Privacy policy

This English translation is provided for information only. Only the German version is legally binding.

With this privacy policy we inform you, in accordance with Art. 13 and 14 of the General Data Protection Regulation (GDPR), about which personal data we process when you visit our website, contact us or use our services (web hosting, email mailboxes, domains, web design), for what purposes and on what legal basis this takes place, how long we store the data and what rights you have.

Contents: 1. Controller · 2. Principles · 3. Hosting and server logs · 4. Cookies · 5. Contact · 6. Orders and customer account · 7. Performance of contracts · 8. Domains · 9. Payment and invoices · 10. Support · 11. Termination and withdrawal · 12. Data processing agreement · 13. Data in your websites and mailboxes · 14. Emails · 15. Recipients · 16. Third countries · 17. Storage period · 18. Data security · 19. Your rights · 20. Right to lodge a complaint · 21. Mandatory information, no automated decisions · 22. Minors · 23. Changes

1. Controller

The controller responsible for data processing within the meaning of Art. 4(7) GDPR is:

Hostgarten – Webhosting & Webdesign
Proprietor: Georgios Tassoúlas
Heilbronner Strasse 1
10779 Berlin
Germany
Telephone: +49 (0)30 367 469 74
Email: info@hostgarten.de

For all questions about data protection and for exercising your rights, you can reach us directly at datenschutz@hostgarten.de or at the address above. We are not required to appoint a data protection officer under Art. 37 GDPR and § 38 BDSG (German Federal Data Protection Act), as fewer than 20 persons in our business are constantly engaged in the automated processing of personal data and our core activities do not involve particularly extensive or high-risk processing.

2. Principles of our data processing

Personal data is any information relating to an identified or identifiable person, such as name, address, email address or IP address. We only process the data required for the respective purpose and delete it as soon as the purpose no longer applies and no statutory retention obligations prevent deletion.

• No tracking, no advertising: We do not use any third-party analytics or statistics services (e.g. Google Analytics; our own cookie-free visitor statistics are described in section 3), advertising or marketing cookies, social media plug-ins, map or video services, or fonts from third-party servers. We deliver all components of the website – including fonts, icons and scripts – from our own server.
• No disclosure for advertising purposes: We do not sell any data and do not pass it on to third parties for advertising purposes.
• Search engine verification: Our pages may contain a verification code for Google Search Console or Bing Webmaster Tools. This is purely text in the source code; it does not cause any data to be transmitted to Google or Microsoft when our pages are accessed.

The most important legal bases are: Art. 6(1)(a) GDPR (consent), (b) (contract and pre-contractual measures), (c) (legal obligation, e.g. retention for tax purposes) and (f) (legitimate interests). For each processing operation, we state the specific legal basis below.

3. Hosting, server logs and connection security

Hosting service provider

This website and the hosting and email services we offer are operated on servers of STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin. The servers are located in data centres in Germany. We have concluded a data processing agreement with STRATO in accordance with Art. 28 GDPR; STRATO processes the data exclusively on our instructions.

Server logs

Each time our website is accessed, the web server automatically processes the following access data and stores it in log files: IP address of the requesting device, date and time of access, address accessed (URL) and request method, HTTP status code, amount of data transferred, the previously visited page (referrer, if transmitted by your browser) and information about the browser and operating system (user agent).

We need this data in order to deliver the website, to ensure stable and secure operation, to analyse faults and to detect and fend off attacks (e.g. mass login attempts). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in secure and functional operation. The data is not combined with other data sources or evaluated for marketing purposes. The logs are deleted after 30 days at the latest, unless further retention is necessary to investigate a specific security incident; in that case, we delete them once the incident has been resolved.

