GDPR Policy

Effective from

October 1, 2026

1. DATA CONTROLLER

Controller: Jiří Viták, Company ID: 21766177, Ametystová 702/46, 153 00 Prague 16 – Radotín, Czech Republic.

Contact for privacy matters: [email protected] (alternatively [email protected]), phone +420 910 114 397. We have not appointed a data protection officer because we are not obliged to do so under Article 37 GDPR.

Data you store in your own services (for example a game server's player database, website content or data on a VPS) is processed by us as a processor on your behalf. That processing is governed by the Data Processing Agreement at billing.blazehost.cz/terms/dpa.

2. PURPOSES AND LEGAL BASIS OF PROCESSING

Personal data is processed for the performance of the service contract under Article 6(1)(b) GDPR, for accounting and tax obligations under Article 6(1)(c) GDPR, for system security, fraud and abuse prevention and the defence of legal claims under the legitimate interest basis in Article 6(1)(f) GDPR, and for analytics and the support chat on this website only with your consent under Article 6(1)(a) GDPR.

Processed data may include: account data (username, email, password hash, two-factor authentication data), billing details (name or company, address, Company ID, VAT ID), payments and receipts (amount, date, payment method, transaction identifier and payer details passed to us by the payment gateway), data about ordered services (parameters, assigned IP addresses, domain names), IP addresses and login and session records, support tickets, records of consents with the Terms of Service, and abuse reports.

Inquiry forms on this website (VPS, dedicated servers, server housing): we process the details you enter, the time of submission and technical data (IP address where available, browser identifier) to answer the inquiry and prepare an offer, i.e. steps taken at your request before entering into a contract (Article 6(1)(b) GDPR), and to protect the form from abuse (Article 6(1)(f) GDPR).

We do not send marketing newsletters. We do not carry out automated decision-making or profiling with legal effects.

3. RETENTION PERIOD

Account and service data: for the lifetime of the account; after the account is closed it is deleted, except for the data listed below.

Payments, receipts and withdrawal or refund requests: 10 years (tax records under Act No. 586/1992 Coll., on income taxes, and the period for assessing tax under the Tax Code).

Records of consents (Terms of Service, request to start a service before the withdrawal period expires): for the lifetime of the account and 4 years after it is closed.

Security and activity audit logs: 365 days; application logs: 14 days; abuse reports: 3 years after they are resolved.

Encrypted database backups: data of a deleted account may remain in backups for up to approximately 12 months before the oldest snapshot is removed.

Inquiries sent through the forms on this website: deleted automatically no later than 2 years after submission; if the inquiry leads to a contract, the data becomes account and service data.

Data processed with your consent on this website (analytics, support chat) is processed until you withdraw consent or for the retention period set by the respective tool. The detailed retention table is part of the full Privacy Policy.

4. RECIPIENTS AND PROCESSORS

Processors acting on our instructions: firstcolo Datacenters GmbH (FRA4 datacentre, Frankfurt am Main, Germany – colocation of our own servers), dataforest GmbH (Kriftel, Germany – connectivity and DDoS protection), Cloudflare, Inc. (network layer in front of our web services), Google Ireland Limited (Google Workspace – company email and service emails), an encrypted backup storage provider in the EU/EEA, and – if form bot protection is enabled – Google reCAPTCHA or Cloudflare Turnstile. On this website, with your consent: Google Ireland Limited (Google Analytics) and Crisp IM SAS (France – support chat).

Independent controllers: payment gateways that you choose for a payment – GOPAY s.r.o., Stripe Payments Europe, Ltd., PayPal (Europe) S.à r.l. et Cie, S.C.A., Mollie B.V., NOWPayments (cryptocurrency payments) and MercadoPago, depending on what the client area currently offers; NameSilo, LLC and domain registries (domain registration); Discord Inc. (only if you connect your Discord account).

Data may also be disclosed to public authorities where the law requires it and to our legal or tax advisers bound by confidentiality. We have processing agreements in line with Article 28 GDPR with our processors.

5. TRANSFERS TO THIRD COUNTRIES

Data on the servers running our services and the backups of the client area database remain in the EU. The servers are located in the firstcolo FRA4 datacentre in Frankfurt am Main, Germany.

Some recipients may process data outside the EEA: Google LLC, Cloudflare, Inc. and Discord Inc. (USA) on the basis of the European Commission adequacy decision for the EU-U.S. Data Privacy Framework (Article 45 GDPR); Stripe and PayPal through their European companies, which secure transfers within their groups themselves (Data Privacy Framework or standard contractual clauses); NameSilo, LLC (USA), NOWPayments (Saint Vincent and the Grenadines) and MercadoPago (Latin America) where the transfer is necessary to perform the contract you choose – domain registration or payment by that method (Article 49(1)(b) GDPR).

If you consent to analytics cookies, Google Analytics processes pseudonymised usage data, which may be transferred to Google LLC in the USA under the EU-U.S. Data Privacy Framework (Article 45 GDPR). A copy of the relevant safeguards is available on request.

6. DATA SUBJECT RIGHTS

You have the right to access your personal data, to rectification, erasure and restriction of processing, to data portability, to object to processing based on legitimate interest, and to withdraw consent at any time with effect for the future.

We handle requests without undue delay, at the latest within one month (in complex cases extendable by two further months), via [email protected].

You may lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz, or with the supervisory authority of your EU member state of residence or work.

7. SECURITY

We protect data with appropriate technical and organisational measures, in particular encrypted transfer (HTTPS), password hashing, encryption of sensitive access data, role-based access control, mandatory two-factor authentication for staff, audit logging, encrypted backups and regular updates. If a security breach poses a high risk to your rights, we will inform you.

8. COOKIES

Necessary cookies keep the website working and remember your settings, such as the chosen currency and your cookie choice. They do not require consent.

With your consent (Article 6(1)(a) GDPR), given separately for each purpose, we also use Google Analytics to measure traffic (it stores a pseudonymous identifier in your browser; the data is pseudonymised, not anonymous) and the Crisp chat for customer support. Neither script is loaded before you make a choice, and each is loaded only if you allow its category ("Accept all" or "Customize").

You can withdraw or change your consent at any time using the "Cookie settings" link in the website footer.

9. FINAL PROVISIONS

These principles become effective on October 1, 2026. The full Privacy Policy is available at https://billing.blazehost.cz/terms/privacy. We will inform you about material changes by email or in the client area.