This English version is a translation provided for convenience. Only the German version is legally binding; if the two versions differ, the German version prevails.

General Terms and Conditions for 1.wien Webhosting

Version draft-2026-10-20, applicable to contracts concluded on or after [to be added].

§ 1 Scope, contracting party, definitions

1.1 These General Terms and Conditions (“Terms”) apply to all contracts for web hosting services that you conclude with us through the website https://webhosting.1.wien (the “Shop”) and to their performance, including use of the customer area.

1.2 Your contracting party is [to be added], [to be added], [to be added] [to be added], [to be added], e-mail [to be added], telephone [to be added], VAT ID [to be added] (“1.wien Webhosting”, “we”, “us”). Further details are in the imprint.

1.3 In these Terms:

Consumer means a natural person who concludes the contract for purposes outside the operation of their business (§ 1 of the Austrian Consumer Protection Act, KSchG).
Business customer means anyone who concludes the contract for the operation of their business.
Customer or you means consumers and business customers alike, unless expressly distinguished.
Plan description means the description of the chosen plan (features and limits) as shown in the Shop at the time of your order. It is included in the order summary attached to the order confirmation.
Customer area means your password-protected area of the Shop where you manage contracts, invoices and payment methods.
Service start means the day on which our obligation to perform begins (clause 7.2).
Billing period means the period you choose, one month or twelve months, for which the fee is payable in advance.
Billing month means each month from the service start. A billing month begins on the calendar day that corresponds to the day of the service start (or, if that day does not exist in the month concerned, on the last day of that month) and ends on the day before the next billing month begins. Example: service start 19 October 2026; the billing months run from 19 October to 18 November, from 19 November to 18 December, and so on.
Minimum term means the first twelve billing months from the service start.
Text form means a legible declaration on a durable medium, in particular an e-mail.

1.4 We conclude contracts with consumers only if their domicile or habitual residence is in a member state of the European Union. We conclude contracts with business customers regardless of their seat, unless legal restrictions (such as sanctions) prevent it. Only adults with full legal capacity may order.

1.5 Anyone who selects “Business” in the order process confirms that they are concluding the contract for their business and that the business details given (in particular the company name, VAT ID or registration or tax number) are correct.

1.6 General terms and conditions of business customers apply only if we have expressly agreed to them in text form.

1.7 Annex 1 (Data Processing Agreement under Art. 28 GDPR, with Schedules 1a and 1b) and Annex 2 (Information on data export and switching) form part of these Terms. Our privacy policy and the withdrawal policy with the model withdrawal form are separate documents in the Shop.

§ 2 Conclusion of the contract in the Shop

2.1 The presentation of the plans in the Shop is not a binding offer but an invitation to make us an offer.

2.2 The order process consists of the following technical steps:

You choose a plan, the billing period (monthly or annual) and the domain: either your own domain or a free address under webhosting.1.wien (clause 3.3). “Add to cart” places your selection in the cart.
You check your selection in the cart.
You create a customer account (e-mail address and password) or sign in with your existing account.
You enter your billing details: whether you order as a private individual or as a business, your name, the company name if applicable, your address and country and, as a business, your VAT ID or registration or tax number if applicable. We then calculate the final price for your country (§ 8).
The review page shows all details of your order, in particular the plan, billing period, domain, minimum term, cancellation terms and the total price including VAT. There you confirm that you accept these Terms including the data processing agreement and that you agree to electronic invoicing. As a consumer you may additionally request that we start performing before the withdrawal period ends (clause 7.3).
By clicking “Order with obligation to pay” you make a binding offer to conclude the contract.
You are redirected to the payment page of our payment service provider Stripe, where you choose the payment method and pay.

2.3 Until you click “Order with obligation to pay” you can check and correct your entries at any time: the review page shows all entries, and the “Change” links or the steps of the order process take you back to each entry. You can also cancel the order process at any time by closing the browser window.

2.4 We confirm receipt of your order by e-mail without undue delay. This acknowledgement of receipt is not yet an acceptance of your offer.

2.5 The contract is concluded when we accept your offer with an order confirmation by e-mail. We send the order confirmation as soon as we have received your payment: for card payments and eps usually immediately, for SEPA Direct Debit after the amount has been credited, usually within six bank business days. We may accept your offer within ten working days of the order. If we do not accept it within that period, you are no longer bound by your offer. If you do not complete the payment within 24 hours of the order, the order lapses.

2.6 We may decline orders, in particular if the payment fails, details are missing or obviously incorrect, there are indications of misuse or fraud, or the requirements of clause 1.4 are not met. In that case we refund any payment already made to the payment method used without undue delay.

2.7 The contract language is German or English, depending on the language in which you order. These Terms are available in both languages; if they differ, the German version prevails.

2.8 We store the contract text, that is your order data and the version of these Terms valid at the time of the order. With the order confirmation you receive these Terms with their annexes, the withdrawal policy with the model withdrawal form and a summary of your order as PDF files. You can view your orders at any time in the customer area. The current version of the Terms is available in the Shop; we will send you earlier versions on request.

2.9 We have not subscribed to any codes of conduct.

§ 3 Our services

3.1 The scope of our services follows from the plan description and these Terms. It includes in particular storage space, the number of domains, e-mail mailboxes and databases, the available PHP versions, TLS certificates, backups (§ 11) and support.

