Privacy Notice

Version: ltd-1 · Effective: from the date on which the operation of the BlazeHost services is transferred to BLAZEHOST LIMITED

The Czech version of this notice is binding; the English version is a translation. If the language versions conflict, the Czech version prevails.

This notice explains what personal data we process when providing the BlazeHost services through the customer panel billing.blazehost.cz (the "Panel") and the service control panel panel.blazehost.cz (the "Control Panel"), why we process it, to whom we disclose it, how long we keep it and what rights you have.

Processing is governed by Regulation (EU) 2016/679 of the European Parliament and of the Council to the extent it applies to us under Article 3(2) (offering services to individuals in the EU), and by the United Kingdom's UK GDPR and Data Protection Act 2018 (together the "GDPR"; references to articles of the GDPR refer to both instruments).

The BlazeHost VIP service (vip.blazehost.cz – sale of perks on customers' game servers) has its own privacy notice published at vip.blazehost.cz; this notice does not apply to it. Until that service is transferred to us, its controller is Jiří Viták, company ID (IČO) 21766177.

1. Controller and contact

1.1. The controller of personal data is BLAZEHOST LIMITED, Company number 17523509, England and Wales, registered office 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom ("we" or the "controller").

1.2. For all data protection matters contact us at [email protected] (or [email protected]) or by telephone on +420 910 114 397.

1.3. We have not appointed a data protection officer because we are not required to do so under Article 37 GDPR (we are not a public authority and our core activities do not consist of large-scale systematic monitoring of individuals or large-scale processing of special categories of data).

1.4. EU representative (Article 27 GDPR): has not been appointed yet. You can contact us directly at [email protected] on all data protection matters.

1.5. Transfer from the previous operator. The BlazeHost services were previously provided by Jiří Viták, a self-employed natural person, company ID (IČO) 21766177, with his registered place of business at Ametystová 702/46, 153 00 Praha 16 – Radotín (the "previous operator"). As of the date on which the operation of the BlazeHost services was transferred to us, we took over existing customers' data from the previous operator as part of the transfer of the business, to the extent described in section 2 (customer accounts, services, credit, payments, documents, records of consents, tickets and other Panel and Control Panel data), and from the transfer date we process it as controller. The legal basis for the takeover is the performance of the transferred contracts (Article 6(1)(b) GDPR), compliance with legal obligations (Article 6(1)(c) GDPR) and our legitimate interest in continuing to provide the services without interruption (Article 6(1)(f) GDPR). We inform you of the transfer by the transfer notice. You may object to processing based on legitimate interest (section 6) and you may terminate the contract within 30 days of the transfer notice under clause 15.1 of the Terms. The previous operator continues to keep records of payments received before the transfer date to comply with its own accounting and tax obligations.

1.6. Data you store in your services (e.g. a game server's player database, website content, data on a VPS) is processed by us as a processor on your behalf as controller. That processing is governed by the Data Processing Agreement (https://billing.blazehost.cz/legal/dpa), not by this notice.

2. What data we process, why, on what basis and for how long

2.1. Panel (billing.blazehost.cz)

2.2. Control Panel (panel.blazehost.cz)

A Control Panel account is created automatically with the Panel account. In the Control Panel we process as controller:

These values correspond to the Control Panel's settings. Data you store on servers (files, player databases, backups) is processed by us as processor under the Data Processing Agreement.

2.3. General

We do not send commercial communications (newsletters); the e-mails you receive from us are service e-mails only.

Providing account, billing and payment data is a contractual requirement – without it we cannot provide the services. We do not carry out automated decision-making or profiling with legal effects.

3. Cookies and similar technologies

The use of cookies, the browser's local storage and bot protection for forms (Google reCAPTCHA, Cloudflare Turnstile) is described in the separate Cookie Policy (https://billing.blazehost.cz/legal/cookies). We do not use analytics or advertising tools.

4. Recipients of personal data

We disclose personal data only to the extent necessary to the following recipients.

Processors (process data on our instructions):

Independent controllers (process data for their own purposes under their own policies):

You can see which payment gateways are currently available in the Panel store; we pass data only to the gateway you choose for the payment.

Backups. We back up the Panel database in encrypted form (restic) outside the main server, to storage we operate ourselves in the firstcolo FRA4 data centre, Frankfurt (EU). We keep 14 daily, 8 weekly and 12 monthly snapshots; data of a deleted account may therefore persist in backups for up to approximately 12 months. We back up the Control Panel database in encrypted form and keep at most 14 backups, for no longer than 30 days. Short-term backups taken when deploying a new version of the Panel remain on our servers and the last 14 are kept. We restore data from backups only for disaster recovery; deleted accounts are not made accessible again.

