Privacy Policy

2. Your rights as a data subject

Subject to applicable law, you have the right at any time to:

• obtain information about the personal data we have stored about you (Art. 15 GDPR),
• have inaccurate personal data corrected (Art. 16 GDPR),
• have your personal data deleted (Art. 17 GDPR),
• restrict the processing of your data (Art. 18 GDPR),
• data portability (Art. 20 GDPR), and
• object to the processing of your personal data (Art. 21 GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data, e.g. the data protection authority responsible for North Rhine-Westphalia.

3. Collection of general data and information (server log files)

When you access our website, our infrastructure collects a range of general data and information (e.g. IP address, browser type used, date and time of access, pages accessed). This data is processed in particular to securely operate our website, to detect attacks, and for statistical purposes (legal basis: Art. 6(1)(f) GDPR, legitimate interest in the technical stability and security of our systems).

4. Registration and customer account

Using ZapX requires creating a customer account. The data collected in this process (including name, email address, billing address) is processed for the performance of the contract and to manage the customer relationship (Art. 6(1)(b) GDPR).

5. Cookies and consent management

We use cookies on our website. On your first visit, a cookie banner is displayed that lets you consent, decline, or individually adjust your choice per category (necessary, functional, performance, and advertising cookies). A detailed, up-to-date list of all cookies used, including purpose, provider, and retention period, can be found in the cookie banner and its settings area. You can withdraw or adjust your consent at any time with effect for the future.

6. Payment processing (Stripe)

We use the payment provider Stripe Payments Europe, Ltd. (Stripe) to process payments. The data required for payment processing (e.g. payment method information, billing data) is transmitted to Stripe for this purpose (Art. 6(1)(b) GDPR, performance of a contract). Further information on data protection at Stripe can be found in Stripe's privacy policy.

7. Email delivery (Mailgun)

We use the email delivery service Mailgun to send operationally necessary emails (e.g. order and invoice confirmations, security notices, notices about locked or soon-to-be-deleted services) as well as marketing and customer care emails to existing customers (see section 23). For this purpose, your email address and the relevant message content are transmitted to Mailgun (Art. 6(1)(b) GDPR, performance of a contract, or (f), legitimate interest in reliable email delivery; for marketing and customer care emails Art. 6(1)(f) GDPR in conjunction with Section 7(3) German Act against Unfair Competition (UWG)).

8. WhatsApp notifications (optional)

If you explicitly enable this in your account settings, we additionally send certain notifications via the WhatsApp Business API of Meta Platforms Ireland Limited. Your stored phone number is transmitted to Meta for this purpose (Art. 6(1)(a) GDPR, consent). You can disable this feature again at any time in your account settings.

9. Object storage for backups and file uploads (AWS S3)

We use the Amazon S3 object storage service of Amazon Web Services EMEA SARL to store backups and certain file uploads (e.g. related to TeamSpeak servers). Processing takes place to fulfil the respective contract for the booked service (Art. 6(1)(b) GDPR).

10. Error monitoring (Sentry)

We use the error monitoring service Sentry, provided by Functional Software, Inc., to detect and fix technical errors on our platform. This may involve processing technical error information and, where applicable, parts of request or user context data (Art. 6(1)(f) GDPR, legitimate interest in a functional, error-free platform).

11. Analytics and marketing (Google Tag Manager / Google Analytics)

We use Google Tag Manager and, through it, Google Analytics services provided by Google Ireland Limited to statistically evaluate the use of our website. These services are only activated after you have explicitly consented to the relevant category in the cookie banner (Art. 6(1)(a) GDPR, consent via Google Consent Mode); without your consent, analytics and advertising cookies remain deactivated. You can withdraw your consent at any time via the cookie banner.

12. Content delivery network and DDoS protection (Cloudflare)

To protect our platform from overload attacks (DDoS) and to speed up content delivery, we use Cloudflare, Inc. as an upstream reverse proxy. For technical reasons, all traffic between your device and our servers is routed through Cloudflare's infrastructure (Art. 6(1)(f) GDPR, legitimate interest in a secure and available platform).

13. Artificial intelligence (OpenAI)

We use AI-powered features on our platform, e.g. the support assistant (chat with Zappy, also for visitors who are not logged in), the assistants in the areas of your services (e.g. game servers, vServers, dedicated servers, TeamSpeak, Discord bot, domains), the analysis of console output and configuration files, configuration and plugin generators, the help search, the shop advisor, domain name suggestions and summaries of cancellation feedback. In doing so, your inputs and, where necessary to answer them, context about your customer account and your services (e.g. service name, configuration settings, console and log excerpts, order and service activity) are transmitted to language models of OpenAI (OpenAI Ireland Limited, Dublin, or its affiliates in the USA). We store the answers and chat histories so that you can open them again; for quality assurance, chat histories are also analysed, likewise with the help of OpenAI models.