3.2 We provide your hosting on the day of the service start (clause 7.2), usually within a few hours and at the latest on the following working day. This requires that you have confirmed your e-mail address. You receive your access details by e-mail or in the customer area.

3.3 Free address under webhosting.1.wien. Instead of your own domain you can choose an address of the form name.webhosting.1.wien. The address is part of our domain; you acquire no rights in it, and it is not transferable. It is available to you for the duration of the contract. After the contract ends we block it for 90 days and then release it. We may refuse an address or prohibit its use if it infringes third-party rights, is misleading (for example imitates the name of a bank, authority or brand) or is used for abuse.

3.4 Your own domain. Registering and managing your own domain is not part of our service. You must be the holder of the domain or be authorised by the holder to use it, and you must set the DNS records or name servers as we tell you. We do not check your authorisation. If there are well-founded indications that you are not authorised to use the domain, we may deactivate it in your hosting.

3.5 TLS certificates. For your domains we set up free certificates from the certification authority Let’s Encrypt and renew them automatically. This requires that the domain points to our servers. Issuance also depends on the availability of Let’s Encrypt.

3.6 E-mail. E-mails of your mailboxes are received, stored and sent through our own servers. To protect our systems, our customers and deliverability, we automatically scan incoming and outgoing e-mails for malware and spam and limit the number of outgoing e-mails per unit of time within the limits of the plan description. E-mails identified as malware may be rejected; e-mails identified as spam may be marked.

3.7 Resources and fair use. Our servers are shared by several customers. Technical limits per hosting account apply to computing power, memory, concurrent processes and connections; we set them so that normal websites, online shops and e-mail use within the plan are possible without restriction. “Unlimited” in the plan description means that the number of the units concerned (such as domains or mailboxes) is not limited; the storage space of the plan and the technical limits mentioned still apply. If your use places such a heavy load on the shared resources that other customers are affected, we will inform you and try to find a solution with you, for example by optimisation or a change of plan. To avert an acute impairment we may temporarily limit or stop individual processes; we will inform you of this without undue delay.

3.8 Availability and maintenance. We operate our systems with the care of a diligent hosting provider and endeavour to keep them available with as few interruptions as possible. We do not promise a particular availability rate. Where possible, we carry out planned maintenance between 22:00 and 06:00 (Vienna time) and announce maintenance that is expected to cause an interruption of more than 30 minutes at least 48 hours in advance by e-mail or in the customer area. We may carry out urgent security measures without prior notice. Your statutory warranty rights (§ 13) remain unaffected.

3.9 Support. You can reach us by e-mail and by telephone at the times stated in the Shop, in German or English. Telephone support costs you nothing beyond the charges of your telephone provider. A 24/7 emergency service is not part of the service.

3.10 Your applications. We provide the server environment (web server, PHP, databases, e-mail). You are responsible for the applications you install (such as WordPress, plugins, themes, your own scripts), for keeping them up to date and for their configuration, even if you set them up with an installation tool provided by us, unless we have expressly agreed otherwise.

3.11 Changes to the service. We develop our services further. Beyond necessary updates, we may change the service for one of the following valid reasons: (a) to maintain or improve security, (b) to implement statutory or regulatory requirements, (c) because the manufacturer no longer provides security updates for a piece of software (such as an older PHP version), (d) to replace a function with an equivalent or better one, or (e) because of changes at our suppliers (such as the data centre or the certification authority) that we cannot influence. Such a change does not cause you any additional costs. We inform you about it clearly and comprehensibly. If the change impairs your access to or use of the service more than only slightly, we inform you at least 30 days in advance in text form of the features and the date of the change and of your right to end the contract; we usually announce the withdrawal of a PHP version at least three months in advance. In that case you may terminate the contract free of charge with immediate effect within 30 days after the change (or after receiving the information, if that comes later). We refund fees paid in advance for the period after termination pro rata. For consumers, § 27 of the Austrian Consumer Warranty Act (VGG) applies in addition.

§ 4 Your obligations

4.1 Keep your details in the customer area up to date, in particular your name, address, country, e-mail address and, as a business customer, your VAT ID. Your address and country determine the VAT (§ 8).

4.2 Keep your access details secret and use secure passwords. We recommend two-factor sign-in for the customer area. If you suspect that third parties know your access details, change them immediately and inform us. Persons to whom you grant access act within your sphere of responsibility.

4.3 You are responsible for the content that you store, publish or send through our services. You ensure that you hold the necessary rights to it and that your websites comply with the obligations that apply to them (such as an imprint, a privacy policy and consent for cookies).

4.4 Keep the applications you install up to date and configure them securely. If we notify you of a known security vulnerability in your application, fix it within the reasonable deadline we set.

4.5 Cooperate to a reasonable extent in clarifying faults, in particular on the question whether an error is caused by your own technical environment (such as your application, your device or your internet connection). This cooperation is limited to the technically available means that are least intrusive for you (§ 19(4) VGG).

4.6 The technical requirements on your side are a current web browser, for file transfer a program that supports SFTP or FTPS, for e-mail a program with TLS support (IMAP/POP3 and SMTP), and applications that are compatible with the PHP and database versions offered.

