This English version is a translation provided for convenience. Only the German version is legally binding; if the two versions differ, the German version prevails.

Privacy Policy

Version draft-2026-10-20

This policy informs you under Art. 13 and 14 of the General Data Protection Regulation (GDPR) which personal data we process when you visit our Shop at https://webhosting.1.wien, create a customer account, order from us and use our hosting services.

1. Controller

[to be added], [to be added] [to be added], [to be added]
E-mail: [to be added]
Telephone: [to be added]

We have not appointed a data protection officer because we are not required to (Art. 37 GDPR). For all data protection questions you can reach us at [to be added].

2. What this policy covers – and what it does not

This policy covers data that we process for our own purposes: visits to the Shop, customer account, order, contract, payment, invoice, support.

It does not cover data that our customers store in their hosting (websites, databases, mailboxes). We process that data as a processor on behalf of our customers under Annex 1 of our Terms. If you visit the website of one of our customers or communicate with a mailbox hosted with us, the operator of that website is responsible for your data; please contact them. We forward requests about such data that reach us to the operator.

3. Overview

4. The processing in detail

4.1 Visiting the Shop

When you open the Shop, our server processes the technically necessary data: IP address, time, requested address, amount of data transferred, browser identifier and the previously visited page. We need this data to deliver the pages, fend off attacks and find errors (legitimate interest, Art. 6(1)(f) GDPR). Our application logs are designed not to contain personal data in clear text and are deleted after 14 days.

The Shop runs through the network of Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). Cloudflare forwards requests to our server, protects it against attacks and overload, and delivers static files faster. In doing so, Cloudflare processes the connection data mentioned above on our behalf (data processing agreement under Art. 28 GDPR). Cloudflare also tells us from which country a request comes (see 4.5). The legal basis is our legitimate interest in a secure and fast Shop (Art. 6(1)(f) GDPR). For the transfer to the USA see section 6. Cloudflare only concerns the Shop and the customer area, not the websites and mailboxes of our customers.

4.2 Cookies

We only use cookies that are strictly necessary. We do not need consent for them (§ 165(3) TKG 2021). We use no analytics, advertising or tracking cookies and do not embed third-party services that set such cookies.

When you pay on Stripe’s page (checkout.stripe.com), Stripe sets its own cookies, among other things for fraud prevention. Stripe is responsible for these; information is available at https://stripe.com/at/legal/cookies-policy.

4.3 Customer account

You need a customer account to order and to manage your contracts. We store your e-mail address, your password exclusively as a cryptographic hash, on request the secret for two-factor sign-in together with recovery codes (encrypted), your language and your active sign-in sessions. We send you an e-mail to confirm your address. The legal basis is the performance of the contract or of pre-contractual steps (Art. 6(1)(b) GDPR). If you delete your account or the business relationship ends, we anonymise the account data as soon as no retention obligation applies any longer; issued invoices keep the details they contain (section 7).

4.4 Order and contract

For the order and the contract we process your name, the company name if applicable, your address, country, optionally your telephone number, whether you order as a consumer or a business, your VAT ID or registration or tax number, the chosen plan, the domain or free address, and the contract data (term, termination, withdrawal). The legal basis is Art. 6(1)(b) GDPR.

In the order process we also store which declarations you made (acceptance of the Terms, consent to electronic invoicing, any request for an early service start), with the exact wording, the version of the documents, the time and your IP address. This allows us to prove that we fulfilled our information obligations under the Austrian Distance and Off-Premises Contracts Act (FAGG) (Art. 6(1)(c) and (f) GDPR).

4.5 VAT: place of supply and VAT ID check

For consumers in the EU we must charge the VAT of the country in which they live and keep evidence of it (Art. 24b, 24f and 63c of Implementing Regulation (EU) 282/2011). For this we process:

• the country of your billing address;
• your IP address and the country derived from it. We receive the country from Cloudflare. If this is missing, we determine it on our own server from a locally stored database of DB-IP (Eris Networks S.A.S., France); no data is transmitted to DB-IP;
• the issuing country of your card or the country of your IBAN, which we receive from Stripe (for eps: Austria).

If these details contradict each other, a staff member reviews your order before we accept it. The legal basis is Art. 6(1)(c) GDPR.

If you give a VAT ID as a business, we check it through the VAT Information Exchange System (VIES) of the European Commission. We transmit your VAT ID and our own; VIES replies with the validity and, where available, the name and address registered for the number, and a consultation number. We keep the result as evidence for the tax exemption (Art. 6(1)(c) GDPR in conjunction with § 11 UStG and Art. 18 Implementing Regulation 282/2011).

