Privacy Policy
How Hostynet processes and protects your personal data.
This is a courtesy translation. The French version is the legally binding document.
1. Purpose
This policy describes how Hostynet processes personal data in the context of: (i) website management, client account (dashboard.hostynet.fr), orders, billing and support, and (ii) provision of hosting services (VPS and game servers).
- Client management data (account, billing, support): Hostynet acts as data controller.
- Data hosted by the Client on their VPS or game server: Hostynet acts as data processor and the Client acts as data controller.
2. Data processed
2.1 Client management (Hostynet = data controller)
- Identity and contact details: name/surname or company name, email, phone, billing address (if provided).
- Account data: client area credentials, contract information (plan, renewal, service history).
- Support data: ticket content and technical information provided by the Client.
- Technical and security data: logs necessary for security, diagnostics and compliance with applicable legal obligations.
- Quote requests (website design service): name, email, phone, company, country, requested pack and free-text message submitted via the quote form. Connection metadata (IP, user-agent, timestamp) is also recorded for security and anti-spam purposes.
- Authentication data: email and password (stored hashed); if the Client chooses Discord or Google sign-in (OAuth), the technical identifier and email of that account; two-factor authentication (2FA) secret if enabled.
- Payment data: card payments are processed by Revolut; Hostynet never stores the full card number (tokenisation by the payment provider). Hostynet keeps order history, invoices and the account credit balance.
- Free offer abuse prevention: normalised email address and IP address, retained to limit free trials (checked over a 30-day window).
2.2 Data hosted on the Services (Hostynet = data processor)
The Client is solely responsible for data and content hosted and processed through their VPS or game server, including personal data.
3. Purposes and legal bases (client management)
| Purpose | Examples | Legal basis (GDPR) |
|---|---|---|
| Contract performance | Service creation, account management, VPS delivery, support | Article 6(1)(b) |
| Legal obligations | Accounting, billing, dispute management | Article 6(1)(c) |
| Security and abuse prevention | Abuse prevention, traceability, diagnostics, security | Article 6(1)(f) |
| Pre-contractual measures | Processing website-design quote requests, follow-up commercial exchange before signature | Article 6(1)(b) |
4. Hosting and transfers
Services (VPS and game servers) are operated from infrastructure owned by Hostynet and located in France (Martigues). Data is stored in France. Hostynet does not transfer data outside the European Union without a GDPR-compliant legal basis.
5. Sub-processors
Hostynet uses providers strictly necessary for service delivery (network connectivity, IP addressing, domain name, payment processing).
| Provider | Role | Data concerned | Location |
|---|---|---|---|
| Orange Pro | Internet connectivity (fiber) | Network metadata (IP addresses, connection/transit information) | France / EU |
| Free Pro | Internet connectivity (fiber) | Network metadata (IP addresses, connection/transit information) | France / EU |
| Servperso Systems (BE 0725.528.920) | IP address provisioning / NoBGP tunnel connectivity | Network metadata (IP addresses, tunnel/transit information) | Belgium (EU) |
| OVHcloud | Domain name registration/management | Domain-related data (registrant/contacts, administrative information) | EU |
| Revolut Business | Payment collection and processing | Identity/transaction data for payment and compliance | EU |
| Discord Inc. | Discord sign-in and account linking (only if the Client chooses this option) | Discord technical identifier, account email | United States (transfer framed in accordance with the GDPR) |
| Google Ireland Limited | Google sign-in (only if the Client chooses this option) | Google technical identifier, account email | EU (Ireland) |
6. Retention periods
- Service data (account, contract): during the contract, then deletion within 30 days after end of service, unless required by law.
- Technical logs (security/diagnostics): maximum retention of 12 months.
- Support data: retained for the duration necessary for processing, then archived/deleted as required by law or evidence needs.
- Quote requests (website-design service): retained for up to 3 years after the last commercial contact (in line with CNIL recommendations on prospect data), then deleted. Earlier deletion on request.
7. Security
Hostynet implements appropriate technical and organizational measures, including:
- Access control limited to authorized personnel (need-to-know basis).
- Network and system security measures to prevent unauthorized access.
- Monitoring and logging for security and diagnostics purposes.
- Maintenance and updates to maintain system security.
8. VPS access (managed services / premium support)
Under standard service, Hostynet does not access VPS content or Client admin credentials.
For managed services / premium support, Hostynet may intervene only upon Client request and consent, via the ticket system. Required access must be provided as temporary credentials.
Outside the managed-services framework, Hostynet may access a VPS without the Client's prior request in case of suspected abuse, a security incident affecting or threatening the infrastructure or other clients, or a legal obligation. Such access is based on Hostynet's legitimate interest (Art. 6(1)(f) GDPR) in ensuring security and preventing unlawful use, as well as on its legal obligations (Art. 6(1)(c) GDPR); it is strictly limited to what is necessary, logged, and notified to the Client within a reasonable time unless legally prohibited. For personal data hosted by the Client in its VPS as data controller, such access is carried out in accordance with Article 28 of the GDPR.
For game servers, the management platform (Pterodactyl) and its host servers are administered by Hostynet: technical access to server files exists by design. This access is used only for operation, maintenance, security and support, under the conditions of this article.
9. Data subject rights
For data where Hostynet is the data controller, you have rights of access, rectification, erasure, restriction, objection and portability under Articles 15 to 22 of the GDPR. Requests can be sent to: rgpd@hostynet.fr.
For data processed by the Client on their VPS, requests should be directed to the Client (data controller).
10. Data breaches
In the event of a personal data breach, Hostynet notifies the Client as soon as possible and provides available technical information to help the Client fulfill their obligations.
11. Policy updates
Hostynet may update this policy. The version published online at the time of consultation is the applicable version.
Last updated: 2026-07-11.