§ 5 Prohibited use

5.1 You must not use our services for unlawful purposes. In particular, it is prohibited

to store, distribute or make available unlawful content, such as child sexual abuse material, terrorist content, criminal incitement, content infringing copyrights, trade marks or personality rights, or unfair or misleading offers;
to send unsolicited messages (spam), in particular bulk e-mails without the consent required under § 174 of the Austrian Telecommunications Act 2021 (TKG 2021), or to advertise content hosted with us through spam sent from other servers;
to operate phishing pages, fake login pages or other content that deceives about the identity of the provider;
to distribute or host malware, to control botnets, or to carry out or prepare attacks on other systems (such as port scans, denial-of-service attacks or guessing other people’s passwords);
to circumvent security measures or resource limits of our systems or to access other accounts or data;
to operate open proxies, anonymisation services, open mail relays or Tor exit nodes;
to use the servers for purposes unrelated to normal website and e-mail use that place an excessive load on shared resources, such as cryptocurrency mining, game servers, permanently running background services, public download mirrors, or using the storage space as a general data or backup archive;
to process data in breach of data protection law.

5.2 You may send newsletters and other bulk e-mails only to recipients who have demonstrably consented (for example through a double opt-in procedure) and only within the sending limits of your plan. You must remove undeliverable addresses from your mailing lists.

5.3 If you culpably breach these obligations, you indemnify us against claims of third parties and the costs of an appropriate legal defence arising from the breach. Towards consumers this applies only within the scope of statutory liability for damages.

§ 6 Notices of unlawful content, abuse and our measures

6.1 Point of contact. Authorities, users and anyone else who wishes to notify us of unlawful content, abuse or security problems can reach us at [to be added] (point of contact under Art. 11 and 12 of Regulation (EU) 2022/2065, the “DSA”). You may write to us in German or English.

6.2 Notices. A notice should contain: an explanation of why the content is unlawful; the exact location (full URL or other unambiguous details); the name and e-mail address of the person giving notice (except in notices concerning child sexual abuse material and comparable offences); and a statement that the person giving notice believes in good faith that the information is accurate and complete. We confirm receipt of a notice if an e-mail address is given and inform the person giving notice of our decision.

6.3 Review. We review notices promptly, diligently, in a non-arbitrary and objective manner. Decisions to block or remove content are always taken by a human. We use automated tools to defend against malware, spam and attacks (malware and spam scanning of e-mails, limits on sending volumes, automatic blocking of IP addresses after repeated failed sign-in attempts). These tools may reject or mark individual e-mails and block connections; they do not block websites.

6.4 Measures. If we become aware of unlawful content or a breach of § 5, we act proportionately and step by step: (a) notice to you with a reasonable deadline to remedy; (b) blocking or removal of individual content, files, scripts or mailboxes; (c) temporary blocking of the website or service concerned; (d) termination for good cause in the case of serious breaches or breaches repeated despite notice (clause 7.10). We act without prior notice only if this is necessary to avert significant harm or to fulfil a legal obligation, for example in the case of active phishing pages, malware being distributed, ongoing spam, attacks from your account, an acute danger to our systems or other customers, or an order of an authority or court. We limit the measure to what is necessary and lift it as soon as its reason no longer applies.

6.5 Statement of reasons. If we block or remove content or restrict a service, we tell you in text form, at the latest when the measure takes effect: what we are doing and for how long, the facts and circumstances on which the decision is based, whether automated means were involved, the legal or contractual ground, and which remedies you have (Art. 17 DSA). This does not apply where an authority prohibits us from doing so.

6.6 Objection. You may object to any measure by e-mail to [to be added]. A human reviews your objection, and we inform you of the outcome. If the measure was not justified, we lift it without undue delay. Recourse to the courts is open to you at any time.

6.7 If a measure was justified, your obligation to pay the fee continues during the blocking.

6.8 We are required by law to inform the authorities if we become aware of information giving rise to a suspicion that a criminal offence involving a threat to the life or safety of a person has taken place, is taking place or is likely to take place (Art. 18 DSA). We disclose your data to authorities, courts and third parties only within the scope provided by law (for example under § 13 of the Austrian E-Commerce Act, ECG).

§ 7 Start of the contract, term and termination

7.1 The contract begins when it is concluded (clause 2.5).

7.2 Service start. For business customers, performance starts on the day the contract is concluded. For consumers it starts

on the day the contract is concluded, if you expressly requested in the order process that we start before the withdrawal period ends (clause 7.3), otherwise
on the day after the 14-day withdrawal period ends, that is on the 15th day after the contract is concluded.

The first billing period starts with the service start, so you do not lose any paid time. If you have not confirmed your e-mail address by the service start, we set up the hosting without undue delay after confirmation; the billing period nevertheless starts with the service start.

7.3 Early start (consumers only). In the order process you may make the following declaration by ticking a separate box that is not pre-ticked: “I expressly request that 1.wien Webhosting start providing the service before the 14-day withdrawal period ends. I understand that if I withdraw, I will pay a proportionate amount for the service provided until then, and that my right of withdrawal ends once the contract has been fully performed.” The declaration is voluntary. Without it, we only start after the withdrawal period has ended. Details of the right of withdrawal are in the withdrawal policy.

7.4 Term. The contract is concluded for an indefinite period. The minimum term is twelve billing months from the service start. The billing period (one month or twelve months) renews by the same length each time until the contract ends.

7.5 Termination by you. You may terminate the contract at any time. The termination takes effect at the end of the later of the following days: (a) the last day of the minimum term or (b) the last day of the billing month in which we receive your notice of termination. There is no further notice period. Example: service start 19 October 2026; the minimum term ends on 18 October 2027. If you terminate on 3 March 2027, the contract ends on 18 October 2027. If you terminate on 3 March 2028, it ends on 18 March 2028.

