Ever.
- We use a small number of carefully vetted sub-processors (listed in our GDPR Statement).
- You can access, export, correct, or delete your personal data anytime by emailing privacy@hostingdon.com.
- If you're in the EU/UK, our GDPR Statement and Data Processing Agreement apply automatically.
1. Who we are
HostingDon Inc. ("HostingDon", "we", "us") is the data controller for personal data described in this policy. Our registered office is Friedrichstraße 68, 10117 Berlin, Germany, with operating subsidiaries in Singapore and Austin, Texas (USA).
Our Data Protection Officer can be reached at dpo@hostingdon.com.
2. Data we collect
2.1 Account & billing data
When you create an account or place an order, we collect:
- Name, email address, and (if applicable) company name;
- Billing address and tax ID where required by law;
- Payment details — processed and stored by our PCI-DSS compliant payment provider, not by us. We only retain the last 4 digits and card brand for receipts.
2.2 Service usage data
To run the Services, we collect:
- Server logs (IP, timestamps, request method, status codes) for security and abuse detection;
- Resource usage metrics (CPU, RAM, disk, bandwidth) so we can show you dashboards and bill correctly;
- Support ticket and chat content, so we can help you and improve our service.
2.3 Customer Content
You may upload personal data to your hosted sites or applications. With respect to that data, HostingDon is a data processor and you are the controller. We don't read, scan, or analyze your Customer Content except as necessary to provide the Services or required by law.
2.4 Website analytics
We use a privacy-friendly analytics tool (Plausible Analytics) on hostingdon.com. It does not use cookies, does not track you across sites, and does not collect personal data. We see aggregate numbers like "1,200 visits to the pricing page yesterday."
3. How we use your data
We use personal data only to:
- Provide, maintain, and improve the Services;
- Process payments and prevent fraud;
- Communicate about your account, service incidents, and security alerts;
- Provide customer support;
- Comply with legal obligations (tax, regulatory, law enforcement requests with proper legal process);
- Send occasional product updates if you've opted in. You can unsubscribe anytime.
We don't use your data for advertising, data brokerage, or AI model training. We don't sell your data.
4. Legal basis (for EU/UK users)
Under GDPR, we rely on the following legal bases:
- Contract (Art. 6(1)(b)) — to provide the Services you ordered.
- Legitimate interest (Art. 6(1)(f)) — for security, fraud prevention, network operation, and basic analytics.
- Consent (Art. 6(1)(a)) — for marketing emails, where you've opted in.
- Legal obligation (Art. 6(1)(c)) — for tax records, regulatory compliance, and lawful disclosure requests.
5. Sharing & disclosure
We share personal data only with:
- Sub-processors — vetted vendors who help us operate the Services (payment processing, email delivery, anti-fraud, error monitoring). The full list is in our GDPR Statement and is updated whenever it changes.
- Domain registries — when you register a domain, we submit the WHOIS data required by ICANN. You can use WHOIS privacy (free on most plans) to mask personal details.
- Law enforcement and courts — only when we receive a valid legal request and have determined we must comply. We publish an annual Transparency Report with the number of requests received.
- Acquirer or successor entity — in the event of a merger, acquisition, or asset sale. Any successor will be bound by this policy or one substantially similar.
6. Data retention
We keep personal data only as long as we need it:
| Data type | Retention |
|---|---|
| Active account & billing data | For the life of your account |
| Account data after deletion | 30 days, then permanently deleted |
| Server access logs | 30 days for security; 90 days if a security investigation is open |
| Customer Content backups | Per your plan (typically 30 days), or 30 days after account closure |
| Tax & accounting records | 7 years (legal requirement) |
| Support tickets | 3 years for product improvement, then anonymized |
7. International data transfers
HostingDon is headquartered in Germany with operations in the EU, USA, and Singapore. Personal data may be transferred between these regions for business purposes. Where personal data is transferred outside the EU/UK, we rely on the European Commission's Standard Contractual Clauses (SCCs) and supplementary safeguards consistent with the Schrems II ruling.
Data hosted on customer-facing infrastructure stays in the region you select. EU customers can choose EU-only datacenters during signup or in account settings.
8. Your rights
Depending on your jurisdiction, you have the right to:
- Access — get a copy of the personal data we hold about you;
- Rectification — correct any inaccurate data;
- Erasure ("right to be forgotten") — delete your data, subject to legal retention requirements;
- Restriction — limit how we use your data while a dispute is resolved;
- Portability — receive your data in a machine-readable format;
- Objection — object to certain processing activities;
- Withdraw consent — for processing based on consent, at any time.
To exercise any of these rights, email privacy@hostingdon.com. We respond within 30 days. If you're not satisfied with our response, you can file a complaint with your local data protection authority. In Germany that's the BfDI (bfdi.bund.de); in the UK, the ICO (ico.org.uk).
California Residents (CCPA)
California residents have additional rights under the CCPA, including the right to know what categories of personal information we collect and the right to opt out of the "sale" of personal information. As stated above, we don't sell personal information. To exercise CCPA rights, email privacy@hostingdon.com.
9. Cookies
Our use of cookies on hostingdon.com is described in detail in our Cookies Policy. The short version: we use only what's necessary to run the site and remember your login. We don't use third-party advertising cookies.
10. Security
We protect personal data with administrative, technical, and physical safeguards proportionate to the sensitivity of the data, including encryption at rest and in transit (TLS 1.3), strict access controls, audit logging, and regular third-party penetration testing.
HostingDon is SOC 2 Type II certified. Our security whitepaper is available on request from security@hostingdon.com.
Despite all reasonable measures, no system is 100% secure. If a breach occurs that is likely to result in risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours, as required under GDPR Art. 33.
11. Children's privacy
The Services are not directed to children under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact privacy@hostingdon.com and we will delete it promptly.
12. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be communicated by email at least 15 days before they take effect. The "Last updated" date at the top of the page reflects the most recent revision. Older versions are available on request.
13. Contact
For privacy-related inquiries, including exercising your rights:
- Email: privacy@hostingdon.com
- DPO: dpo@hostingdon.com
- Mail: HostingDon Inc., Attention: Privacy Team, Friedrichstraße 68, 10117 Berlin, Germany