Visitor statistics without cookies

To find out which pages are read and how visitors find us, we count page views on our own server. We do not set any cookies, store nothing on your device and do not store IP addresses. Only daily totals are stored: the page viewed (without personal parts of the address), language, device type (computer, tablet or smartphone), the referring website or search engine (only its name, e.g. “Google”) and the first page viewed. So that a visitor is only counted once per day, we form a check value from the IP address and browser identifier using a random key that changes daily and is then discarded. This check value does not allow any conclusions to be drawn about you, cannot be linked to other days and is deleted after 48 hours. If your browser sends the “Do Not Track” or “Global Privacy Control” signal, we only count the page view. Logged-in staff and automated access (search engines, bots) are not counted. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in designing our website according to demand. The daily totals are deleted after 25 months and are not passed on to third parties.

Technical error logs

If a technical error occurs in our application, we store an error message with the time and the function affected. As a matter of principle, passwords, access keys and payment data are not recorded in it. These logs serve to correct errors (Art. 6(1)(f) GDPR) and are deleted automatically after 90 days.

Encryption

All connections to our website, to the customer area and to our mail servers are encrypted using TLS. You can recognise an encrypted connection by “https://” in the address bar and the padlock symbol in your browser.

4. Cookies and similar technologies

Cookies are small text files stored by your browser. We exclusively use cookies that are strictly necessary for the operation of the website and for the functions you have expressly requested. Under § 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG), no consent is required for this. That is why we do not display a cookie banner. The cookies are not transmitted to third parties and are not used for tracking:

• HOSTGARTEN_SID – session cookie. Maintains your session (e.g. login to the customer area, protection of forms against misuse, temporary storage of form entries). It is deleted when you close your browser.
• lang – stores the website language you have chosen. Storage period: 12 months.
• hg_remember – is only set if you select “Stay logged in” when logging in. It contains a random key (not a password) that recognises you. Storage period: 30 days; it is deleted when you log out.

The legal basis for the processing associated with the cookies is Art. 6(1)(b) GDPR, insofar as it serves the use of the customer area, and otherwise Art. 6(1)(f) GDPR (language, protection of forms). You can delete or block cookies in your browser at any time; without the session cookie, however, it is not possible to log in to the customer area or to submit forms.

For our own staff only, the administration panel stores a setting for the display of the menu in the browser’s local storage. Visitors and customers are not affected by this.

5. Contact form, email and telephone

If you write to us via the contact form, we process your name, your email address, the topic selected, your message and, on a voluntary basis, your telephone number and company. If you contact us by email or telephone, we process the information you provide to us in doing so. We use this data exclusively to process and answer your enquiry. After submitting the form, you will receive an automatic acknowledgement of receipt at the email address provided.

The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to an existing contract or is aimed at concluding a contract, and otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in answering the enquiries addressed to us.

Protection against spam and misuse

We do not use external services such as reCAPTCHA to protect our forms. Instead, the forms contain a check field that is invisible to humans, a time check and a small calculation task that your browser solves automatically. In addition, we limit the number of requests per sender. For this purpose, we store your IP address only as a non-reversible check value (hash). We log rejected attempts without their content (date, form, reason, check value) to obtain an overview of attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting our systems and our customers against spam and misuse.

Storage period

We remove the check value of the IP address for contact enquiries after six months, and logs of rejected attempts after 13 months. We delete messages identified as spam after 30 days. We delete your enquiry itself once it has been finally dealt with and no statutory retention obligations apply; if it leads to a contract or constitutes a business letter, the periods set out in section 17 apply.

Online consultations

If you book a consultation via our website, we process your name, email address, your phone number for phone appointments, optionally your company and message, as well as the topic, date, time and language of the appointment. We use this to hold the appointment and to send you a confirmation with a calendar file, a reminder the day before and, where applicable, the link to the video call (Art. 6(1)(b) GDPR – pre-contractual measures at your request). To protect against misuse, we store a non-reversible check value of your IP address. For video calls, the privacy notice of the service the link leads to also applies. We delete the appointment data 12 months after the appointment unless a contract results from it.

