Terms of Service for Hosting and Domains

The contract behind every Hostna order: what the service is, what it costs, what you must not do with it, and where liability sits.

These terms govern every service ordered from Hostna. You accept them at checkout, before payment, and no order can be placed without doing so.

1. Who you are contracting with

Your contracting party is KAUFEX (Einzelunternehmen), owner Muhamet Adıgüzel, Ziegelstr. 32b, 32105 Bad Salzuflen, Germany, trading as Hostna. Full details are in the Legal Notice.

These terms apply to consumers and to business customers. Where a clause applies to only one of the two, it says so. A consumer is a natural person entering into the contract for purposes outside their trade, business or profession (§ 13 BGB); everyone else is a business customer (§ 14 BGB).

Your own general terms and conditions do not apply, even where we perform without objecting to them.

2. Services

Hostna provides shared hosting, managed WordPress hosting, email hosting, reseller hosting, virtual private and dedicated servers, domain registration and transfer, TLS certificates, a website builder, and related tools. The specification of each service is the plan description published on this website at the time of your order, together with the configuration you selected.

Hostna supplies infrastructure and platform capacity. Unless a service description says otherwise in as many words, we do not supply, operate, monitor or warrant the applications you install, the code you deploy, the content you publish, or the security posture of any of them. See section 7 and the Shared Responsibility policy.

Where a service runs on a virtual or dedicated server that you administer yourself, administration, patching, hardening, monitoring and backup of that server are yours. We provide the machine, the network and the hypervisor.

We may develop the services further, and may replace a technical component with an equivalent or better one, where this does not reduce the agreed scope of service and is reasonable for you.

3. How a contract comes about

You select a plan and a billing period and place it in the cart.
You create or sign in to a customer account and enter your billing details.
You read the purchase declaration at checkout and confirm each of its statements. The order button stays inoperative until you do, and an order submitted without a complete and current declaration is rejected by the server, not merely by the browser.
You place the order. This is your binding offer.
We accept it by confirming the order in text form or by activating the service, whichever happens first.

The contract language is English. German applies to the /de/ section and to any contract concluded in German. We store the contract text with your order; you can retrieve it at any time in the Client Area.

The purchase declaration is not a formality. It is where you consent to immediate provisioning — and therefore, as a consumer, to the loss of your withdrawal right. Its exact wording is published at Purchase Declaration.

4. Prices, tax and price changes

Prices are those published at the time of the order, in euros. Hostna is a small business within the meaning of § 19 (1) UStG: no VAT is charged and none is shown, so every published price is the final price — for consumers and business customers alike. Each invoice states the exemption in as many words. Should the business become subject to regular VAT, prices shown to consumers will continue to be final gross prices and the change will be announced as section 14 describes.

Setup fees, where a plan has one, are stated separately on the plan and on the invoice, and are charged once.

Domain registration and renewal fees are set by the registry and the registrar. We pass on changes to them with effect from the next renewal period, and tell you before the renewal is charged.

We may adjust recurring prices with at least 30 days notice in text form, with effect from the next billing period. If the increase exceeds general consumer price inflation since the last adjustment, you may terminate the affected service with effect from the date the new price would take effect. We say so in the notice.

Promotional prices and discount codes apply to the first invoice of a new service only, unless the offer says otherwise in as many words. After the discounted first term, the service renews at the regular price published on the plan — which is the price shown next to "renews at" on the plan card and in the Client Area before you order.

Discount codes — what they do and who they are for. A discount code reduces one invoice. It does not change the plan, the billing period, the service, or the price the plan renews at. Where a code is reserved for new customers, the offer says so next to the code everywhere we advertise it, and the order screen tells you before you order whether your account qualifies.

The welcome code WELCOME20 gives 20% off the first invoice of a new service and is for new customers. New customer means an account that has not previously placed an order with us at a price above zero. A Free Hosting plan is billed at zero, so evaluating the free plan first does not use up the code — that is deliberate, and it will not be changed to your disadvantage for an order already placed.

