Your Data Protection Is Our Priority

1. What is GDPR?

The General Data Protection Regulation (GDPR) is a comprehensive data protection law enacted by the European Union. It sets strict standards for how organizations collect, process, store, and protect personal data of individuals within the EU.

StormHoster is fully committed to GDPR compliance. We have implemented robust data protection measures to ensure that your personal information is handled in accordance with the highest standards of privacy and security.

2. Data Protection Principles

StormHoster adheres to the seven core principles of GDPR data protection:

• Lawfulness, Fairness, and Transparency: We process personal data lawfully, fairly, and transparently.
• Purpose Limitation: We collect data for specific, explicit, and legitimate purposes only.
• Data Minimization: We collect only the data necessary for the intended purpose.
• Accuracy: We ensure personal data is accurate and kept up to date.
• Storage Limitation: We retain data only as long as necessary for the purposes collected.
• Integrity and Confidentiality: We protect data against unauthorized access, loss, or damage.
• Accountability: We take responsibility for our data processing activities.

3. Your Rights Under GDPR

As a data subject, you have the following rights under GDPR:

4. How We Protect Your Data

StormHoster implements comprehensive security measures to protect your personal data:

5. Data Processing Activities

StormHoster processes personal data for the following purposes:

• Service Delivery: Providing hosting, domain registration, and related services.
• Account Management: Creating and managing user accounts, processing payments.
• Customer Support: Responding to inquiries, troubleshooting technical issues.
• Communication: Sending service updates, marketing materials (with consent).
• Security: Detecting and preventing fraudulent activities.
• Legal Compliance: Meeting regulatory and legal obligations.

Lawful Basis: We process personal data based on:

• Contractual Necessity: To fulfill our contractual obligations to you.
• Legitimate Interests: For our legitimate business interests, such as improving our services.
• Consent: When you have provided explicit consent for specific purposes.
• Legal Obligation: To comply with legal and regulatory requirements.

6. Data Retention Policy

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Active Clients: Data is retained for the duration of your active account and for up to 7 years after account closure for legal and tax purposes.
• Payment Data: Retained for up to 7 years as required by financial regulations.
• Support Interactions: Retained for up to 5 years to maintain support history.
• Marketing Data: Retained until you withdraw your consent.
• Log Data: Retained for up to 2 years for security and troubleshooting purposes.

Data Deletion: Upon request, we will delete your personal data within 30 days, subject to legal retention obligations.

7. Data Subject Access Requests (DSAR)

If you wish to exercise any of your GDPR rights, you can submit a Data Subject Access Request (DSAR) to us. We will respond to your request within 30 days as required by GDPR.

To submit a DSAR, please contact us at support@stormhoster.com with "DSAR Request" in the subject line. Please include:

• Your full name and contact information.
• Details of the request (access, rectification, deletion, etc.).
• Any relevant account information to help us locate your data.

8. Third-Party Data Processors

StormHoster works with trusted third-party service providers who assist us in delivering our services. All processors are contractually obligated to comply with GDPR and maintain the same level of data protection as StormHoster.

Our third-party processors include:

• Payment Processors: PayPal, Stripe, and local payment gateways.
• Data Centers: Tier-III facilities in the US, UK, and Pakistan.
• Analytics: Google Analytics for anonymized website usage data.
• Support Tools: Live chat, ticket systems, and CRM platforms.
• Infrastructure Providers: Cloudflare, AWS, and other infrastructure partners.

We maintain Data Processing Agreements (DPA) with all third-party processors to ensure compliance with GDPR.

9. Data Breach Response

StormHoster has a comprehensive Data Breach Response Plan in place. In the event of a data breach, we will:

• Contain the breach: Immediately secure and isolate the affected systems.
• Investigate: Conduct a thorough investigation to determine the scope and cause.
• Notify: Notify affected individuals within 72 hours as required by GDPR.
• Report: Report to the relevant supervisory authority as required.
• Remediate: Take corrective actions to prevent future breaches.

10. Data Protection Officer (DPO)

StormHoster has appointed a Data Protection Officer (DPO) to oversee our data protection strategy and ensure GDPR compliance.

11. Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the relevant supervisory authority. In the UK, this is the Information Commissioner's Office (ICO).

Before contacting the ICO, we encourage you to contact us first so we can resolve your concern directly. We take all complaints seriously and strive to resolve them promptly.