6. Orders and customer account

For ordering our services and managing your contracts, a customer account is created – through your registration, as part of an online order or by us at your request (invitation by email). In doing so, we process:

• master data: form of address/name, where applicable company and VAT identification number, address, information as to whether you are ordering as a consumer or a business, customer number;
• contact data: email address, telephone number (voluntary), preferred language;
• access data: your password, which we store exclusively as a secure hash (never in plain text), and – if you activate two-factor login – the associated key in encrypted form as well as hashed recovery codes;
• order and contract data: selected plans, domains, terms, prices, time of order, your confirmations (e.g. regarding the General Terms and Conditions and the withdrawal policy) and the contract status.

The purpose is the initiation, conclusion, performance and invoicing of the contracts as well as your access to the customer area. The legal basis is Art. 6(1)(b) GDPR.

When you register, you confirm your email address via a link that we send you (double opt-in). This ensures that nobody creates an account using someone else’s address. Confirmation, invitation and password links are only valid for a limited time and are automatically deleted once they expire.

We log security-relevant events in your account (e.g. logins, failed login attempts, password and email changes) with the time and the IP address as a non-reversible check value, in order to protect your account against misuse and to be able to trace incidents (Art. 6(1)(f) GDPR). These entries are deleted after 24 months.

You can view and change your details in the customer area at any time. If you would like your account to be deleted, a message to us is sufficient; any ongoing contracts must have ended for this. Data that we are required to retain for legal reasons will be restricted from any other use until the respective period has expired.

Refer a customer

If you take part in our referral programme, you receive a personal voucher code and link. You pass on the link yourself – we do not contact anyone. If someone orders using your code, we store the link between your customer account and the new customer account as well as the status of the credit in order to assign the credit to you and to prevent misuse (e.g. referring yourself) (Art. 6(1)(b) and (f) GDPR). In the customer area you only see the number and status of your referrals, no data about the people referred. We keep this information together with the billing records and delete it afterwards.

7. Performance of contracts: hosting, email and web design

To provide our services, we process the data required for this purpose: access data for web space, databases, FTP/SFTP and email mailboxes (passwords stored as a hash or encrypted), technical settings, usage data such as storage space used, and, in the context of web design projects, the content, texts, images and access data that you provide to us for implementation, as well as the related coordination. The legal basis is Art. 6(1)(b) GDPR.

In order to restore data after faults, we regularly back up the data of the hosting packages. The backups are overwritten on a rolling basis, after 14 days at the latest (Art. 6(1)(b) and (f) GDPR).

8. Domains

When we register, transfer or manage a domain for you, we transmit the required data of the domain holder and the contact persons (in particular name or company, address, email address and telephone number) to the registrar we have engaged – currently IONOS SE, Elgendorfer Straße 57, 56410 Montabaur – and to the registry responsible for the respective extension, for “.de” domains to DENIC eG, Theodor-Stern-Kai 1, 60596 Frankfurt am Main. For other extensions, the registry may be based outside Germany (see section 16). The legal basis is Art. 6(1)(b) GDPR; without this information, registration is not possible under the rules of the registries.

The registries process the data under their own responsibility and, in accordance with their policies, generally no longer publish holder data in public lookup services (WHOIS/RDAP). Details can be found in the privacy notices of the respective registry, for “.de” at denic.de/datenschutz.

If you check on our website whether a domain is still available, our server queries the domain name in the registry’s public lookup service (RDAP). Only the domain name is transmitted, not your IP address or any other information about you.

9. Payment, invoices and claims

For invoicing, we process billing and payment data: billing address, invoice numbers and amounts, service periods, payments received, the payment method chosen and, where applicable, payment reminders. We provide invoices as PDFs in the customer area and send them by email. The legal basis is Art. 6(1)(b) GDPR, and for retention Art. 6(1)(c) GDPR.

Bank transfer

If you pay by bank transfer, we receive from our bank the information transmitted with the payment (name of the account holder, IBAN, amount, payment reference).

Online payment

If you choose an online payment in the customer area, you will be redirected to the page of the respective payment service. That service processes your payment data (e.g. card data or PayPal account) as an independent controller under data protection law. For this purpose, we transmit the invoice number, the amount and your email address and only receive confirmation of the payment (amount, time, transaction ID, status) – never your full card data or access data:

• Stripe (credit and debit cards as well as other payment methods offered): Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Privacy notice: stripe.com/de/privacy
• PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Privacy notice: paypal.com/de/legalhub/privacy-full

The legal basis is Art. 6(1)(b) GDPR. The payment services carry out their own checks to prevent fraud; these are their responsibility.