One redemption per customer account. If you hold more than one account, the code applies to the first of them that places a paid order, not to each.
It applies to the first invoice of the service you order with it and to no other invoice — not to a renewal, not to an upgrade, and not to a service you add later.
After the first invoice the service renews at the regular price published on the plan — the figure shown next to "renews at" before you order. That figure does not change because you used a code.
It has no cash value: it is not paid out, not credited to your account balance, not transferable, and not applied to an order already placed.
It is not combined with another code or another promotional price on the same invoice. Where more than one would apply, we apply the one worth most to you.

Because eligibility depends on the account the order is placed from, and an account exists only once you have created one, the code is confirmed when you place the order rather than when you type it into the cart. If the account does not qualify, the order is refused with that reason stated: nothing is charged, nothing is provisioned, and your configuration is kept exactly as it is. The screen then shows the listed price and lets you place the same order at it in one step. We do not charge the listed price against a screen that showed a discounted one.

Where you have already been shown a discounted total and we later find the account did not qualify, that is our error and you keep the price you were shown for that invoice. Where you obtained the discount by giving details you knew to be untrue — a second account, another person's name or address — the position is the one in section 16: we tell you what we found, and you may either pay the difference between what you were charged and the listed price for the service you are using, or end that service, in which case we refund the part of the term you have not used. We do not re-price a paid invoice without telling you first, and we never charge more than the listed price.

We may withdraw a promotional offer, change its conditions, or run a different one, at any time with effect for the future. An order already placed at a discounted price is not affected by a later change.

5. Payment, renewal and late payment

Services are paid in advance for the billing period you selected. An invoice is created in the Client Area and, unless you cancel first, the service renews automatically as described in section 6.

Payment is due on the invoice date. Payment methods are those offered at checkout. We do not store full card details; those are handled by the payment provider you choose.

If a renewal is not paid on its due date — because no payment arrived, a card could not be charged, another payment method failed, or the account balance did not cover it — we send a reminder and the service may be suspended. A service that remains unpaid 7 days after suspension is terminated and its data is deleted. Statutory default interest remains unaffected. Reinstating a suspended service requires the outstanding amount to be settled, and is not possible at all once data has been deleted — invoices and accounting records are kept for their statutory retention periods, the service data is not.

Domains are not suspended: an unpaid domain simply is not renewed and enters the registry expiry process, which we do not control. Redemption after that point, where the registry offers it at all, is charged at the registry redemption fee.

6. Term, renewal, cancellation and data after the end

The initial term is the billing period you selected. After the initial term the contract does not extend by a further fixed term: it continues for an indefinite period, and you may terminate it at any time with one month's notice (§ 309 no. 9 BGB). We may terminate with the same notice. Renewal invoices continue to be issued for periods of the same length as your initial term — that is a prepayment convenience, not a new minimum term. If your termination takes effect inside a renewal period you have already paid, we credit the prepaid amount for the time after the end date, or refund it on request. The initial term itself is not shortened and not refunded.

You can cancel in the Client Area, or — without logging in — through the cancellation page at Verträge hier kündigen / cancel contracts here, which confirms receipt immediately in text form as § 312k BGB requires. Cancellation by email or post to the addresses in the Legal Notice is equally valid; the button and the Client Area are simply the routes we can attribute and confirm fastest.

The right of both parties to terminate for good cause without notice remains unaffected. Good cause exists in particular where you materially breach the Acceptable Use Policy, where you are in default with a significant payment despite a reminder, or where continuing the contract would expose us to legal liability.

After a service ends — by cancellation, by non-payment or by termination for cause — your data on it is deleted. Export what you need before the end date. We do not guarantee that any copy survives the end of the contract, and a backup we happen to hold is not a service you can rely on. See section 9.

