Scope
This policy applies to customers who order domains, hosting, VPS, dedicated servers or SSL certificates from WebHostFlow and is part of our terms of service. Data collected when you simply visit webhostflow.eu is covered by our privacy policy.
Controller and processor
For your account, order and billing data we are the controller. For the websites, files, databases, mailboxes and other personal data you store on our hosting or servers, you are the controller and we are your processor under Article 28 GDPR. We process that content only on your instructions and access it only to deliver the service, handle your support request or a security incident, or when the law requires it. Our staff are bound to confidentiality. You can request a data processing agreement at privacy@webhostflow.eu.
Data we collect
Your name, email address and billing details, what you ordered and when, and the payment result reported by Stripe. We never receive your card details; they go directly to Stripe. We also keep support correspondence and server logs (IP address, time, request, status) for security, abuse investigation and fixing errors.
Purposes and legal bases
Order, payment and service data: performance of the contract (Art. 6(1)(b) GDPR). Invoices and accounting records: legal obligation under tax and accounting law (Art. 6(1)(c)). Logs and abuse prevention: our legitimate interest in a secure platform (Art. 6(1)(f)). Optional processing, such as website analytics, only with your consent (Art. 6(1)(a)), which you can withdraw at any time.
Who receives data
Stripe processes payments. For domain registration we pass the required holder details to the registry and registrar; where registry rules require it, some of them appear in public WHOIS or RDAP data. For SSL certificates the certificate authority receives the data needed for validation. Our infrastructure is in the EU. We do not sell personal data.
Retention
Server logs: up to 90 days. Backups: 14 days. Account and billing data: for the term of the contract and then as long as tax and accounting law requires. When your contract ends, we delete the content on your hosting or servers, and remaining copies disappear as backups roll off within 14 days.
Security
Data travels over TLS-encrypted connections. Access to systems and customer data is restricted to authorised staff. Daily backups are kept on separate infrastructure. If a personal data breach occurs, we notify the data protection authority within 72 hours and inform affected customers without undue delay.
The customer area on this website
The customer area on webhostflow.eu currently keeps your account, profile, password hash and orders only in your browser. It is never sent to us, we cannot see or recover it, and clearing site data deletes it. It is not real authentication, so do not store anything sensitive there.
Your rights and contact
You have the right to access, rectification, erasure, restriction, objection and portability, and to withdraw consent. Write to privacy@webhostflow.eu; we answer within one month. Requests about data you host with us go to you as controller, and we help you answer them. You may also complain to the data protection authority of your country.