OpenAI processes this data on our behalf as a processor (Art. 28 GDPR). We use the OpenAI API with server-side conversation storage disabled (store=false). According to OpenAI, inputs and outputs of the API are not used to train its models, and logs for abuse monitoring are retained for up to 30 days by default. We base the transfer to the USA on standard contractual clauses (see section 21).

The legal basis is Art. 6(1)(b) GDPR (providing the feature you use); for visitors without a contractual relationship (e.g. support chat) and for the quality analysis of chat histories it is Art. 6(1)(f) GDPR (legitimate interest in functioning support and in improving the features). You may object to the analysis of your chat histories for quality assurance at any time with effect for the future (Art. 21 GDPR), e.g. by email to info@zap-hosting.com.

Please do not enter passwords, credentials or particularly sensitive data (Art. 9 GDPR) in AI chats, and no personal data of third parties (e.g. names, email addresses or messages of other people) unless you are entitled to pass this data on to us.

14. Domain registration (registrar)

When registering, transferring and managing domains, we transmit the contact details of the domain holder required for this (name, organisation if applicable, address, phone number, email address and, where available, salutation/gender and fax number) to our registrar service provider Antagus and, depending on the domain extension, to the competent registry. The registry processes the data under its own responsibility in accordance with the rules that apply to the respective domain extension; whether and to what extent holder data is publicly available (e.g. via WHOIS or RDAP) depends on these rules and can differ by domain extension (Art. 6(1)(b) GDPR, performance of a contract).

15. Sign-in via third-party providers (GitHub, Google, Discord, Steam)

Optionally, you can sign in to our platform with an account from GitHub (GitHub, Inc.), Google (Google Ireland Limited) or Discord (Discord, Inc.), or link such an account to your customer account. You can link a Steam account (Valve Corporation, via Steam OpenID) only to an existing customer account; signing in via Steam is not possible. In doing so, we receive from the respective provider the profile data required for sign-in and linking (e.g. account identifier, user name and, where provided by the provider, email address; for Steam we receive only the Steam ID); the provider learns that you are signing in to us or linking an account. Use is voluntary; you can sign in with an email code instead. The legal basis is Art. 6(1)(b) GDPR (sign-in and linking that you explicitly initiate). For providing its own account, each provider is an independent controller; its privacy notices apply. You can remove the link in your account settings at any time.

16. Bot protection (Cloudflare Turnstile)

To protect against automated abuse (e.g. when signing in with an email code, subscribing to the newsletter and in certain forms), we use Cloudflare Turnstile by Cloudflare, Inc. Technical characteristics of your browser and your IP address are transmitted to Cloudflare for verification; Cloudflare processes this data as our processor (Art. 28 GDPR). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure platform and in protection against abuse). You can object to the processing under Art. 21 GDPR; without the check, however, the protected features cannot be used.

17. Log analysis (Axiom)

Operating and error logs of our platform, which can contain technical identifiers such as account or service IDs and IP addresses, are transmitted to the log service Axiom (Axiom, Inc.) for error analysis and secure operation and are analysed there. Axiom processes the data as our processor (Art. 28 GDPR); we base the transfer to the USA on standard contractual clauses or the adequacy decision on the EU-US Data Privacy Framework (see section 21). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a functioning and secure platform). Retention is governed by section 22.

18. PayPal (payment method and partner payouts)

Depending on currency and availability, we offer PayPal as a payment method. Processing runs via Stripe; PayPal also processes your payment data (including the PayPal email address). If you take part in the partner programme, we store the PayPal email address or bank details you provide in order to pay out your commission and pass them on to the respective payment service or credit institution for the payout (Art. 6(1)(b) GDPR).

19. Task management (ClickUp)

For internal processing we use the task management system ClickUp (Mango Technologies, Inc., USA). We transmit to it applications to the partner programme (name, email address and the details you provide about your channel) and, when our support follows up on a request internally, name, email address and customer number, subject and a summary of the support conversation. ClickUp processes this data as our processor (Art. 28 GDPR; Art. 6(1)(b) GDPR or (f), legitimate interest in orderly handling of requests). For the transfer to the USA, see section 21.

20. Notifications to channels you set up

In your account settings you can set up Discord, Slack, Telegram or webhook targets to which we send notifications about your services and your account (e.g. server crashes, resource warnings). For this purpose we transmit the content of the notification (including service name and event) to the target you specify; we store the target address in encrypted form. The respective provider or the operator of your webhook is itself responsible for the processing there. The feature is voluntary; you can delete channels at any time (Art. 6(1)(b) GDPR).