7. What you are responsible for

The account, everything done under it, and everything stored or published through it are yours. In particular you are responsible for:

the content you publish, transmit or store, and its legality in Germany and in every jurisdiction you target;
the applications, themes, plugins, libraries, containers and scripts you install, including keeping them updated and free of known vulnerabilities;
the security of your own systems: strong and unique credentials, two-factor authentication where offered, key management, file permissions, and prompt revocation of access for people who no longer need it;
your own backups — see section 9;
the legal texts your own website needs, including your imprint, privacy notice and cookie banner where the law requires them;
compliance with data protection law for the personal data you process on our infrastructure, for which you are the controller and we are the processor — see the Data Processing Agreement;
the acts of everyone you give access to, including your own customers where you resell.
applying a vendor security update for anything you installed — promptly, and at the latest within 30 days of its release, or taking the affected component offline until you can;
telling us without undue delay, and at the latest 24 hours after you become aware of it, when you suspect that your service has been compromised or is being used to harm someone else;
the data you choose to keep here. Cardholder data, special categories of personal data under Art. 9 GDPR, data on criminal convictions under Art. 10 GDPR, credential databases and key material may only be stored under the conditions in the Shared Responsibility policy — and never at all on shared, WordPress or email plans where that policy says so.

You must not exceed the resource limits of your plan, and must not operate a service in a way that impairs the stability, security or performance of shared infrastructure or of other customers. Where a plan states a fair-use limit, that limit is the specification, not a suggestion.

You must keep the contact details in your account accurate and reachable. Notices sent to the email address on file are deemed received.

These are contractual duties, not advice. Where a loss you suffer was caused or made worse by a breach of them — an unpatched component, a reused or leaked credential, cardholder data kept where this contract does not allow it, a compromise you noticed and did not report — that is taken into account under § 254 BGB when any claim is assessed, and it can reduce a claim to nothing.

8. Acceptable use, and what happens when it is breached

The Acceptable Use Policy is part of this contract. It lists what may not be hosted or done on Hostna infrastructure, including intrusion and attack tooling, cryptocurrency mining, spam, malware, phishing, pornography, gambling, the sale of controlled substances, and — as an absolute prohibition — any depiction of the sexual abuse of children or of non-consensual sexual acts.

Where a breach is established we may, in proportion to what we found and without prior warning where the breach is serious or ongoing:

remove or disable the specific content or process;
suspend the affected service;
terminate every service on the account without notice and close the account;
refuse to enter into a further contract with the same person, household or business, and refuse orders placed from the same payment instrument, address, device or network in an attempt to circumvent that refusal;
block the IP addresses and address ranges used, at the network edge;
preserve the relevant logs, files and account records as evidence;
report the matter to the competent German authorities, and where the material is child sexual abuse material report it to the Bundeskriminalamt immediately and, where identifiable, to the competent authority in the account holder country of residence;
claim damages, including the cost of investigation, of restoring affected systems, of legal advice, and of harm to the reputation of Hostna and of its IP address space.

Amounts already paid are not refunded where a service is terminated for a breach of the Acceptable Use Policy, and the fees for the remainder of the term remain due as damages unless you show that no loss, or a substantially smaller loss, was incurred.

Where the breach caused a third party to bring a claim against us, you indemnify us against that claim and against the reasonable costs of legal defence, unless you are not responsible for the breach. We will tell you about a claim before settling it and give you the opportunity to defend it.

9. Backups and data loss

Backups are your responsibility. Keep a current, tested copy of your data outside Hostna infrastructure.

Some plans include an automated backup as a convenience feature. Where they do, it is exactly that: a convenience. It runs on a stated schedule, it has a stated retention window, it is stored on the same platform, and it may be incomplete, out of date or unrecoverable — for instance where the loss also affected the storage holding it, where a database was being written to during the snapshot, or where the data was already corrupted or encrypted when the snapshot was taken. It does not substitute for your own backup, and no restore is warranted.

Where we do restore data as a goodwill measure, that is a voluntary act and creates no obligation to do so again.