7.6 Annual payers. If the contract ends after a termination before the end of a twelve-month billing period already paid, we refund one twelfth of the gross amount paid for that period for each full billing month no longer used. We issue a credit note for this and refund the amount to the payment method used within 14 days after the contract ends.

7.7 How to terminate. You can terminate

in the customer area with the button “Cancel contract”,
without signing in through the page “Cancel contracts here” (https://webhosting.1.wien/en/cancel-contract; the link is in the footer of every page of the Shop), or
in text form, for example by e-mail to [to be added] or by letter.

We confirm receipt of your notice of termination and the day on which the contract ends by e-mail without undue delay. Until that day you may withdraw your notice of termination in the customer area.

7.8 Reminder. At the latest 30 days before the end of the minimum term we remind you by e-mail when it ends and that the contract can be terminated monthly thereafter.

7.9 Termination by us. We may terminate the contract in text form with three months’ notice to the end of a billing month, at the earliest to the end of the minimum term. We refund fees paid in advance for the period after the end of the contract pro rata.

7.10 Termination for good cause. Either party may terminate the contract for good cause without notice. Good cause for us exists in particular in the case of payment default as set out in clause 9.8, a serious breach of § 5 or a breach repeated despite notice, or if your account poses a significant danger to our systems or third parties that cannot be averted otherwise. Where reasonable, we first give you a reasonable deadline to remedy.

7.11 Statutory rights to end the contract, in particular under the Consumer Protection Act, the Consumer Warranty Act and Regulation (EU) 2023/2854 (“Data Act”, § 12), remain unaffected.

7.12 If the contract is terminated early for good cause for which you are responsible, our claims to the fees accrued until then remain; further claims for damages are governed by law.

§ 8 Prices and VAT

8.1 The prices in the plan description at the time of your order apply. Before you place the order we show you the total price per billing period including VAT.

8.2 Basis: the net price. Our fees are net amounts (excluding VAT) that are the same for all customers.

Consumers pay the net amount plus the VAT of the member state in which they are domiciled (in Austria currently 20%). The gross amount per billing period is rounded commercially to whole cents. The gross price therefore differs from country to country; we show it in the Shop for your country, at the latest before you place the order.
Business customers established in Austria pay the net amount plus 20% Austrian VAT.
Business customers established in another EU member state with a valid VAT ID pay the net amount without VAT; the tax liability passes to them (reverse charge). We check the VAT ID through the VAT Information Exchange System (VIES) of the European Commission. If it is invalid or cannot be checked, we charge VAT as for a consumer in that country; once it is confirmed, we issue the following invoices without VAT and, at your request, correct invoices already issued.
Business customers established outside the EU pay the net amount without Austrian VAT. They are themselves responsible for taxes and duties in their country.

8.3 Change of VAT. If the statutory VAT rate applicable to you changes, or if the member state whose VAT applies to you changes (for example because you move or because your VAT ID becomes valid or invalid), we charge VAT at the rate then applicable from the next billing period. We pass on reductions just as we pass on increases. The net amount stays the same. We state the new amount in the invoice that we send you 14 days before it is due.

8.4 There are no further costs such as set-up fees or shipping costs.

§ 9 Payment, invoicing and payment default

9.1 The fee is payable in advance for each billing period. You pay the first fee when you order; each further fee is due on the first day of the respective billing period.

9.2 Payment methods. You can pay by credit or debit card, Apple Pay, Google Pay, SEPA Direct Debit or eps bank transfer. eps can only be used for individual payments, not for automatic recurring payments. We process payments through the payment service provider Stripe Payments Europe, Limited (Ireland). You enter your card or account details directly on Stripe’s payment page; we do not receive them, only an identifier and details such as the card brand, the last four digits and the issuing country.

9.3 Automatic recurring payments. If you pay by card or SEPA Direct Debit, Stripe stores this payment method for recurring payments, and you authorise us to collect the fees for the following billing periods from it on the due date. We state the amount and the date in the invoice we send you by e-mail 14 days before it is due. You can change or remove the stored payment method in the customer area at any time. Without a stored payment method, you pay the invoice by the due date using the payment link in the invoice e-mail or in the customer area.

9.4 SEPA Direct Debit. You give the SEPA Direct Debit mandate on Stripe’s payment page. You receive the pre-notification at least two calendar days before the debit; it is usually contained in the invoice you receive 14 days before the due date. For the first order we debit the amount shown in the order process immediately; the display in the order process is the pre-notification. Please ensure sufficient funds. For the first order, the contract is only concluded once the direct debit has been credited (clause 2.5).

9.5 Electronic invoices. You agree that we issue invoices and credit notes electronically as PDF files and send them to you by e-mail; they are also available in the customer area. You can withdraw this consent for future invoices at any time in text form; we will then send you invoices by post.

9.6 Refunds are made to the payment method you used, unless otherwise agreed.

9.7 Default. If you do not pay on time, you owe the statutory default interest. We currently do not charge dunning fees.

9.8 Procedure in case of payment default. Day 0 is the due date, the day a debit fails or the day a payment is reversed.

Day	What happens
0	We inform you by e-mail about the open payment and send you a payment link.
3	For card payments we retry the charge.
7	For card payments we retry the charge; for SEPA Direct Debit only if the first debit failed for lack of funds. You receive a payment reminder.
10	You receive a dunning notice stating that we will suspend your hosting on day 14 if payment has not been received by then.
14	We suspend your hosting: websites and mailboxes are no longer reachable, and e-mails to your addresses cannot be delivered during the suspension. Your data is kept. The contract and your obligation to pay continue.
30	You receive a final notice with a grace period of 14 days, stating that we will terminate the contract when the grace period expires.
44	If payment has not been received, we terminate the contract for good cause. § 12 applies to your data. The open amount remains owed.

