Privacy Policy
Last updated: 2026-10-31
Overview
This Privacy Policy explains which personal data HetrixHosting processes when you visit our website and use our services, for what purposes and on what legal basis this happens, and which rights you have. It applies to our website hetrixhosting.com, our client area and our hosting services.
Controller
Controller within the meaning of Art. 4(7) GDPR:
HetrixHosting (sole proprietorship)
Owner: Yves Habelt
Gilcherweg 10b, 22393 Hamburg, Germany
Email: [email protected]
Customer Account, Orders and Contract Performance
When you create a customer account and order or use services, we process:
• Master data: name, address, email address and, where provided, telephone number
• Access data: username and password or, if you sign in with Google or Discord, the ID of that account (see Sign-In with Google or Discord)
• Contract and billing data: booked services, invoices and payment status; we do not receive or store full card details, these are processed solely by the payment providers
• Usage data of your services: e.g. IP addresses, access and activity logs and resource consumption
We process this data to perform the contract, in particular to provide, manage and bill your services and to send you contract-related notices. The legal basis is Art. 6(1)(b) GDPR. Where we retain data because of tax law obligations, the legal basis is Art. 6(1)(c) GDPR. We also analyse logs to detect and prevent abuse and attacks; the legal basis for this is our legitimate interest in the security of our services (Art. 6(1)(f) GDPR).
Providing master, access and billing data is required to conclude a contract. Without this data we cannot enter into a contract with you.
Visiting the Website and Server Log Files
When you visit our website, we automatically process technical data transmitted by your browser: IP address, date and time of access, page accessed, referrer URL, browser type and operating system. This data is required to deliver the website and to ensure its security and stability.
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and stable operation of the website. Server log files are deleted automatically after seven days and are not combined with other data.
Contact and Support
When you contact us by email, via the support portal or by other means, we process the information you provide (e.g. name, email address, content of your request and, where relevant, details of your services) in order to handle your request.
The legal basis is Art. 6(1)(b) GDPR where your request relates to a contract or pre-contractual steps, and otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in answering your request. We delete the data once the request has been fully resolved, unless statutory retention obligations apply.
Online Withdrawal Form
If you declare a withdrawal via our online form, we process the data entered there (name, email address, product ID or order number, date of contract conclusion and, if provided, the reason for withdrawal) as well as the IP address from which the form was submitted. We use this data to process the withdrawal, to confirm receipt to you by email and to document the declaration.
The legal basis is Art. 6(1)(c) GDPR in conjunction with Section 356(1) BGB (processing and confirming the withdrawal), and for the IP address Art. 6(1)(f) GDPR; our legitimate interest lies in being able to prove the declaration and in protecting the form against abuse. We store the data until the limitation period for claims under the contract concerned has expired and beyond that where statutory retention obligations apply.
Service Providers
Hetzner Online GmbH
Industriestr. 25, 91710 Gunzenhausen, Germany. Our servers are operated in Hetzner data centres in Germany. Hetzner processes the data stored there as a processor under Art. 28 GDPR. Privacy policy: https://www.hetzner.com/de/legal/privacy-policy
Cloudflare
Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare protects our website against attacks, checks suspicious requests and delivers content via a content delivery network. In doing so, Cloudflare processes in particular IP addresses and technical connection data. We also use Cloudflare Web Analytics to evaluate loading times and use of our website in aggregated form. No cookies are set for this, but technical data about the page view (e.g. page accessed, referrer, browser and device information and loading times) is transmitted to Cloudflare. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure, fast and stable operation of the website. Privacy policy: https://www.cloudflare.com/privacypolicy/
Stripe
Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Stripe processes card payments and the data required for them. The legal basis is Art. 6(1)(b) GDPR. Privacy policy: https://stripe.com/privacy
PayPal
PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. PayPal processes PayPal payments and the data required for them. The legal basis is Art. 6(1)(b) GDPR. Privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full
Trustpilot
Trustpilot A/S, Denmark. We use Trustpilot to collect and publish customer reviews. If you submit a review on Trustpilot, Trustpilot processes your data under its own terms: https://legal.trustpilot.com/for-reviewers/end-user-privacy-terms
Recipients and Disclosure
We do not sell personal data. We only disclose data where this is necessary to perform the contract (e.g. to payment providers), where we use service providers as processors, where we are legally obliged to do so (e.g. towards authorities) or where you have given your consent.
Transfers to Third Countries
Some service providers are based in the USA or transfer data there, in particular Cloudflare and Stripe, as well as Google and Discord if you sign in with their accounts. Where the recipient is certified under the EU-US Data Privacy Framework, the transfer is based on the European Commission’s adequacy decision (Art. 45 GDPR). Otherwise we base transfers on the European Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR).
Retention Period
We store personal data only for as long as necessary for the respective purpose:
• Website server log files: seven days
• Customer account and contract data: for the duration of the customer relationship; after the customer account has been deleted only where statutory retention obligations apply
• Invoices and other tax-relevant records: for the statutory retention periods, in particular under Section 147 AO (up to ten years)
• Support requests: until they have been fully resolved, unless retention obligations apply
• Server data of terminated services: see End of Contract and Data Deletion
Your Rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR).
Right to object: Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.
An email to [email protected] is sufficient to exercise your rights.
Right to Lodge a Complaint
You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
Hamburg Commissioner for Data Protection and Freedom of Information
Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany
Website: https://datenschutz-hamburg.de
Data Security
We protect your data with technical and organisational measures, in particular encrypted transmission via SSL/TLS (recognisable by “https://” in your browser’s address bar), limiting access to what is necessary and operating our servers in data centres in Germany. However, nobody can guarantee completely secure transmission of data over the internet.
Minors
Persons under the age of 18 may only conclude contracts with us with the consent of their parents or legal guardians (see Minors and Customer Data). We process the data of minor customers in the same way as that of other customers in order to perform the contract (Art. 6(1)(b) GDPR).
If we request proof of consent, we additionally process the details of the parent or guardian (e.g. name, email address and their confirmation). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in being able to prove that a valid contract has been concluded. If consent is refused, we delete the data unless legal obligations prevent this.
Changes to This Privacy Policy
We update this Privacy Policy when our data processing or the legal situation changes. The version published on this page applies.