Where a claim relates to lost or damaged data, our liability is limited to the cost of recovering that data from backup material you maintained properly. Practically: if you kept a backup, the exposure is the effort of putting it back. If you did not, there is nothing to restore from and nothing to recover.

10. Attacks, availability and third-party failures

The internet is not a controllable environment. Hostna is not liable for interruption, degradation, data loss or disclosure caused by events outside our reasonable control, including denial-of-service attacks, network-level attacks on us or on our upstream providers, intrusion into your application or your credentials, exploitation of a vulnerability in software we do not supply, registry and registrar outages, certificate authority failures, routing incidents, power and cooling failures at a data centre, natural events, war, and acts of authorities.

Where an attack against one service threatens the stability of shared infrastructure we may null-route or otherwise isolate that service until the attack subsides. We tell you when we do, and why.

Availability targets, planned maintenance and the credit that applies when a target is missed are in the Service Level and Availability policy. No availability figure is promised anywhere else on this website, and marketing copy is not a service level.

Nor do we warrant that our own systems cannot be attacked successfully. We maintain the measures described in the Shared Responsibility policy and in section 6 of the Data Processing Agreement, and we keep them current — but no operator of any system can warrant a result, and we do not pretend to. Nothing on this website, in a plan description, in a feature list or in support correspondence is a guarantee within the meaning of § 443 BGB unless it says so in as many words and is given in text form by the owner of the business.

If an incident on our side affects your service or the personal data you hold on it, we tell you without undue delay: what we know at the time, what we are doing, what we cannot yet say, and what you should do. We give you what you need for your own duties under Art. 33 and 34 GDPR, and we preserve the evidence. We do that as a matter of course, before anybody has decided whose fault anything was.

11. Liability

We are liable without limitation for damage arising from injury to life, body or health caused by a breach of duty on our part or by our legal representatives or agents; for damage caused intentionally or by gross negligence; under the German Product Liability Act; and to the extent we have given a guarantee.

For slight negligence we are liable only where a material contractual obligation is breached — an obligation whose fulfilment makes the proper performance of the contract possible in the first place, and on whose fulfilment you may regularly rely. In that case liability is limited to the loss typical for this type of contract and foreseeable at the time it was concluded.

Any further liability for slight negligence is excluded. This applies in particular to loss of profit, loss of production, loss of anticipated savings, loss of goodwill, and claims brought by third parties.

For business customers, liability for a slightly negligent breach of a material contractual obligation is additionally limited, per event of loss, to the amount paid for the affected service over the twelve months preceding the event, and in the aggregate over a contract year to twice that amount.

Strict liability for defects existing at the time a rental-type contract was concluded, under § 536a (1) BGB, is excluded.

The limitations above apply equally to the personal liability of our employees, representatives and agents.

No guarantee of security, of availability, or of freedom from attack has been given, and none is to be inferred from the marketing description of a plan or from a security-adjacent feature it lists. Where liability nevertheless arises out of an incident on our infrastructure, it arises only where a duty of care was breached; the measures we maintain under the Shared Responsibility policy are the standard against which that is judged.

Contributory responsibility under § 254 BGB applies in full. Where your own breach of section 7 caused a loss or made it larger — an unpatched component, a compromised credential, data stored contrary to section 7, a compromise reported late — the claim is reduced accordingly, and may be reduced to nothing.

Tell us in text form about a loss you intend to claim for, within 30 days of learning of the loss and of the circumstances behind it. Late notice does not extinguish a claim; but where it stopped us from limiting the loss, that consequence is yours under § 254 BGB. Where you are not a consumer, claims for a slightly negligent breach become time-barred one year after the statutory limitation period begins to run; the unlimited-liability cases in the first paragraph of this section, and claims arising from a fraudulently concealed defect, keep the statutory period.

None of this reduces what German law does not permit us to reduce. Where a limitation in this section would be void, the statutory position applies to that point alone and the rest of the section stands.