4.6 Payment

We process payments through Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). You enter your card or account details directly on Stripe’s payment page; they never reach our servers. From Stripe we only receive identifiers, the payment method, for cards the brand, last four digits, expiry date and issuing country, for SEPA the last four digits of the IBAN, the country and the mandate reference, as well as the payment status and a risk assessment. We transmit to Stripe your name, e-mail address, billing address, language and the amount.

Stripe processes this data partly as our processor and partly as an independent controller, in particular to detect and prevent fraud, to comply with legal obligations (such as anti-money-laundering rules) and to improve its services. Stripe’s privacy policy applies to these purposes: https://stripe.com/at/privacy.

For us, the legal basis is the performance of the contract (Art. 6(1)(b) GDPR), Art. 6(1)(c) GDPR for retention and our legitimate interest (Art. 6(1)(f) GDPR) for fraud prevention. If you pay by card or SEPA Direct Debit, Stripe stores the payment method for automatic recurring payments; you can change or remove it in the customer area at any time.

4.7 Fraud prevention

Hosting is often misused for fraud, for example for phishing pages paid for with stolen payment details. To protect us, our customers and third parties, we use the following measures (legitimate interest, Art. 6(1)(f) GDPR):

• Stripe automatically assesses every payment for fraud risk. Stripe declines payments with very high risk or a wrong card security code. Orders with elevated risk or contradictory country information (4.5) do not go through automatically but are reviewed by a staff member before we accept or decline them.
• We limit the number of orders and payment attempts per account and per IP address. After more than five failed payments on one day we automatically lock the customer account for new orders and for sign-in. We reject sign-ups with e-mail addresses from disposable-address providers.
• We only set up the hosting once you have confirmed your e-mail address and, for a first payment by SEPA Direct Debit, only after it has been credited.

If your account or order is affected, you can contact us at [to be added]. A staff member will then review the case personally; you can state your point of view and contest the decision (section 9).

4.8 Invoices, accounting and tax reporting

We issue an invoice for every payment and a credit note for refunds. We use the data for accounting, the VAT return, the recapitulative statement (reverse charge) and the One-Stop-Shop (OSS) return. The legal basis is Art. 6(1)(c) GDPR in conjunction with § 11 UStG, § 132 BAO and the OSS rules. We transmit the data to the tax office and, where applicable, to our tax adviser.

4.9 Payment reminders and dunning

If a payment is open, we process the data on the amount, payment attempts and dunning stage and send you reminders and dunning notices (Art. 6(1)(b) and (f) GDPR). The procedure is described in § 9 of our Terms.

4.10 E-mails about your contract

We send you e-mails necessary for the contract: confirmations, invoices, payment and security notices, information on the term and changes. We do not send advertising e-mails. We send the e-mails through our own mail server in Vienna; we do not use an external e-mail service provider. We store when an e-mail was accepted by our mail server and its identifier (Message-ID), because we must be able to prove, for example, that we provided you with the contract confirmation on a durable medium (Art. 6(1)(b) and (c) GDPR).

4.11 Withdrawal and termination

If you make a declaration through our pages “Withdraw from contract here” or “Cancel contracts here” or in the customer area, we store your name, your contract details, your e-mail address, the wording of the declaration, the time, your IP address and your browser identifier. We need this data to match the declaration to your contract, to send you an acknowledgement of receipt (§ 13a FAGG) and to be able to prove timeliness (Art. 6(1)(b), (c) and (f) GDPR).

4.12 Support and complaints

If you contact us by e-mail or telephone, we process your details to handle your request (Art. 6(1)(b) GDPR, or (f) for requests unrelated to a contract).

4.13 Notices of unlawful content and abuse

If you notify us of unlawful content or abuse, we process your name, your e-mail address and the content of the notice in order to review it, to inform you of receipt and of our decision, and to take measures where appropriate (Art. 6(1)(c) GDPR in conjunction with Art. 16 and 17 DSA, and (f)). We only disclose your name to the customer concerned if this is necessary to clarify the matter and your interests do not prevail.

4.14 Security and accountability

We log administrative actions in our system (such as issuing invoices or changes to contracts) so that they remain traceable; the log contains no passwords, IBANs, keys or card data. Our servers log sign-in attempts and automatically block addresses after repeated failures. The legal basis is Art. 6(1)(c) GDPR (Art. 32 GDPR) and (f) (protection of our systems).

4.15 Enforcement of rights and disclosure obligations

We also process data where necessary for the establishment, exercise or defence of legal claims (Art. 6(1)(f) GDPR). We disclose data to courts, authorities and third parties only within the scope provided by law, for example under § 13 of the Austrian E-Commerce Act (Art. 6(1)(c) GDPR).