You can pay at any time in the customer area with any payment method offered. As soon as the payment has been received, the procedure ends and we lift any suspension without undue delay. We may deviate from this procedure in your favour.

9.9 Set-off. Business customers may only set off claims that we have acknowledged or that have been established by a court; they have a right of retention only in these cases. For consumers the statutory rules apply (§ 6(1) nos. 6 to 8 KSchG).

§ 10 Indexation

10.1 The net fees are index-linked. The reference is the consumer price index 2020 (VPI 2020) published monthly by Statistics Austria (Bundesanstalt Statistik Österreich). If it is no longer published, the consumer price index published by Statistics Austria as its successor applies, converted using the chaining factor published by Statistics Austria. The base value is the index figure for the month in which the contract was concluded.

10.2 Once per calendar year, for the first time after the minimum term has ended, we compare the most recently published index figure with the base value or with the index figure on which the last adjustment was based. If the index has fallen, we reduce the net fees in the same proportion; we are obliged to do so. If the index has risen, we may increase the net fees in the same proportion. If we forgo an increase in a given year, the index figure of the last adjustment actually made remains decisive for the next comparison. We never change fees retroactively.

10.3 We notify you of every adjustment in text form, with the calculation, at least one month before it takes effect. It applies from the first billing period beginning after that month. You may terminate the contract under clause 7.5 until the adjustment takes effect.

10.4 Other price changes apply only if you expressly agree to them.

§ 11 Backups

11.1 We automatically back up the data of your hosting account (files, databases, mailboxes) in accordance with the plan description, in particular daily and with the retention period stated there. The backups are stored on our server and on a separate storage system (Schedule 1a). We restore data from these backups in accordance with the plan description.

11.2 Our backups serve primarily to restore operation after technical faults. They are no substitute for your own backups. Please keep your own copies of your data outside our systems regularly and before every major change, such as an update. If you fail to do so, this may be taken into account as contributory negligence in the event of data loss (§ 1304 of the Austrian Civil Code, ABGB).

§ 12 Data export, switching and end of the contract

12.1 During the term you can export all your data yourself at any time: files via SFTP or FTPS, databases as an SQL export, e-mails via IMAP. Annex 2 lists which data this covers and in which formats.

12.2 Switching. You may at any time request in text form to switch to another provider or to your own systems, or to have your data erased. We start the switching process without a notice period, at the latest on the day you name. During the subsequent transitional period of at most 30 days the contract continues; we provide reasonable assistance, maintain the continuity of the service and a high level of security, and inform you of known risks to continuity. If the transitional period cannot be met for technical reasons, we inform you within 14 working days of your request, giving reasons; the transitional period is then at most seven months. You may extend the transitional period once by a period you consider more appropriate for your purposes. The contract ends when the switching has been successfully completed; we confirm this to you in text form. If you do not wish to switch but to have your data erased, the contract ends on the day you name, at the earliest when we receive the request, and we confirm the end of the contract in text form.

12.3 If the contract ends under clause 12.2 before the end of the minimum term, you owe, as compensation for the early termination, the fees until the end of the minimum term, less what we save as a result of the early termination. We do not charge any fees for the switching or the data export itself.

12.4 After the contract ends, for whatever reason, including after a withdrawal, we suspend your hosting. We keep your data available for retrieval for a further 30 days (retrieval period): at your request we re-enable SFTP and IMAP access for that time or provide an archive for download, in each case free of charge. In the case of switching, the retrieval period starts at the end of the transitional period.

12.5 After the retrieval period we completely erase all data of your hosting account. In our backups it is overwritten in the regular rotation cycle, at the latest [to be added] days after erasure. This does not cover data that we must keep for legal reasons (such as invoices); our privacy policy informs you about this.

12.6 Consumers who withdraw from the contract or terminate it because of a defect receive on request all content they provided or created when using the service, free of charge, without hindrance, within a reasonable time and in a commonly used, machine-readable format (§ 14(7) FAGG, § 24(6) VGG).

§ 13 Warranty

13.1 Consumers have the statutory warranty rights. For our hosting services as a digital service supplied continuously, the Consumer Warranty Act (VGG) applies in particular: we are liable for any defect that occurs or becomes apparent during the term of the contract (§ 18(2) VGG) and provide the updates throughout the term that are necessary to keep the service in conformity with the contract (§ 7 VGG). You may first demand that the service be brought into conformity and, under the conditions of § 20 VGG, reduce the price or terminate the contract. A price reduction relates to the period in which the service was defective. The rights become time-barred three months after the end of the term of the contract (§ 28 VGG). The burden-of-proof rules of § 19 VGG apply; please note your duty to cooperate under clause 4.5.

13.2 Business customers: §§ 922 et seq. ABGB apply with the following deviations: defects must be notified to us in text form without undue delay after they are discovered. We may first remedy a defect within a reasonable period. The presumption of defectiveness under § 924 ABGB does not apply. Warranty claims must be asserted in court within six months of the defect becoming apparent.