Backups of your services' data (disaster-recovery backups of game servers: 7 daily and 4 weekly, at most 30 days after the service is deleted; database backups: at most 30 days, at most 14 days after the database or service is deleted) are governed by the Data Processing Agreement and chapter 10 of the Terms.

Test environment. For testing we use a copy of the database in which personal data is anonymised before use (e-mails, names, IP addresses, access and payment data are replaced).

Staff alerts. Operational alerts from the Panel are sent to Discord or Telegram without customers' personal data – they carry only the alert name and an internal reference. Control Panel alerts may contain the username and server name; to that extent Discord is our processor (table above).

We may also disclose data to public authorities where required by law, and to our legal or tax advisers bound by confidentiality.

We operate the service management software (Pterodactyl, Proxmox, Convoy, Enhance, LibreNMS) on our own infrastructure; its vendors have no access to your data.

5. Transfers to third countries

5.1. We are established in the United Kingdom. Transfers of personal data from the EU/EEA to the United Kingdom are covered by the European Commission adequacy decision (Article 45 GDPR). Data on the servers running our services and the backups remain in the EU (firstcolo FRA4 data centre, Frankfurt). For transfers from the United Kingdom to other countries we use the UK GDPR instruments (the UK Extension to the EU-U.S. Data Privacy Framework or the International Data Transfer Addendum to the standard contractual clauses).

5.2. Some of the entities listed may process data outside the European Economic Area and the United Kingdom. Transfers take place on the following bases:

• Resend, Inc., Google LLC, Cloudflare, Inc., Discord Inc. (USA) – European Commission adequacy decision for the EU-U.S. Data Privacy Framework (Article 45 GDPR) for certified recipients; this also applies to Discord as our processor (Control Panel alerts) and to Cloudflare as proxy and DNS for the Control Panel. Where certification is not sufficient, standard contractual clauses (Article 46(2)(c) GDPR) within the supplier's contractual terms;
• Stripe, PayPal – we contract with their European or British companies; transfers within their groups to the USA are handled by those companies themselves (Data Privacy Framework certification or standard contractual clauses) under their own policies;
• NameSilo, LLC (USA) – the transfer is necessary for the performance of the domain registration contract you order (Article 49(1)(b) GDPR); the registration data is required by the domain registry;
• NOWPayments (Saint Vincent and the Grenadines) – the transfer is necessary to carry out a payment by the method you choose (Article 49(1)(b) GDPR); if you do not use this payment method, we do not pass it any data.

5.3. We will provide a copy of the relevant safeguards on request.

6. Your rights

You have the right:

• of access to the personal data we process about you and to a copy of it (Article 15 GDPR);
• to rectification of inaccurate data (Article 16 GDPR) – you can edit most data yourself in your profile;
• to erasure (Article 17 GDPR) where we no longer need the data and are not required by law to keep it; you can close your account yourself in the Panel if you have no active services;
• to restriction of processing (Article 18 GDPR);
• to data portability for data you have provided to us and that we process by automated means on the basis of a contract (Article 20 GDPR);
• to object to processing based on legitimate interest (Article 21 GDPR); we will stop processing unless we demonstrate compelling legitimate grounds;
• to withdraw consent where processing is based on consent, with effect for the future.

On a request for access or portability we will send you the data from both the Panel and the Control Panel in a machine-readable format (JSON). If you close your account in the Panel, your Control Panel account is also deleted; data we must keep (payments, documents, records of consents) is kept for the period stated in section 2. An account in the BlazeHost VIP service is not closed by closing the Panel account – erasure there is handled on a separate request sent to [email protected].

We handle requests without undue delay and at the latest within 1 month (in complex cases the period may be extended by a further 2 months). To verify your identity we may ask you to send the request from the e-mail address assigned to your account.

You also have the right to lodge a complaint with a supervisory authority: the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom, www.ico.org.uk. You may also lodge a complaint with the supervisory authority in the EU state of your residence, place of work or place of the alleged infringement (Article 77 GDPR) – in the Czech Republic the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, www.uoou.gov.cz.

7. Security

We protect data with appropriate technical and organisational measures, in particular encrypted transmission (HTTPS), password hashing, encryption of sensitive access data in the database, role-based access control, mandatory two-factor authentication for staff, an audit log and regular updates. If a security breach occurs that poses a high risk to your rights, we will inform you.

8. Changes to this notice

We may update this notice. We will inform you of material changes by e-mail or in the Panel. The current version is always available at https://billing.blazehost.cz/legal/privacy.

Effective: from the date on which the operation of the BlazeHost services is transferred to BLAZEHOST LIMITED (version ltd-1).