5. Recipients

• Cloudflare, Inc. (USA) – protection and delivery of the Shop; processor (4.1).
• Stripe Payments Europe, Limited (Ireland) and its affiliates, in particular Stripe, LLC (USA) – payment processing; partly processor, partly independent controller (4.6).
• Hohl IT e.U. (“Alwyzon”), Floridsdorfer Hauptstraße 1, 1210 Vienna – operator of the servers on which the Shop and our database run (data centre in Vienna); processor.
• Hetzner Online GmbH, Gunzenhausen, Germany – storage of backup copies; processor.
• European Commission (VIES) – VAT ID check (4.5).
• Tax authorities – tax returns and reports (4.8); where applicable our tax adviser, who is bound to confidentiality.
• Banks and payment service providers, where necessary for payments and refunds.
• Let’s Encrypt (Internet Security Research Group, USA) – receives our customers’ domain names for TLS certificates; these are published in public Certificate Transparency logs. The same applies to webhosting.1.wien for our own Shop.
• Courts, authorities, legal representatives – where provided by law or necessary to enforce rights (4.15).

We send our contract e-mails through our own mail server; they are delivered to the mail server of your e-mail provider.

6. Transfers to third countries

Cloudflare, Inc. and Stripe, LLC are established in the USA. Both are certified under the EU-US Data Privacy Framework; transfers to them are covered by the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR). In addition, both have agreed to the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR). Cloudflare may process connection data in data centres outside the EU, including in the USA. Let’s Encrypt (ISRG) only receives domain names and technical data (section 5).

7. How long we keep data

We keep data as long as we need it for the respective purpose and then delete or anonymise it. For the most important data:

• Invoices and accounting: § 132 BAO requires seven years from the end of the calendar year, longer as long as the documents are relevant to pending tax proceedings. For supplies to consumers in other EU member states that we declare through the One-Stop-Shop, we must keep the records for ten years from the end of the year of the supply (Art. 369k of VAT Directive 2006/112/EC, Art. 63c Implementing Regulation 282/2011). We keep all invoices, credit notes and the related order, payment and tax evidence uniformly for ten years. Where this goes beyond the seven years of § 132 BAO and no OSS obligation applies, we rely on our legitimate interest (Art. 6(1)(f) and Art. 17(3)(e) GDPR) in being able to defend ourselves against tax reassessments: the authority’s right to assess a tax becomes time-barred at the latest ten years after it arose (§ 209(3) BAO).
• Evidence of contract conclusion (confirmations in the order process, withdrawal and termination declarations): together with the order, ten years.
• Customer account: until deleted; then anonymised unless one of the periods above is running.
• Server and security logs: at most four weeks; application logs 14 days.
• Technical event data from Stripe (without personal data): 90 days.
• If proceedings are pending or claims have been asserted, we keep the necessary data until they are concluded.

8. Do you have to provide data?

We need the details marked as mandatory in the order process to conclude the contract and for the invoice and VAT required by law. Without them we cannot conclude a contract. The telephone number is optional.

9. Automated decisions

We only take decisions based solely on automated processing with legal or similarly significant effects (Art. 22 GDPR) in the following cases, which are necessary for entering into and performing the contract (Art. 22(2)(a) GDPR):

• Stripe automatically declines payments with very high fraud risk or a wrong card security code.
• After more than five failed payments on one day we automatically lock the customer account for new orders and sign-in.

The logic: Stripe assesses payments based on characteristics of the payment and the device and on experience from its entire network; our own lock only counts failed payments. The consequence is that the payment or further orders are not possible for the time being. You have the right to obtain human intervention by a staff member, to express your point of view and to contest the decision: write to [to be added]. All other decisions on orders with elevated risk are taken by a human (4.7). There is no profiling for advertising purposes.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where we process data on the basis of our legitimate interest, you may object at any time on grounds relating to your particular situation (Art. 21). Please contact [to be added]. We reply within one month and may ask for proof of your identity.

11. Complaint to the supervisory authority

If you believe that we process your data unlawfully, you can lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde): Barichgasse 40–42, 1030 Vienna, telephone +43 1 52 152-0, e-mail dsb@dsb.gv.at, https://www.dsb.gv.at. You can also contact the supervisory authority of the EU member state in which you live or work. We would appreciate it if you contacted us first.

12. Data security

We protect your data through technical and organisational measures under Art. 32 GDPR, in particular encrypted transmission (HTTPS), separate system users, two-factor sign-in for our staff, restricted access and regular security updates. A description is in Schedule 1a of our Terms.

13. Attribution

IP geolocation by DB-IP (https://db-ip.com), licensed under Creative Commons Attribution 4.0 International (CC BY 4.0).

14. Changes

We adapt this policy when our processing or the law changes. The current version is available in the Shop at https://webhosting.1.wien/en/privacy.