12. Free plans

Free Hosting is a real plan with published limits — the Free Hosting page and its limits page say what is included and what happens at each limit. It has no expiry date and no countdown. It comes without an availability target and with best-effort support: we answer, after paying customers. Because you provide personal data to obtain it, the statutory rules for digital services provided against data (§§ 327 ff. BGB) apply to it; nothing in this section takes a right away that those rules give you.

One free plan is available per natural person and per household. Registering additional email addresses, identities, payment instruments or addresses in order to hold more than one free plan, or to regain one after it was withdrawn, is a breach of these terms and of the Acceptable Use Policy.

The details you give when signing up must be true and current — your own name, your own address, an email address you control. A free plan obtained with false or borrowed identity details is void and is closed on discovery without notice; where false details were given in order to obtain a service of value, the matter may be reported.

A free plan is activated by a person, not by a script. Before activating one we may verify identity, email address, telephone number or address, and we may decline an application without giving reasons — a decision that is never based on nationality, ethnic origin, language or a similar characteristic. A free plan is activated, and stays active, only on an account that carries a confirmed email address, a telephone number and a complete postal address whose postal code matches the stated city. The Client Area shows exactly which of these is still missing. Free plans are available in the countries our country policy allows; customers in the EU and EEA, the United Kingdom and Switzerland are never excluded on account of their country.

Changes to the plan (§ 327r BGB). We may change what the free plan includes — a limit, a feature, the software behind it — only for a valid reason: a change in the law or in case law; a change in the technical environment, such as a PHP version reaching its end of life or a change at the control panel or datacenter; a measurable abuse or cost problem the plan as it stands cannot absorb; or the need to keep the free plan consistent with the paid plans it leads to. A change never costs you anything. We tell you in text form, to the address on file, at least 30 days before it takes effect, saying what changes and why. Where a change more than insignificantly reduces what you can do with the plan, you may end the plan free of charge within 30 days of receiving the notice — or of the change, if that comes later — and take your content with you; the notice says so and says how.

Withdrawing the plan. We may discontinue the free plan as a whole for the same reasons, with at least 60 days of notice in text form to the address on file. The notice period is there so that you can move to a paid plan, move elsewhere, or download your content.

Inactivity. The free plan has no expiry date; it has an inactivity rule. If nobody signs in to the Client Area for six consecutive months, we send a notice to the address on file. If there is still no sign-in thirty days after that notice, the free plan and its content — files, database, mailbox — are deleted. A sign-in resets the count. This is the only way a free plan ends without a breach and without a notice under the paragraphs above.

Suspension and termination for cause follow section 8, with the notice section 8 provides and without notice where section 8 allows it. Section 9 (backups) applies in full: the free plan includes no backup service, and content deleted under this section cannot be restored.

Rewards. Months earned in the rewards programme described on the Free Hosting page are credit, not time: each is one month of Pro Hosting at its list price, taken off an invoice when you move to a paid plan. They do not extend the free plan, which has no expiry to extend; they are not paid out, not transferable and not applied to an order already placed. An account holds at most twelve unused months at a time. Every claim is checked by a person and may be refused with a reason; a claim based on a review is judged on whether the review is genuine, never on whether it is favourable.

13. Withdrawal, cancellation and refunds

Digital services are provisioned immediately, which is what almost every customer wants. The consequence, for a consumer, is that the statutory 14-day withdrawal right lapses once the service has been fully provided — but only where you expressly consented to immediate performance and acknowledged that consequence. That is exactly what the purchase declaration at checkout asks you to do.

Because of that, and because the capacity, licences and registry fees behind an order are committed at once, Hostna does not refund services already provisioned and does not operate a money-back guarantee.

The full picture — what the withdrawal right is, when it survives, when it does not, what is never refundable, and the model withdrawal form — is in the Cancellation, Withdrawal and Refund policy. Nothing in these terms takes away a statutory right you have not validly waived.

Withdrawing is not the same as cancelling for the future. Ordinary cancellation under section 6 is always available — in the Client Area or through the cancellation page.