§ 14 Liability

14.1 We are liable without limitation for damage caused intentionally or with gross negligence by us or by persons for whom we are responsible, and for personal injury.

14.2 Consumers: For property damage and financial loss caused by slight negligence we are liable in accordance with the statutory provisions.

14.3 Business customers: We are not liable for slight negligence, except for personal injury. In the case of gross negligence that is not extremely gross, our liability is limited to the foreseeable damage typical for the contract and, per incident, to the total fees you paid in the twelve months before the event causing the damage; in that case we are not liable for loss of profit, indirect damage or third-party claims. Claims for damages must be asserted in court within six months of knowledge of the damage and the party causing it, and in any event within three years of the event causing the damage. In the case of slight and gross negligence you bear the burden of proving our fault.

14.4 Data loss. If, contrary to clause 11.2, you have not backed up your data yourself, we take this into account as contributory negligence. Towards business customers, our liability for data loss is limited to the effort that would have been needed to restore the data from a proper backup of your own, except in the case of intent or extremely gross negligence.

14.5 Claims under Art. 82 GDPR and under the Austrian Product Liability Act remain unaffected.

§ 15 Changes to these Terms

15.1 Consumers: Changes to these Terms for existing contracts apply only if you expressly agree to them. We send you planned changes in text form at least two months before they take effect, with a comparison of the amended provisions, and ask for your consent, for example by confirmation in the customer area. If you do not agree, the contract continues under the previous Terms; our right of termination under clause 7.9 remains unaffected. Changes to the service are governed by clause 3.11.

15.2 Business customers: We may change these Terms with effect for the future only for the following reasons: (a) to adapt them to amended laws, regulations or regulatory requirements, (b) to adapt them to amended case law of the highest courts, (c) to implement a change to the service under clause 3.11, or (d) to add new, additional services without making the existing services worse. We do not change main performance obligations or fees in this way. We send you the changes in text form at least six weeks before they take effect. If you do not object in text form before they take effect, the changes are deemed accepted; we will point this out specifically in the notification. If you object, either party may terminate the contract with effect from the date the change would take effect; until then the previous Terms apply.

§ 16 Data protection and data processing

16.1 Our privacy policy describes how we process your personal data as a controller.

16.2 For personal data that you store in your hosting or process through your websites and mailboxes, you are the controller and we are your processor. Annex 1, which you accept with these Terms, applies to this.

§ 17 Communications, complaints and dispute resolution

17.1 We send communications to you to the e-mail address in your customer account or post them in the customer area. Electronic declarations are deemed received when you can retrieve them under normal circumstances (§ 12 ECG). Please keep your e-mail address up to date and, if possible, choose an address that is not hosted with us, so that you receive our communications even during a fault or suspension.

17.2 You may make declarations to us in any form, in particular by e-mail to [to be added], by letter or through the functions of the customer area.

17.3 Complaints should be sent to [to be added]. We confirm receipt and usually reply within five working days. If we cannot resolve a complaint by agreement, we tell you in text form which consumer dispute resolution body is competent and whether we will take part in a procedure.

17.4 We are not obliged to take part in dispute resolution proceedings before a consumer arbitration body.

§ 18 Governing law and place of jurisdiction

18.1 Austrian law applies, excluding the conflict-of-law rules of private international law and the UN Convention on Contracts for the International Sale of Goods. For consumers, this choice of law applies only to the extent that it does not deprive them of the protection of the mandatory provisions of the law of the state in which they have their habitual residence.

18.2 The place of jurisdiction for all disputes arising from this contract is the court with subject-matter jurisdiction in Vienna. For consumers, the statutory places of jurisdiction apply: if a consumer is domiciled or habitually resident in Austria or employed here, we can only sue them at these places (§ 14 KSchG); we can only sue consumers domiciled in another EU member state in that state, and they can sue us in Austria or at their domicile.

§ 19 Final provisions

19.1 We may transfer the contract with business customers to a company that takes over our hosting business; we will inform you in good time beforehand, and you may terminate the contract with effect from the transfer. Towards consumers, a transfer is effective only with their consent.

19.2 If a provision of these Terms is invalid, the remaining provisions remain valid. Towards consumers, the invalid provision is replaced by the statutory rule. Towards business customers, the valid rule that comes closest to the purpose of the invalid one applies.

19.3 Side agreements with business customers must be made in text form.

Annex 1: Data Processing Agreement (Art. 28 GDPR)

between you as controller (“Customer”) and [to be added] as processor (“we”).

1. Subject matter and duration

1.1 This agreement covers the processing of personal data that you store in your hosting account under the hosting contract or have processed through your websites, databases and mailboxes. For data that we process for our own purposes (such as your contract and billing data) we are ourselves the controller; our privacy policy applies to that data.

1.2 This agreement applies for as long as we process personal data on your behalf, that is for the term of the hosting contract and until complete erasure under § 12 of the Terms. If you use your hosting exclusively for personal or household purposes, the GDPR does not apply to your processing under Art. 2(2)(c) GDPR; we nevertheless treat your data in accordance with this agreement.

2. Nature, purpose and scope of the processing

2.1 Nature of the processing: storing, making available over the internet, receiving, storing and sending e-mails, automated scanning of e-mails for malware and spam, logging access, backing up and restoring, transmitting to the certification authority for TLS certificates (domain names only), erasing.

2.2 Purpose: exclusively the provision of the hosting services under the contract, including operation, security, troubleshooting and backups.

