Privacy Policy LuxHost

1.1. This Privacy Policy (the “Policy”) describes how Great Flower, a business entity registered in Israel under registration number 342667532, at 12 Rozmarin Street, Be’er Sheva 8465059, Israel, operating under the trade name LuxHost (the “Provider”, “we”), processes personal data of users of the website https://luxhost.cc, the client area at https://app.luxhost.cc and our support channels (the “User”, “you”).

1.2. The Provider is the controller (owner of the database) of the personal data described in this Policy. Contact: support@luxhost.cc; ticket system https://app.luxhost.cc/support; postal address above.

1.3. This Policy is an integral part of the LuxHost Terms of Service (the “Terms”). Capitalized terms have the meaning given in the Terms.

1.4. This Policy does not apply to data that Users store on their servers or process through their own domain names (see Section 10), nor to third-party websites linked from the Site.

2.1. We process personal data in accordance with the Israeli Protection of Privacy Law, 5741-1981 (חוק הגנת הפרטיות), as amended, including Amendment No. 13, and the Protection of Privacy Regulations (Data Security), 5777-2017.

2.2. Where we offer Services to individuals in the European Economic Area, we additionally comply with Regulation (EU) 2016/679 (the "GDPR") in respect of their personal data. Israel is recognised by the European Commission as providing an adequate level of data protection (Decision 2011/61/EU, confirmed by the Commission's review of January 2024), so transfers of personal data from the EEA to the Provider in Israel do not require additional safeguards.

3.1. You are not legally obliged to provide us with personal data. However, the data marked as required at registration, at checkout and in domain registration forms is necessary to conclude and perform the Agreement; without it we cannot provide the Services.

3.2. The purposes of processing and the recipients of the data are set out in Sections 5 and 6. You have the rights of access and correction described in Section 9.

4.1. Account data: email address, login, password (stored in hashed form), language, Account settings, and the Telegram identifier and username where you contact us via the Telegram bot.

4.2. Domain registration data: name or company name, postal address, telephone number and email address of the registrant and of the administrative and technical contacts and, for legal entities, registration details, as required by ICANN and registry rules.

4.3. Billing data: company name, VAT identification number and billing address; the date, amount, currency and identifier of each payment; the payment method; for a stored card, the card brand, last four digits and expiry date (the full card number is processed only by the payment provider); for cryptocurrency payments, the wallet address and blockchain transaction identifier; invoices.

4.4. Verification data: where we ask you to verify your identity or business status under the Terms, copies of the documents you provide and the result of the verification.

4.5. Technical data: IP addresses and timestamps of logins and actions in the Account, browser and device information, cookies and similar identifiers, and server and network logs relating to the Services (connection metadata, traffic volumes, resource consumption, abuse reports).

4.6. Communications: the content of tickets, emails and Telegram messages exchanged with support, and the notes we make about them.

4.7. We do not request or knowingly process special categories of data (such as health, political opinions or religious beliefs). We do not provide Services to persons under 18.

5.1. Concluding and performing the Agreement: creating and administering the Account, registering, renewing and transferring domain names, provisioning servers, accounting for the Balance, providing support, and sending service notices (expiry and renewal reminders, invoices, maintenance, changes to terms). Basis: performance of a contract (GDPR Art. 6(1)(b)); under Israeli law, your consent and the contractual relationship.

5.2. Payments and refunds, accounting and tax reporting. Basis: performance of a contract; compliance with legal obligations (GDPR Art. 6(1)(c)).

5.3. Security, fraud and abuse prevention: verifying identity and payment methods; detecting and investigating fraud, abuse, attacks and breaches of the Terms; protecting the Infrastructure and other users; handling abuse notices and orders of authorities. Basis: legitimate interests (GDPR Art. 6(1)(f)); compliance with legal obligations.

5.4. Compliance with legal obligations: ICANN and registry requirements (including registrant data verification and publication), tax and bookkeeping law, sanctions and anti-money-laundering rules, orders of competent authorities and the EU Digital Services Act. Basis: compliance with legal obligations; legitimate interests.

5.5. Analytics and improvement of the Site and the Account: understanding how they are used in order to improve them. Basis: legitimate interests; where the law requires it (for example, for analytics cookies for visitors from the EEA), your consent.

