Privacy Policy

EliteStarHosting VOF acts as data controller for its own business operations and as data processor on behalf of customers for end-user data. Contact: [email protected].

As data controller we process:

• Account data: name, email, username, billing address, phone number, KvK number (business)
• Payment data: payment references, payment method, invoicing history (full card data is held by payment providers)
• Technical data: IP address, system logs, browser type, OS
• Communication data: support tickets, Discord messages, email correspondence
• Usage data: CPU, RAM, storage, bandwidth consumption, uptime data

• Performance of contract (Art. 6(1)(b) GDPR): account management, service delivery, payment, support, communication
• Legal obligation (Art. 6(1)(c) GDPR): financial administration (7 years), disclosure to authorities
• Legitimate interest (Art. 6(1)(f) GDPR): infrastructure security, system logging, fraud prevention, capacity planning, website analytics
• Consent (Art. 6(1)(a) GDPR): commercial newsletters and marketing

• Account data: active relationship + max. 90 days after termination
• Financial administration: 7 years (statutory obligation, Art. 52 AWR)
• System logs: max. 90 days; security incident logs: max. 12 months
• Communication data: customer relationship + max. 12 months after termination

• Payment providers: Stripe and/or PayPal (independent data controllers)
• Infrastructure: Hetzner Online GmbH (Germany / EU) for game hosting; SERVCITY (Amsterdam) for VPS/web hosting
• Communication: Discord Inc. (independent data controller)
• Authorities: only where legally required

We do not sell personal data. All sub-processors are contractually bound to GDPR compliance. Where data is transferred outside the EEA (e.g. Discord / USA), Standard Contractual Clauses (SCCs) apply.

When customers store end-user data on our infrastructure (e.g. player names, IP addresses, chat messages), EliteStarHosting acts as data processor and the customer acts as data controller. A Data Processing Agreement (Art. 28 GDPR) is available on request. Staff access to customer data is logged and retained for a maximum of 90 days.

We apply TLS/SSL encryption, need-to-know access control, password management policies, system logging, firewall and DDoS protection, and periodic access rights reviews to protect personal data against unauthorised access, disclosure, alteration, or destruction.

We maintain an internal breach response process. Where required, breaches are reported to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours (Art. 33 GDPR). If a breach poses a high risk to individuals, affected persons are notified (Art. 34 GDPR). When acting as processor, we notify the relevant customer without undue delay.

You have the right to access, rectification, erasure, restriction, data portability, objection and withdrawal of consent. Requests via [email protected]; we respond within 30 days (extendable). Complaints can be submitted to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Functional cookies are placed without consent. Analytical and marketing cookies require consent. See the Cookie Policy for full details.

The most recent version is always available at https://elitestarhosting.com/legal. Customers are informed in writing about material changes.

Contact: [email protected] · KvK: 98619616