Privacy Policy

Last Updated: October 2025

Hostyt (Varsofia) (“Hostyt”, “we”, “us”, “our”) acts as the data controller for personal data processed via our websites, client area, and hosting services, and as a data processor when providing infrastructure to customers under a DPA.

Contact Details

Controller: Hostyt (Varsofia), Lindleya 16, 02-013 Warsaw, Poland; privacy contact: privacy [at] host.yt; EU supervisory authority: President of the Personal Data Protection Office (PUODO).

Scope and Relationship

This notice covers personal data collected directly (Article 13 GDPR) and indirectly (Article 14 GDPR), including via forms, support, billing, and technical logs; customers may appoint Hostyt as processor under a DPA.

Categories of Data

• Identity and contact: name, email, phone, billing address.
• Account and billing: service identifiers, invoices, payment status (no full card data stored by Hostyt).
• Technical: IP addresses, device, browser, logs necessary for security and service delivery.

Purposes and Legal Bases

• Account setup and service provision, support and incident handling: contract performance \(Art. 6(1)(b)\).
• Billing, taxes, fraud prevention, record keeping: legal obligation \(Art. 6(1)(c)\).
• Service integrity, abuse prevention, improvements: legitimate interests \(Art. 6(1)(f)\) balanced with rights.
• Marketing communications and analytics cookies: consent \(Art. 6(1)(a)\), withdrawal at any time.

Data Sources

Data is obtained from the data subject (forms, orders, tickets), from processors (payments, anti-fraud), and automatically via service logs and security controls.

Recipients and Processors

Personal data may be shared with infrastructure providers, payment processors, anti-abuse and support tools, under contracts enforcing confidentiality, security, and GDPR Article 28 obligations.

International Transfers

Where data is transferred outside the EEA, Hostyt implements European Commission Standard Contractual Clauses and complementary safeguards as required by GDPR.

Retention

• Account and contract data: for the term of service and statutory retention periods (e.g., accounting).
• Security and access logs: retained only as necessary for security and legal purposes, then deleted or anonymized.
• Marketing consents and preferences: until withdrawal or periodic renewal.

Rights of Data Subjects

Rights include access, rectification, erasure, restriction, portability, and objection; when consent is the legal basis, it may be withdrawn at any time without affecting prior processing.

A complaint may be lodged with the President of the Personal Data Protection Office (PUODO), Poland.

Security Measures

We implement organizational and technical measures appropriate to risk, including access controls, encryption in transit, and hardened infrastructure, with incident response aligned to GDPR.

Cookies and Similar Technologies

Non-essential cookies require prior, explicit, granular consent; no pre-ticked boxes, no cookie walls, and consent can be withdrawn at any time via the banner or browser settings.

Compliance also reflects Polish Electronic Communications Law/ECA on consent, categories, records, and accessibility of the consent mechanism.

DSA Intermediary Service Disclosures

As a hosting provider, we maintain a notice-and-action mechanism for illegal content and provide statements of reasons when restricting or removing content, consistent with DSA Articles 16–18.

Processor Role and DPA

When acting as processor for customer-controlled content, processing occurs strictly on documented instructions under a signed Data Processing Agreement meeting Article 28 GDPR requirements.

Changes

We may update this policy to reflect legal or operational changes and will indicate the “Last Updated” date accordingly.