Late payment

If an invoice remains unpaid despite a reminder, we process the data required to enforce the claim and, in individual cases, pass it on to a lawyer or to the courts (Art. 6(1)(b) and (f) GDPR; legitimate interest in enforcing our claims). We do not carry out credit checks with credit agencies.

10. Support requests

For enquiries about existing contracts, we offer support tickets in the customer area. We store your messages, our replies, the time and the processing status so that we can deal with your request and trace earlier matters. The legal basis is Art. 6(1)(b) GDPR. If you share access data with us in a ticket, we use it only for the respective task; please change such passwords once the task has been completed.

11. Termination and withdrawal via the website

Via the pages “Cancel contracts here” and “Withdraw from contract here”, you can terminate contracts online at any time or, as a consumer, declare your withdrawal. In doing so, we process your name, your email address, your customer number if applicable, the contract concerned, the type and time of the declaration and any voluntary information (e.g. a message or a reason for termination) in order to execute the declaration and to confirm its receipt to you immediately by email, stating the date and time. The legal basis is Art. 6(1)(b) and (c) GDPR in conjunction with § 312k BGB or the statutory requirements for the electronic withdrawal function. We retain the declarations as evidence until the end of three years after the end of the year in which the contract ends (regular limitation period); if a declaration constitutes a business letter, the longer periods set out in section 17 apply.

12. Data processing agreement (DPA)

If you conclude our data processing agreement in the customer area, we store as evidence the version of the agreement, the time, the contracting party with its address at the time of conclusion, the person acting and the IP address as a non-reversible check value. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 28(3) and (9) GDPR. We retain this evidence for the duration of the main contract and thereafter until the limitation periods have expired.

13. Data in your websites and mailboxes

If you operate a website, a shop or email mailboxes on our servers, personal data of your visitors, customers or correspondents is stored in the process (e.g. form entries, orders, emails, server logs of your website). You yourself are the controller for this data within the meaning of the GDPR; we process it exclusively as your processor in accordance with Art. 28 GDPR and on your instructions, in particular for storage, delivery and backup. The details are governed by our data processing agreement, which you can conclude in the customer area.

Incoming emails are automatically checked to protect against spam and malware (e.g. sender verification, virus and spam filters). The content is not read by humans in the process. Messages identified as spam are flagged or moved to a spam folder.

14. Emails from us

We send you emails insofar as they are necessary for the contract or your enquiry, e.g. confirmations, access data links, invoices, payment reminders, notices of maintenance work or expiring domains, and replies to your enquiries (Art. 6(1)(b) GDPR). We do not send advertising emails or a newsletter. The emails are sent via our own mail server at STRATO in Germany, with transport encryption where the receiving server supports it.

We keep a dispatch log of emails sent, without their content (recipient address, subject, type of message, time, delivery result), in order to be able to prove delivery and correct errors (Art. 6(1)(f) GDPR). The log is deleted after twelve months.

15. Recipients and processors

Within our business, only those persons who need your data for their tasks are given access to it; access to our administration system is restricted by roles and permissions and secured with two-factor login. Outside our business, your data is only received by:

• our hosting service provider STRATO AG as processor (section 3);
• the registrar and the registries for domains (section 8);
• the payment services Stripe and PayPal as well as our bank, insofar as you use these payment methods (section 9);
• our tax advisers, who as professionals bound by professional secrecy are obliged to maintain confidentiality, in the context of bookkeeping and tax obligations (Art. 6(1)(c) GDPR);
• authorities, courts and lawyers, insofar as we are legally obliged to do so or it is necessary for the establishment, exercise or defence of legal claims;
• freelancers engaged in the context of web design projects, only to the extent necessary and after they have been contractually bound to confidentiality and data protection.