2.3 Types of personal data: all data you store in your hosting (files, database contents), e-mails including their contents, attachments and metadata (sender, recipients, times, IP addresses), access and error logs of your websites (IP address, time, requested address, browser identifier, referrer), and sign-in logs for SFTP, FTP and e-mail. You decide whether this includes special categories of personal data (Art. 9 GDPR) or data relating to criminal offences (Art. 10 GDPR); you check whether our technical and organisational measures are appropriate for them.

2.4 Categories of data subjects: visitors of your websites; your customers, prospects, members and users; senders and recipients of e-mails; your employees and other persons whose data you process in your hosting.

2.5 Place of processing: We process your data exclusively in data centres in the European Union (Schedule 1b). Processing in a third country takes place only in accordance with Art. 44 et seq. GDPR and after informing you under clause 6.

3. Instructions

3.1 We process the data only on your documented instructions, including with regard to transfers to a third country, unless we are required to do so by Union or Austrian law; in that case we inform you of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

3.2 Your instructions are set out conclusively in the Terms, the plan description and this agreement. You give further instructions by using the functions of your hosting account (such as creating, changing or deleting data, mailboxes or forwardings) or in text form. We treat instructions that go beyond the agreed scope of services as a request to change the service.

3.3 If we consider that an instruction infringes the GDPR or other data protection provisions, we inform you without undue delay. We may suspend its execution until you have confirmed or changed the instruction.

4. Confidentiality

We only use persons for the processing who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (§ 6 of the Austrian Data Protection Act, DSG). These persons process the data only on your instructions. We access the contents of your hosting account only where this is necessary for operation, security, troubleshooting, support you have asked for, or compliance with a legal obligation.

5. Security of processing

5.1 We take the technical and organisational measures under Art. 32 GDPR described in Schedule 1a.

5.2 We may adapt the measures to technical progress as long as the level of protection does not fall. We document material changes and update Schedule 1a.

6. Sub-processors

6.1 You give us general authorisation to engage other processors (“sub-processors”). The sub-processors engaged when the contract is concluded are listed in Schedule 1b and are deemed approved.

6.2 We inform you in text form at least four weeks in advance of any intended addition or replacement of a sub-processor. You may object to the change in text form on data protection grounds within two weeks of receiving the information. If we cannot resolve your objection, for example by a different arrangement, you may terminate the contract free of charge with immediate effect before the change takes effect; we refund fees paid in advance pro rata. If a sub-processor must be replaced at short notice for urgent reasons (such as the failure or insolvency of a supplier or a security incident), we inform you as early as possible; your right to object and terminate remains.

6.3 We contractually bind every sub-processor to the same data protection obligations as set out in this agreement, in particular to sufficient guarantees of appropriate technical and organisational measures. If a sub-processor fails to fulfil its obligations, we remain liable to you for it.

6.4 Ancillary services that we obtain from third parties without them accessing your data, such as telecommunications services or the delivery of e-mails by the recipients’ mail servers, are not sub-processing within the meaning of this agreement.

7. Assistance to the controller

7.1 Data subject rights: You can fulfil most requests of data subjects (access, rectification, erasure, restriction, data portability) yourself with the functions of your hosting account. Where this is not possible, we assist you with appropriate technical and organisational measures. If data subjects contact us directly, we refer them to you and forward the request to you without undue delay.

7.2 Obligations under Art. 32 to 36 GDPR: Taking into account the nature of the processing and the information available to us, we assist you with the security of processing, with notifications of personal data breaches, with data protection impact assessments and with prior consultations of the supervisory authority.

7.3 Personal data breaches: If we become aware of a personal data breach in your hosting, we notify you in text form without undue delay. The notification contains, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken and proposed, and a contact point. We provide information we do not yet have in phases.

7.4 We may charge business customers reasonable rates, after prior notice, for assistance that goes beyond our statutory obligations and the usual effort, unless it is caused by a breach on our part.

8. Erasure and return after the end of the contract

After the end of the services we keep your data available for retrieval for 30 days and then erase it completely; copies in backups are overwritten in the regular rotation cycle (§ 12 of the Terms). This does not apply where we are obliged to store data under Union or Austrian law. On request we confirm the erasure to you in text form.

9. Evidence and audits

9.1 On request we make available to you all information necessary to demonstrate compliance with the obligations of Art. 28 GDPR, in particular a current description of the measures in Schedule 1a and, where available, evidence from our sub-processors (such as certificates).

9.2 You, or an auditor mandated by you who is bound to confidentiality and is not a competitor of ours, may carry out audits including inspections. Inspections must be announced at least four weeks in advance and take place during our business hours, without unreasonably disrupting operations and while safeguarding the confidentiality of other customers’ data. Access to data centres is subject to the rules of their operator. We may charge business customers a reasonable amount for the effort of more than one inspection per calendar year that is not prompted by a breach on our part.

10. Liability and precedence

10.1 Liability is governed by Art. 82 GDPR. Otherwise § 14 of the Terms applies, unless Art. 82 GDPR mandatorily provides otherwise.

10.2 In the event of conflict between this agreement and the other provisions of the Terms, this agreement prevails in matters of data protection.

Schedule 1a: Technical and organisational measures (Art. 32 GDPR)

As of draft-2026-10-20. The description is deliberately general so that it does not help attackers; customers receive details on request under clause 9.1.