21. Processors and transfers to third countries

Where service providers (e.g. OpenAI, Anthropic, Mailgun, Sentry, Axiom, Cloudflare, ClickUp, Amazon Web Services) process personal data on our behalf and on our instructions, this is based on data processing agreements pursuant to Art. 28 GDPR. When you sign in or link an account, GitHub, Google, Discord and Valve are themselves controllers for their own accounts.

Some of the recipients named in this privacy policy (in particular OpenAI, Anthropic, Cloudflare, Sentry, Axiom, ClickUp, GitHub, Discord, Valve, Stripe, PayPal and Google) are based in the USA or also process data through affiliates or sub-processors in the USA, i.e. in a country outside the European Union or the European Economic Area. If the recipient is certified under the EU-US Data Privacy Framework, the transfer is based on the adequacy decision of the European Commission (Art. 45 GDPR); otherwise it is based on the standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR). For OpenAI and Anthropic we rely on the standard contractual clauses. You can request a copy of the respective safeguards from us (info@zap-hosting.com).

22. Retention period

We generally only store personal data for as long as necessary for the respective processing purposes or as long as a statutory retention obligation applies.

You can delete your account at any time in your account settings. The deletion is carried out 14 days after your request; until then you can cancel it via the link in the confirmation email or after signing in. After that we delete or anonymise your personal data unless one of the following retention obligations applies:

• Invoices, accounting records and order, payment and contract data including refunds and chargebacks: 8 years (Section 147(1) no. 4 and (3) German Fiscal Code (AO); Section 257(1) no. 4 and (4) German Commercial Code (HGB); Section 14b German VAT Act (UStG));
• Records of supplies to consumers in other EU member states that we account for under the One-Stop-Shop scheme (OSS), including the information we use to determine the country of supply (e.g. the country of the billing address): 10 years (Section 22(1) UStG; Art. 63c Implementing Regulation (EU) No 282/2011);
• Support requests and other business correspondence of accounts with orders: 6 years (Section 147(1) nos. 2 and 3 and (3) AO; Section 257(1) nos. 2 and 3 and (4) HGB). Without any order we delete them together with the account.

These periods start at the end of the calendar year in which the record was created and do not end while the assessment period for the taxes the records are relevant to is still open (Section 147(3) AO). While we retain the data, we restrict its processing and use it only for the respective retention purpose (Art. 18 GDPR, Section 35(3) BDSG); afterwards we delete it.

In addition, if you objected to advertising, we keep your email address on a block list so that you receive no further advertising from us after the deletion either, and we keep payment identifiers (e.g. card identifier, PayPal account) that we blocked because of payment fraud or abusive chargebacks, for fraud prevention (Art. 6(1)(f) GDPR).

If you moved from the ZAP-Hosting Legacy platform to ZapX, we also keep the migration record: your legacy email address, legacy username and legacy service IDs. It serves as proof of the migration terms you accepted and for handling the migration (Art. 6(1)(f) GDPR). We do not delete this data together with the account.

§ 8 of our Terms and Conditions applies to locked Lifetime products: the data stored on the product is kept fully intact for at least 14 days from the lock. After that, we may archive the product. We keep the archive for at least six months so that we can restore the product if it is unlocked; after that, it may be deleted. For Dedicated Servers, the hardware may be released once the 14 days have passed, in which case all drives are wiped. We inform you by email before an archiving, a release or the deletion of an archive.

23. Direct marketing to existing customers and personal support

We use the email address you provided when registering or in connection with an order to inform you as a customer by email about our own similar products and offers and about tips for your services, and to support you personally (Art. 6(1)(f) GDPR in conjunction with Section 7(3) German Act against Unfair Competition (UWG); legitimate interest in customer care and direct marketing). We inform you about this when you register, during the ordering process and when you move Legacy services, and we store as proof that the notice was shown to you (time, text version and place where it was shown).

So that the messages are relevant to you, we analyse data from your customer account:

• orders and booked products,
• the use of your services (e.g. restarts, backups, configuration changes),
• the areas of the customer area you visit,
• login times,
• support requests, and
• the origin of your registration or order (landing page, campaign parameters and referring page).

Parts of these messages are created by AI systems and are labelled as such in the message. For this purpose we transmit the account data mentioned above to Anthropic (Claude), which acts on our behalf as a processor (Art. 28 GDPR); we base the transfer to the USA on standard contractual clauses (see section 21). We use Mailgun to deliver the emails (see section 7). We store the conversations with you and analyse them for quality assurance, also with the help of these AI systems.

You can object to the use of your email address for direct marketing at any time (Art. 21(2) GDPR) – in your email settings or via the unsubscribe link in every email – without incurring any costs other than the transmission costs at the basic rates. No automated decision-making with legal effects or similarly significant effects within the meaning of Art. 22 GDPR takes place.

24. Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy so that it always complies with current legal requirements, or to reflect changes to our services in the Privacy Policy. The new Privacy Policy will then apply to your next visit.