Privacy Policy
Who is responsible
Controller: WebOsHost, Jan Altinkhof 31, 9646 DL Veendam, the Netherlands (KvK 42005368; VAT NL003073218B79). Use the info@weboshost.com contact form for privacy questions.
What we process and why
| Data | Purpose | Proposed lawful basis |
|---|---|---|
| Name, address, email, telephone, account login data | Set up accounts, deliver hosting and support | Contract or steps requested before a contract |
| Orders, invoices, payment status and transaction reference | Charge for services, issue records and resolve disputes | Contract and legal accounting duties |
| Contact messages and support tickets | Answer enquiries and maintain requested support | Contract or legitimate interest in responding |
| IP address, login history, security and operational logs | Protect services, investigate abuse, detect incidents | Legitimate interest in security; applicable legal duties |
| Domain registration contact details | Submit registration/transfer requests and comply with registry rules | Contract and any applicable registry/legal requirement |
| Site preferences and necessary session data | Keep the site and sign-in working | Necessary service operation |
| Optional analytics identifiers | Measure usage only after an affirmative choice | Consent; withdrawal through Cookie preferences |
The exact categories and grounds must reflect every enabled product and processing operation. We do not sell customer account data. Do not enter sensitive personal data into a support request unless necessary.
Hosted customer content
Customers decide what is stored on their sites, mailboxes and databases. Where we process personal data solely to provide hosting on a customer's instructions, that customer is generally the controller and WebOsHost the processor. The responsibilities, security measures, subprocessors, transfer rules and deletion/return assistance belong in a separate Article 28 GDPR data processing agreement (DPA). This website privacy notice does not substitute for a DPA. Contact us to arrange the required separate agreement before storing third-party personal data in a service for which we act as processor.
Who may receive data
Only authorized staff and providers needed to operate the selected service receive relevant data. Depending on the product these may include the infrastructure provider (Hetzner), registrar/registry (including Nextname when configured), payment processors (such as Mollie or PayPal), and anti-bot service (Cloudflare Turnstile). These services are involved only when needed for the selected product. Where a transfer outside the EEA occurs, we describe the transfer mechanism and appropriate safeguards before that transfer. We disclose data to authorities only where legally required.
Cookies and analytics
Necessary session and security cookies support the site, forms and account access. A Google Analytics measurement script is optional: our public site does not load it until you actively choose "Accept All" and a privacy notice has been published. "Essential Only" keeps the optional script off. You can revisit Cookie preferences in the site footer and withdraw consent; the site stops loading analytics and attempts to remove first-party analytics cookies. Any further non-essential technology is subject to the same consent rules. Analytics is disabled until a measurement ID is configured.
How long we keep data
We keep each category no longer than necessary, subject to legal accounting duties, active contracts, reasonable security retention and the rights of others. The panel's default retention schedule includes audit logs (730 days), login history (365 days), closed tickets (1095 days), failed jobs (30 days), search logs (90 days) and sessions (7 days). Customer content may survive temporarily in backups after service cancellation under the agreed backup and purge schedules. Financial records are retained for the period required by applicable law. Ask through the contact form for the current retention period of a particular category.
Your rights and safeguards
You may request access, rectification, erasure where applicable, restriction, portability and object to relevant processing. Where we rely on consent you may withdraw it at any time without affecting prior lawful processing. We verify a requester's identity before releasing another person's data and respond within the applicable legal deadlines. You may complain to the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl) or the competent supervisory authority. We use access controls, technical and organizational safeguards and investigate/report personal-data breaches where required by law. Contact us using the verified details above to exercise rights.
We notify you of material changes to this notice and show its effective date and version when published.