Privacy policy

This privacy policy explains how personal data is processed in connection with our website and the WebRock customer portal (hosting/managed hosting services).

1. Data controller

UTRANET GbR
Kleine Schmidtgasse 1
63571 Gelnhausen, Germany
Email: billing@utra.network

2. Data we process

Depending on your use of the service, we may process:

• Account and contact data (e.g. email address, password hash, profile details)
• Contract and billing data (e.g. invoice number, service period, amounts, VAT)
• Technical usage data (e.g. IP address, timestamps, pages accessed, user agent)
• Session/cookie data required for login and security
• Support communications, if you contact us

3. Purposes and legal bases

We process personal data in particular for:

• Providing the website and customer portal (Art. 6(1)(f) GDPR)
• Registration, authentication, abuse and fraud prevention (Art. 6(1)(f) GDPR)
• Contract performance and provision of hosting services (Art. 6(1)(b) GDPR)
• Billing and legal retention duties (Art. 6(1)(c) GDPR)
• Customer support and communication (Art. 6(1)(b) and (f) GDPR)

4. Cookies and sessions

We use technically necessary cookies/session mechanisms to maintain login sessions and to protect the security of the portal. Without these, the customer area cannot be provided.

5. Recipients, server location and processing on behalf

All data is processed on servers owned and operated by UTRANET GbR. The hosting server is located in the Equinix data centre in Frankfurt am Main, the backup server in the NTT data centre in Frankfurt am Main (both Germany). The data centre operators provide only rack space, power, network connectivity and physical security and have no access to data content. No data is transferred to countries outside the EU.

To provide hosting services, data required for account and resource management is transmitted to the hosting control panel (e.g. user and plan assignment), which runs on the same server.

Hosting customers: processing on behalf under Art. 28 GDPR

If you process personal data of third parties through your hosting (e.g. visitors, shop customers, email contacts), you are the controller and we act as your processor. The required agreement forms part of the hosting contract and is available at any time at Data processing agreement (DPA). It also lists the technical and organisational measures, the sub-processors and the deletion periods.

Payment processing

If payment methods via external payment service providers are offered (e.g. Stripe or PayPal), the data required to process the payment is transmitted to the respective provider. The available payment methods are shown during checkout; data is only shared where the selected method requires such processing.

6. Retention

We retain data only as long as required for the stated purposes:

• Web server access logs (IP address, timestamp, URL, user agent): 4 weeks, then deleted automatically.
• System logs (control panel, mail, firewall and login logs): 12 months, used only for security analysis and troubleshooting.
• Backups: daily backups with rolling retention; deleted data is removed from all backups within 30 days at the latest.
• Hosting data (web space, databases, mailboxes): up to 30 days after the end of the contract, then deleted.
• Account, contract and invoice data: for the term of the contract and thereafter for the statutory retention periods (6 or 10 years under German tax and commercial law).
• Unconfirmed registrations: 48 hours.

7. Your rights

Subject to legal requirements, you have rights of access, rectification, erasure, restriction, data portability, and objection. You also have the right to lodge a complaint with a supervisory authority.

8. Contact

For privacy requests, please contact: billing@utra.network