16. Transfers to third countries

Our servers are located in Germany; as a rule, no processing takes place outside the European Union or the European Economic Area. Exceptions:

• Stripe and PayPal may transfer data to affiliated companies in the USA. These are certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR); in addition, standard contractual clauses of the European Commission are used (Art. 46(2)(c) GDPR).
• For domains with extensions whose registry is based outside the EU (e.g. “.com”, “.net”), the transfer of the holder data to that registry is necessary for registration (Art. 49(1)(b) GDPR).

17. Overview of storage periods

• Server logs: 30 days; technical error logs: 90 days;
• Visitor statistics: check value 48 hours, daily totals 25 months;
• Consultations: 12 months after the appointment;
• session cookie: until the browser is closed; language cookie: 12 months; “Stay logged in”: 30 days;
• contact enquiries: until they have been finally dealt with, spam 30 days, IP check value 6 months; log of rejected form attempts: 13 months;
• customer account security log: 24 months; email dispatch log: 12 months;
• customer account and contract data: for the duration of the business relationship, thereafter until the limitation periods have expired (generally three years from the end of the year, § 195 BGB);
• invoices, accounting vouchers and annual financial statements: eight or ten years in accordance with the applicable provisions; commercial and business letters and other documents relevant for tax purposes: six years (§ 147 AO, § 257 HGB, § 14b UStG); the period begins at the end of the calendar year in which the document was created;
• content of the hosting packages and mailboxes: up to 30 days after the end of the contract (see General Terms and Conditions), backups on a rolling basis no later than 14 days thereafter.

18. Data security

In accordance with Art. 32 GDPR, we take appropriate technical and organisational measures to protect your data against loss, manipulation and unauthorised access. These include in particular: TLS encryption of all connections, storage of passwords exclusively as a hash, encryption of particularly sensitive access keys, two-factor login for our administration system (and optionally for your customer account), a role and permission concept, limitation of login attempts, regular security updates and backups, and data centres with access control in Germany. We continuously review and improve these measures.

19. Your rights

You have the following rights vis-à-vis us with regard to the personal data concerning you:

• Access to the data processed by us and a copy of it (Art. 15 GDPR);
• Rectification of inaccurate data or completion of incomplete data (Art. 16 GDPR);
• Erasure of your data, insofar as there is no statutory obligation to retain it and the data is not required for the establishment, exercise or defence of legal claims (Art. 17 GDPR);
• Restriction of processing (Art. 18 GDPR);
• Data portability – receipt of the data you have provided to us in a structured, commonly used and machine-readable format (Art. 20 GDPR);
• Withdrawal of consent with effect for the future, without affecting the lawfulness of the processing carried out up to that point (Art. 7(3) GDPR).

Right to object under Art. 21 GDPR: Insofar as we process your data on the basis of Art. 6(1)(f) GDPR (legitimate interests), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

To exercise your rights, an informal message to datenschutz@hostgarten.de or by post is sufficient. To ensure that your data does not fall into the wrong hands, we may ask you to prove your identity if there is any doubt. We will reply without undue delay and in any event within one month (Art. 12(3) GDPR).

20. Right to lodge a complaint with a supervisory authority

If you believe that the processing of your data infringes data protection law, you may, without prejudice to any other remedy, lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The authority competent for us is: Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information), Alt-Moabit 59–61, 10555 Berlin, datenschutz-berlin.de. However, we would appreciate it if you contacted us with your concern first.

21. Mandatory information and no automated decisions

Our website can be used without providing any personal data. To conclude and perform a contract, we require the information marked as mandatory fields in the forms; without it, we cannot conclude the contract or provide the service. Otherwise, there is no obligation to provide the data. No exclusively automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

22. Minors

Our services are aimed at persons of full age and at businesses. Persons under the age of 18 may not conclude contracts with us or transmit personal data to us without the consent of their parents or guardians.

23. Changes to this privacy policy

We adapt this privacy policy when our services, the service providers we use or the legal situation change. The version published on this page at the relevant time applies. We additionally inform our customers by email of any material changes affecting existing contracts.