Legal

Privacy policy

Data protection and security. What we collect, why, and your GDPR rights.

WHO IS RESPONSIBLE

Controller (Art. 4(7) GDPR): Julian Achter (Einzelunternehmer), trading as Aluy

Postal address:
Am Hang 55
85737 Ismaning
Germany

Email: privacy@old.aluy.net

THE SIMPLE VERSION

Privacy-respecting: We collect minimal information necessary for billing and support. We maintain essential operational logs for service reliability only. We do not monitor your server content.

We don't sell your data or use invasive web tracking. We respect user privacy. Verification may be requested when legally required (e.g. bank transfers) or for fraud prevention.

WHAT WE COLLECT

ACCOUNT STUFF:
Name, email address, billing address. For business customers: company name, VAT ID (if applicable). Standard business information for hosting services.
PAYMENT INFO:
Payments are accepted via bank transfer, cryptocurrency, cash, Stripe, and (when available) PayPal—PayPal is temporarily disabled. We use third-party payment processors for payment processing.
SERVER LOGS:
Connection logs for security, operations, and troubleshooting. Standard monitoring for service reliability.
VERIFICATION:
Verification may be requested when legally required (e.g. bank transfers) or when fraud prevention measures indicate it is necessary. Payment-method rules apply as described at order time.
SUPPORT TICKETS:
Your questions and our answers. We keep these to help you better.

WHAT WE DON'T DO

× Track you across websites
× Sell your data to third parties
× Monitor your server content
× Use invasive analytics
× Share data unless legally required

LEGAL BASIS FOR PROCESSING

Under GDPR Article 6, we process your data based on:

CONTRACT PERFORMANCE (Art. 6(1)(b)):
Account management, billing, service provision, technical support
LEGITIMATE INTEREST (Art. 6(1)(f)):
Network security, fraud prevention, service improvement, basic logging
LEGAL OBLIGATION (Art. 6(1)(c)):
Tax records, business records (e.g. retention periods under German tax and commercial law, often up to 10 years for tax-relevant documents), law enforcement requests
CONSENT (Art. 6(1)(a)):
Marketing communications (if you opt-in), non-essential cookies

HOW WE USE YOUR DATA

✓ Billing and payment processing
✓ Technical support
✓ Account security
✓ Legal compliance (when required)
✓ Service announcements (rare)

HOW LONG WE KEEP IT

ACCOUNT DATA: While you're a customer + 1 year
BILLING RECORDS: 7 years (legal requirement)
SERVER LOGS: 30 days max
SUPPORT TICKETS: 2 years for reference

YOUR RIGHTS

Under GDPR (Articles 15-22) and other privacy laws, you have the following rights:

ACCESS (Art. 15):
Request a copy of your personal data
RECTIFICATION (Art. 16):
Correct inaccurate or incomplete data
ERASURE (Art. 17):
Request deletion when legally possible
RESTRICTION (Art. 18):
Limit how we process your data
PORTABILITY (Art. 20):
Receive your data in machine-readable format
OBJECTION (Art. 21):
Object to processing based on legitimate interest

How to exercise your rights:

Email us at privacy@old.aluy.net with your request. We'll respond within 30 days.

Right to lodge a complaint: You may lodge a complaint with a supervisory authority in the EU/EEA—in Germany, e.g. the Federal Commissioner for Data Protection and Freedom of Information (BfDI) or your state data protection authority (Länderbehörden).

DATA PROCESSORS & THIRD PARTIES

We use the following processors to provide our services. All processors are bound by data processing agreements (DPAs) and GDPR compliance:

WHMCS (Customer Portal):
Billing system and customer management hosted on our infrastructure. Used for order processing, invoicing, and support tickets.
INFRASTRUCTURE PROVIDERS:
Our servers are hosted with: Hetzner (Germany/Finland), LIAM (UK), USM (Netherlands). These providers have access to server infrastructure but not customer data except as required for service delivery.
PAYMENT PROCESSORS:
Stripe, PayPal (when enabled), and cryptocurrency payment processors.
EMAIL SERVICE:
Transactional emails (invoices, support) sent via our own mail servers or third-party email service providers as necessary for service delivery.

All processors are located within the EU/EEA or operate under appropriate data transfer mechanisms (Standard Contractual Clauses where applicable).

SECURITY & ENCRYPTION

We implement industry-standard security measures to protect your data:

✓ HTTPS/TLS Encryption: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher
✓ Password Protection: Customer passwords are hashed using industry-standard algorithms (bcrypt/Argon2)
✓ Access Controls: Strict access controls limit who can access customer data internally
✓ Security Monitoring: We maintain security logs and monitor for unauthorized access attempts
✓ Regular Updates: Systems are kept updated with security patches

Note: Admin panel access attempts are logged for security purposes (with consent). These logs include IP addresses and timestamps and are retained for 30 days.

COOKIES

We use essential cookies for service functionality and non-essential cookies with your consent:

• Login session (essential) - Keeps you logged in
• CSRF protection (essential) - Prevents security attacks
• Payment verification (essential) - Confirms payment status
• Preference storage (non-essential) - Remembers banner dismissals (requires consent)

A cookie consent banner appears on your first visit. You can accept all cookies or choose essential-only.

No tracking cookies, no advertising cookies, no third-party analytics.

CHANGES TO THIS POLICY

We'll update this if needed and email you about major changes.

Updated March 2026