Privacy Policy

What personal data Hostna processes, on what legal basis, who receives it, and the rights you have over it.

This notice covers visiting hostna.com, contacting us, holding a customer account, and ordering a service. It is written to meet Art. 13 and 14 GDPR.

1. Controller

Controller: KAUFEX (Einzelunternehmen), owner Muhamet Adıgüzel
Address: Ziegelstr. 32b, 32105 Bad Salzuflen, Germany
Email: privacy@hostna.com
Telephone: +49 1520 5383642

No data protection officer is appointed. The threshold in § 38 (1) BDSG — at least 20 people constantly engaged in automated processing — is not met. Address privacy requests directly to the contact above.

This notice covers data for which Hostna is the controller. For the personal data inside your own hosting account — your visitors, your customers, your mailboxes — you are the controller and we act on your instructions as processor. That relationship is governed by the Data Processing Agreement.

2. Visiting the website

Every request is recorded in a server log: the address requested, the date and time, the volume transferred, the referrer, the browser and operating system reported, and the IP address. The purpose is secure and fault-free operation and the defence of attacks. The legal basis is our legitimate interest, Art. 6 (1) (f) GDPR. Logs are kept only as long as operation and fault-finding require, and are not merged with other sources.

The connection is TLS-encrypted throughout.

3. Cookies and consent

Technically necessary cookies are set so that the site works; § 25 (2) TDDDG allows that without consent. Everything else stays off until you accept it: Google Consent Mode is initialised with every non-essential storage type denied before any tag runs, so no analytics or advertising cookie is written until you say yes.

Your answer is stored for 180 days in a cookie of our own. Withdraw it by deleting this site's cookies in your browser; the banner then asks again. Details are in the Cookie Policy.

4. Analytics

With your consent we use Google Analytics, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to measure which pages are opened and how visitors arrive. Personal data may be transferred to Google servers including in the United States; Google LLC is certified under the EU-US Data Privacy Framework. The legal basis is your consent, Art. 6 (1) (a) GDPR, and Art. 49 (1) (a) GDPR for the transfer. You may withdraw it at any time with effect for the future.

5. Contacting us

When you write, call or send a form we process what you give us in order to answer. The legal basis is Art. 6 (1) (b) GDPR for pre-contractual enquiries and Art. 6 (1) (f) GDPR otherwise. We keep enquiries until the purpose is exhausted or you ask for deletion; statutory retention periods are unaffected.

If you contact us on WhatsApp, the message travels through WhatsApp Ireland Limited and is subject to their terms and their privacy policy as well as ours. Message content is end-to-end encrypted, but the fact and time of contact, and your phone number, are visible to the operator. Use email or the Client Area instead if you would rather not involve a third party — and never send account credentials or payment details over any messaging channel.

6. Customer account and orders

To open an account and run a contract we process your name, address, email address, telephone number, company and VAT details where given, the services you hold, invoices, payments, support tickets, and the login and action records of the account. The legal basis is Art. 6 (1) (b) GDPR, and Art. 6 (1) (c) GDPR for the commercial and tax records we are required to keep.

Accounting records are retained for the statutory periods — generally eight years for invoices under § 147 AO in the version applicable from 2025, and ten years where a longer period applies. Data not caught by a retention duty is deleted when the contract relationship ends and open claims are settled.

7. Consent records at checkout

When you place an order we store the purchase declaration you confirmed: which statements you accepted, the version of the policies in force, the time, your IP address and your browser identification. This is how we can later show that immediate provisioning was requested and that the consequence for the withdrawal right was acknowledged, as § 356 (4) and (5) BGB require. The legal basis is Art. 6 (1) (c) GDPR together with our legitimate interest in being able to prove the transaction, Art. 6 (1) (f) GDPR. These records are kept for the limitation period of claims arising from the contract.

The same applies to two related records: a cancellation submitted through the cancellation page is stored with its timestamp and the confirmation we sent, as § 312k (4) BGB presumes in your favour; and an expressly concluded Data Processing Agreement is stored with the accepted version, account, time and IP, as Art. 28 (9) GDPR requires in electronic form.

8. Payment

Payment data is collected and processed by the payment provider you select at checkout. We receive confirmation of payment and the data needed for the invoice; we never store full card numbers. The provider is an independent controller for its own processing and its privacy notice applies in addition to this one. Bank transfer details reach us through our bank.