14. Changes to these terms

We may change these terms where the change is necessary because of a change in the law, in case law, or in the technical or economic conditions of the service, or in order to close a gap. We notify you in text form at least 30 days before the change takes effect.

The change takes effect unless you object before that date. We say so in the notice, together with your right to terminate the affected service with effect from the same date. If you object, the contract continues on the previous terms and either side may terminate it at the end of the current billing period.

15. Governing law, place of performance and jurisdiction

German law applies, excluding the UN Convention on Contracts for the International Sale of Goods. For a consumer habitually resident in another country, this choice of law does not deprive them of the protection of mandatory provisions of the law of that country.

The place of performance is 32105 Bad Salzuflen.

Where you are a merchant, a legal entity under public law or a special fund under public law, or where you have no general place of jurisdiction in Germany, the exclusive place of jurisdiction for all disputes arising from this contract is 32105 Bad Salzuflen. We may also sue at your general place of jurisdiction.

16. Identity and address verification (fraud prevention)

Hosting bought with stolen payment details or invented identities harms the cardholder, other customers who share the infrastructure, and the reputation of our network. We therefore verify who we are contracting with — routinely in the small ways described elsewhere in these terms (a confirmed email address, a telephone number, a postal address whose postal code matches its city), and, on specific grounds, with documents.

Specific grounds are, in particular: a payment dispute or chargeback; a payment instrument, address or device already linked to fraud or to an Acceptable Use investigation; address details that fail verification; an order pattern typical of card testing; a sanctions-screening match; or a lawful request by an authority. Where such a ground exists, we may ask you to verify your identity, your address, or your control of the payment instrument, and to do so within a stated period of not less than 7 days.

Acceptable evidence is a government-issued identity document (identity card, passport, driving licence), a recent utility bill or bank statement as proof of address, or a confirmation of the payment instrument, as we specify case by case. Documents are transmitted through the Client Area ticket system, are processed only for the verification itself, and are deleted once verification is complete, as described in the Privacy Policy.

Until verification is completed we may suspend provisioning of new services and freeze credit balances on the account. If verification is refused or the period expires, we may terminate the affected contracts for good cause. Amounts already paid for services consumed, and committed third-party costs such as registry fees and licences, are not refunded; in all other respects your statutory rights, including mandatory consumer rights, remain unaffected.

Where verification shows that services were obtained with a stolen payment instrument or a false identity, we report the matter to the competent German authorities and, where the conduct is criminal there, to the competent authorities of your country of residence, and we preserve the relevant records as evidence.

17. Switching provider and taking your data with you (EU Data Act)

Hosting is a data processing service within the meaning of Regulation (EU) 2023/2854 (the Data Act), so the switching rights of its Chapter VI apply to every paid Hostna service. In plain words: you can leave, you can take your data with you, and we may not make either difficult.

You may terminate in order to switch to another provider, or to your own infrastructure, at any time under section 6 — our one-month notice is shorter than the two-month maximum the Data Act allows, and no switching fee is charged. From 12 January 2027 switching charges are prohibited outright; we already charge none.
Exportable data covers everything you put on the service and everything the service holds for you: website files, application code, databases as standard SQL dumps, mailbox content over IMAP or as archive files, DNS zone records, and domain transfer authorisation codes. Export is available self-service through the control panel; where a format is not reachable there, we provide it on request within the transition period.
Formats are open, structured and machine-readable. We do not impose technical, contractual or organisational obstacles to switching, and we provide reasonable assistance during a transition period of up to 30 days from the end of the contract where you request it before the end date.
What we cannot move: assets owned by third parties on their own terms — a domain follows the registry's transfer procedure, an issued TLS certificate is not transferable, and licences bought for the service end with it.

After the end of the contract and any requested transition period, section 6 applies: the data on the service is deleted. The Data Act gives you a right to get your data out; it does not turn a terminated service into an archive.

18. Severability

If a provision of these terms is or becomes invalid, the validity of the remaining provisions is unaffected. The invalid provision is replaced by the statutory rule.