1. Confidentiality

Physical access control: The servers are located in a data centre in Vienna operated or used by our infrastructure provider (Schedule 1b). Physical access is limited to and controlled by data centre staff; we ourselves have no physical access.
System access control: Administrative access to the servers only via SSH with cryptographic keys; password sign-in is disabled. Root access is additionally restricted. The administration panel and its programming interface can only be reached from approved addresses and only used with access keys. Staff access to customer administration requires two-factor sign-in. Repeated failed sign-in attempts automatically block the source address.
Network: Host firewall for IPv4 and IPv6 with a default “drop” rule; only the ports needed for the services are open; databases cannot be reached from outside.
Data access control and separation: Each hosting account is a separate system user without shell access, with its own PHP process pool, its own directory restriction (open_basedir) and its own database users. Processes of other users are not visible (hidepid). File permissions are restrictive. Credentials are transmitted so that they do not end up in logs or in areas visible to other users.
Authorisations: Only a few named administrators have access to customer data, on the principle of least privilege; the customer portal accesses the servers only through a narrowly limited interface.

2. Integrity

Transfer control: State-of-the-art encrypted transmission: HTTPS with TLS certificates for websites, panel and customer area; SFTP and FTPS for files; IMAP, POP3 and SMTP with TLS; backups are transferred over SSH (SFTP).
Input control: Administrative actions are recorded in the panel’s action log and in the customer portal’s audit log; logs contain no passwords or keys.
Protection against malware: On production servers, e-mails are scanned for malware and spam. Security updates for the operating system, PHP and the web server are installed automatically.

3. Availability and resilience

Daily backup of all hosting accounts on the server and on a separate storage system of a sub-processor (Schedule 1b); each server has its own access there, limited to its own backups; additionally automatic snapshots that cannot be deleted from the server.
Storage quotas and resource limits per account prevent one account from blocking the server.
Power supply, air conditioning and network connectivity provided by the data centre.

4. Procedures for regular review

Documented set-up and verification procedures for each server, with a checklist that is worked through after set-up and after restarts.
Review of these measures at least once a year and after security incidents.
Procedure for handling security incidents and personal data breaches, including informing customers under clause 7.3.
Data protection by default: the customer portal’s logs contain no personal data in clear text; retention periods are defined.

5. Organisational measures

Commitment of all persons with access to confidentiality (data secrecy under § 6 DSG).
Selection of sub-processors according to their security guarantees; written contracts under Art. 28 GDPR.

Schedule 1b: Sub-processors

Sub-processor	Service	Place of processing	Guarantees
Hohl IT e.U. (trading as “Alwyzon”), Floridsdorfer Hauptstraße 1, 1210 Vienna, Austria, FN 538746z, Commercial Court of Vienna	Provision of the virtual servers on which all hosting data is stored and processed	Data centre (Interxion campus) in Vienna, Austria	Contract under Art. 28 GDPR
Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, Ansbach Local Court HRB 6089	Storage of backup copies (Storage Box)	Germany	Contract under Art. 28 GDPR (concluded online); ISO/IEC 27001 certification

The following are not sub-processors for your hosting data:

Stripe (Stripe Payments Europe, Limited, Ireland): Stripe only processes the payment data from your contract with us, not the data in your hosting. For this payment data Stripe acts partly as our processor and partly as an independent controller; details are in our privacy policy.
Cloudflare (Cloudflare, Inc., USA): Cloudflare only protects and accelerates our Shop and customer area under webhosting.1.wien. The traffic of your websites and mailboxes does not pass through Cloudflare.
Let’s Encrypt (Internet Security Research Group, USA): To issue TLS certificates, the certification authority receives the domain names, the IP addresses they point to and our server’s request data, but no contents of your hosting and no contact e-mail address. It acts as an independent controller. Issued certificates and the domain names they contain are published in public Certificate Transparency logs.

Annex 2: Information on data export and switching

We provide this information under Art. 26 and 28 of Regulation (EU) 2023/2854 (“Data Act”).

1. Exportable data and formats

Data	Format	Method
Files of your websites	Original files, on request as an archive (tar or zip)	SFTP, FTPS; archive after the end of the contract
Databases	SQL export (MariaDB/MySQL compatible, UTF-8)	Export function or archive
Mailboxes	Messages in Maildir format or via IMAP	IMAP; archive after the end of the contract
E-mail forwardings, aliases, autoresponders	List as text or CSV	On request
DNS records of your domains (where we provide DNS)	Zone file (RFC 1035)	On request
Scheduled tasks (cron jobs)	List as text	On request
TLS certificates and associated keys	PEM	On request
Invoices	PDF	Customer area

2. Data that cannot be exported: data used exclusively for the internal operation of our systems, such as server configurations, security rules and logs of our infrastructure, to the extent that disclosing them would endanger trade secrets or the security of our systems and of other customers.

3. Procedure and limitations: as described in § 12 of the Terms. Technical limitations: export takes place in the format of the respective software (Linux file system, MariaDB, Dovecot/Maildir); applications may need to be adapted to the new provider’s PHP and database versions.

4. Charges: We do not charge any fees for switching or data export.

5. Jurisdiction of the infrastructure and protection against governmental access from third countries (Art. 28 Data Act): The IT infrastructure on which we process your hosting data is located in Austria and is subject to Austrian law and the law of the European Union. We and our infrastructure provider are established in the EU. We respond to requests from authorities of third countries for access to your data only to the extent permitted under Union and Austrian law; we check every request for lawfulness and inform you where permitted.