9. Domain registration

Registering or transferring a domain requires us to pass the registrant details you provide to the registrar and, through them, to the registry responsible for the top-level domain, and where applicable to ICANN. This is a legal and contractual requirement of the domain system; the legal basis is Art. 6 (1) (b) and (c) GDPR. Depending on the top-level domain, some of these details may be published in a public WHOIS or RDAP record. Our registrars are ResellerClub and Internet.bs; registries are located worldwide, so a transfer to a third country can be unavoidable for a given extension.

10. Email we send you

Service email — order confirmations, invoices, expiry notices, maintenance and security notifications — is sent on the basis of the contract, Art. 6 (1) (b) GDPR, and cannot be unsubscribed from while you hold a service. Newsletters and product announcements are sent only with your consent, Art. 6 (1) (a) GDPR, and every one of them carries an unsubscribe link. Mail is delivered through our own mail infrastructure in Germany.

11. Recipients and processors

Hetzner Online GmbH, Gunzenhausen, Germany: Data centre and infrastructure. Processing takes place in Germany. Processor under Art. 28 GDPR.
Payment provider selected at checkout: Payment processing. Independent controller for its own processing.
ResellerClub, Internet.bs, registries and ICANN: Domain registration and administration. Recipients under Art. 6 (1) (b) and (c) GDPR; third-country transfer possible depending on the extension.
Google Ireland Limited: Website analytics, only after consent. Processor under Art. 28 GDPR.
Tax adviser, auditor and, where required, authorities: Statutory accounting and reporting duties.

We do not sell personal data and do not pass it on for advertising by third parties.

12. Abuse handling and security logs

To investigate an abuse report or a security incident we process access logs, mail logs, account records and, where necessary and proportionate, the files on the affected service. Where a report concerns criminal content we preserve the relevant records and pass them to the competent authority. The legal basis is Art. 6 (1) (c) and (f) GDPR and, for content moderation, the Digital Services Act.

Verification documents. Where the Terms of Service let us require identity or address verification (section 16 — fraud prevention, abuse investigation, sanctions compliance), the documents you provide — identity card, passport, driving licence, a utility bill or bank statement as proof of address, or a payment-instrument confirmation — are processed solely to carry out that verification. The legal basis is Art. 6 (1) (c) and (f) GDPR. The documents are stored access-restricted, are never used for any other purpose, and are deleted within 30 days of the verification being completed — unless a statutory retention duty or an open legal dispute requires a specific document to be kept, in which case it is deleted when that reason ends. Address plausibility at signup (does the postal code match the city?) is checked against a public postal dataset on our own server; no address data is sent to a third party for this check.

Refusal list. Where an account is closed for a breach of the Acceptable Use Policy or for fraud, we keep the minimum needed to recognise a further attempt by the same person: name and postal address, a one-way hash of the email address, a fingerprint of the payment instrument, the IP address range used, and the reason and date of the decision. The legal basis is Art. 6 (1) (f) GDPR — our interest, and the interest of every other customer sharing the same infrastructure, in not having the same abuse repeated from a new account. It is kept for three years from the decision and then deleted, unless a legal dispute or a statutory retention duty requires a specific record to be kept longer. You can object under Art. 21 GDPR, and a person will look at the decision again.

13. Automated decision-making

We do not use automated decision-making producing legal effects on you within the meaning of Art. 22 GDPR, and we do not profile you. Automated filters flag suspicious activity for review, but the decision to suspend or terminate is taken by a person.

14. Your rights

access to the data we hold about you (Art. 15 GDPR);
rectification of inaccurate data (Art. 16 GDPR);
erasure (Art. 17 GDPR), subject to retention duties;
restriction of processing (Art. 18 GDPR);
data portability (Art. 20 GDPR);
objection to processing based on legitimate interest (Art. 21 GDPR);
withdrawal of any consent, with effect for the future (Art. 7 (3) GDPR).

An informal message to privacy@hostna.com is enough. We may ask you to identify yourself before answering, so that we do not disclose your data to somebody else.

15. Complaints

You may complain to a data protection supervisory authority. The competent authority for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2-4, 40213 Düsseldorf.

16. Changes

We update this notice when the services we use or the legal position change. The version published here is the one that applies.