5.6. Marketing of our own Services: information about new Services, features and offers by email. Basis: your consent, or an existing customer relationship where the law allows, in accordance with Section 30A of the Israeli Communications Law (Bezeq and Broadcasting), 5742-1982. You may opt out at any time via the link in each message or in the Account.

5.7. Establishing, exercising or defending legal claims. Basis: legitimate interests.

6.1. We disclose personal data only to the extent necessary for the purposes above, to the following categories of recipients:

6.2. We do not sell personal data and do not share it with third parties for their own marketing.

7.1. We are established in Israel and our servers are located in the European Union. Personal data may be transferred to and processed in Israel, in the EU and in the countries where our Suppliers and processors are located (which may include the United States, for example for Amplitude).

7.2. Transfers from the EEA to Israel are covered by the adequacy decision referred to in Section 2.2. Transfers from the EEA to other countries are made under the European Commission's standard contractual clauses or another transfer mechanism recognised by the GDPR, or where necessary for the performance of the Agreement (GDPR Art. 49(1)(b)). Transfers from Israel are made in accordance with the Protection of Privacy Regulations (Transfer of Data to Databases Abroad), 5761-2001.

8.1. We retain personal data for as long as necessary for the purposes above:

8.2. After these periods data is deleted or irreversibly anonymised. Data required for the defence of legal claims is retained until the claim is resolved.

9.1. You have the right to access the personal data we hold about you, to have it rectified or erased, to restrict or object to its processing, to receive it in a portable format and to withdraw consent at any time, to the extent provided by the Israeli Protection of Privacy Law and, for persons in the EEA, by the GDPR.

9.2. You also have the right to lodge a complaint with the competent data protection supervisory authority.

9.3. Requests are submitted through the ticket system at https://app.luxhost.cc/support or to support@luxhost.cc. We respond within 21 days (the period may be extended where the law permits, in which case we will inform you) and may ask you to confirm that the request originates from the holder of the Account. Information about other persons, information whose disclosure is prohibited by law and information relating to pending legal proceedings or investigations may be withheld.

9.4. Deletion of data that is necessary for the provision of Services results in termination of the Services and of the Agreement in accordance with the Terms. We may refuse to delete data that we are required to retain by law or that is necessary for the establishment, exercise or defence of legal claims, and we will inform you of the reasons.

10.1. We do not determine the purposes and means of the processing of information that you store on your servers or process through your domain names. You are the controller of that data and are responsible for its lawfulness, including compliance with the GDPR where applicable.

10.2. To the extent we store and transmit that data as part of the Services, we act as your processor. We do not access the content of your servers except in the cases described in Section 11 of the Terms. A data processing agreement under Article 28 GDPR is available on request.

11.1. The Site and the Account use cookies that are necessary for authentication, security, remembering your settings and protecting against abuse. These cookies do not require consent.

11.2. For analytics we use Amplitude, which collects technical data and information about your actions on the Site and in the Account through cookies and similar identifiers. Where the law requires it, including for visitors from the EEA, we ask for your consent before setting analytics cookies, and you may withdraw it at any time through the cookie settings on the Site. Amplitude's processing is also governed by its own privacy policy.

11.3. You can block or delete cookies in your browser settings; some functions of the Account may then be unavailable.

12.1. We apply organisational and technical measures appropriate to the risk, in accordance with the Protection of Privacy Regulations (Data Security), 5777-2017 and Article 32 GDPR, including: encryption of connections (TLS); hashed storage of passwords; role-based access control and logging of access to personal data; separation of billing and infrastructure systems; regular updates and vulnerability management; physical security of the data centres we use; and confidentiality obligations of our staff.

12.2. In the event of a personal data breach that is likely to result in a risk to your rights, we notify the competent authority and, where required, you, in accordance with applicable law.

12.3. You are responsible for keeping your Account credentials confidential and for enabling two-factor authentication where available. Notify us immediately at support@luxhost.cc if you suspect unauthorised use of your Account.

13.1. We may amend this Policy. Material changes are notified in accordance with Section 16 of the Terms at least 14 days before they take effect; the current version and its effective date are published on the Site.