Privacy policy

This policy explains what personal data we process, why, on what legal basis and how long we keep it. It fulfils the information duty under Articles 13 and 14 GDPR.

Article 1 - Controller

HOSTZONE s.r.o., company no. 248 81 465, registered office at Příčná 1892/4, Nové Město, 110 00 Prague 1, Czech Republic, entered in the commercial register kept by the Municipal Court in Prague, file no. C 443830.

Contact for data protection matters: privacy@hostzone.eu

We do not appoint a data protection officer (DPO). Under Article 37 GDPR one is required only for public authorities and for organisations whose core activity is large-scale regular and systematic monitoring of individuals or large-scale processing of special categories of data (health data, for example). Web hosting is neither.

Article 2 - Two different roles

With hosting it matters to distinguish two situations:

• As a controller we process the data of our customers and of visitors to our website - identification and billing data, correspondence and operational records. That is what this policy is about.
• As a processor we process the content our customers store on our servers: their website data, e-mail and databases. We do not access that content and the customer determines the purpose of the processing. It is governed by the Data Processing Agreement, not by this policy.

Article 3 - Purposes, legal bases and retention periods

Purpose	Categories of data	Legal basis	Retention
Concluding and performing the contract, managing services	first name and surname, business name where applicable, address, e-mail, telephone, company and VAT number, login credentials	Article 6(1)(b) - performance of a contract	for the term of the contract and 3 years after it ends, then anonymisation
Invoicing and accounting	billing data, documents	Article 6(1)(c) - legal obligation	tax documents 10 years, accounting records 5 years
Payment processing	payment data	performance of a contract	at the payment gateway under its own terms
Domain registration	first name and surname, address, e-mail and telephone number of the holder	Article 6(1)(b) - performance of a contract, and Article 6(1)(c) - the legal obligation to keep accurate and complete registration data under Article 28 of Directive (EU) 2022/2555 (NIS2)	for the term of the registration and thereafter under the registry’s rules
Customer support	content of requests, contact details	performance of a contract; for non-customers, legitimate interest	3 years from closing the request
Contact form	name, e-mail, telephone, message text	legitimate interest and pre-contractual dealings	6 months if no contract arises
Operations and security	IP addresses, operational and security records	Article 6(1)(f) - legitimate interest in network security	operational 30 days, security 6 months
Reports of illegal content	name and e-mail of the reporter, content of the report	legal obligation under Article 16 of Regulation (EU) 2022/2065	3 years
Sending news to customers	name, e-mail	Article 6(1)(f) - legitimate interest in direct marketing, on the conditions in Section 7(3) of Act No. 480/2004 Coll.	until unsubscribing or objecting
Sending news on subscription	e-mail, language	Article 6(1)(a) - consent	until consent is withdrawn
Record of consent and of unsubscribes	e-mail, date and time, IP address	Article 6(1)(c) and (f) - demonstrating compliance under Article 7(1) and honouring an objection	3 years from unsubscribing or withdrawing consent

We do not record calls and we operate no camera system. We do not collect job applicants’ CVs.

We send news once a month. To customers we send it on the basis of legitimate interest under Section 7(3) of Act No. 480/2004 Coll.; you can refuse it already when ordering and then in every message. To everyone else only on subscription, which you confirm by clicking a link in an e-mail - without that confirmation we send you nothing and we delete the address within seven days. An unsubscribe link is in every message.

Article 4 - Recipients

We disclose personal data to:

• processors named in the list of sub-processors - Stripe, PayPal, GRANSY and SK-NIC,
• public authorities, where a legal regulation requires us to.

We do not sell personal data and we do not make it available for third-party marketing.

All processing takes place within the EU and the EEA. No transfer to a third country occurs, so standard contractual clauses and a transfer assessment do not apply.

Article 5 - Your rights

Under the GDPR you have the right to:

• access your data (Article 15),
• rectification of inaccurate data (Article 16),
• erasure (Article 17),
• restriction of processing (Article 18),
• portability of your data (Article 20),
• object to processing based on legitimate interest (Article 21),
• withdraw consent where the processing is based on it.

You may object to processing for direct marketing purposes at any time and without giving a reason (Article 21(2) GDPR). We always honour such an objection; nothing is assessed or balanced. The quickest way is the unsubscribe link in every news message. Operational messages about your services are unaffected - they are part of performing the Contract.

Send your request to privacy@hostzone.eu. We will deal with it within one month; in complex cases we may extend that by a further two months and will tell you if we do.

If you believe our processing infringes your rights, you may lodge a complaint with the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, https://uoou.gov.cz.

Article 6 - Cookies and local storage

Our website uses no analytics, tracking or marketing tools and loads no third-party code.

We store only the following items, all of them preferences you chose yourself:

Item	Where	Purpose	Duration
theme	local storage	the light or dark appearance you chose	until deleted
currency	local storage	the currency you chose	until deleted
vat	local storage	whether prices are shown with or without VAT	until deleted
cookieConsent	local storage	a record of your choice in the banner	until deleted
hz_lang	cookie	the language chosen for the redirect from the root address	1 year

These items do not require your consent - the storage is necessary to provide a service you explicitly requested. You can delete them at any time in your browser settings.

Article 7 - Automated decision-making

We carry out no automated decision-making or profiling within the meaning of Article 22 GDPR. Nor do we use automated means when assessing reports of illegal content - a human assesses them.

Article 8 - Security

We have put in place technical and organisational measures under Article 32 GDPR. The servers’ storage media and the backups are encrypted, transmission is protected by TLS, access is limited to authorised persons bound by confidentiality, and individual customers’ data is kept separate. A detailed description is in Annex 2 to the Data Processing Agreement.

Article 9 - Changes to this policy

We may change this policy; changes are governed by Article 40 of the Terms, that is, by notice at least 30 days in advance. This does not apply to updates that merely clarify or supplement the information under Articles 13 and 14 GDPR without changing the purposes, legal bases or retention periods; those we announce by publishing them on this page. The current wording is always available here together with the date of the last update, and we inform customers of substantial changes by e-mail or in the Customer Portal.