Privacy Policy

1. Who we are (the data controller)

The HostX service is operated by HostX Web Services SRL, with its registered office at Str. Berzelor no. 5, Sângeorgiu de Mureș, Mureș county, registered with the Trade Registry under no. J2023000677269, tax registration code RO14785884 ("HostX", "we"). HostX Web Services SRL is the legal successor of InsideMedia SRL (the same legal entity, CUI RO14785884), renamed in 2023. For any matter regarding data protection you can contact us at privacynospam-do-not-harvest​@hostx.ro.

2. The two roles of HostX

Controller: for the client's account, billing, contact, and marketing data, HostX determines the purposes and means of processing and acts as controller; these processing activities are described in this policy.

Processor: for the personal data the client stores or processes through the contracted services (files, databases, mailboxes and email messages, backups), the client is the controller and HostX is the processor; these processing activities are governed by the Data Processing Agreement (DPA), concluded under Art. 28 GDPR.

3. What data we collect and when

When browsing the site: the IP address and traffic data recorded in log files, for security, diagnostics, and fraud prevention.

When placing an order / creating an account: first and last name, address, email address, phone number, IP address, billing data. For the registration of certain domain extensions by natural persons (e.g., .ro and .it), the personal numeric code (CNP) is requested strictly for that purpose; the CNP is not collected for invoicing, is only transmitted to the competent registry (e.g., ROTLD for .ro) and is deleted immediately from the helpdesk system after use, in accordance with the data-minimization principle (Art. 5 GDPR).

When contacting our team: we retain the communications (email, tickets, chat) and any data you provide within them.

4. Purposes of processing

• identity verification and delivery of the ordered services;
• fulfillment of contractual obligations and account management;
• invoicing and fulfillment of tax and accounting obligations;
• support, service-related communications, and change notifications;
• infrastructure security, fraud prevention and detection;
• marketing communications, only on the basis of your consent.

5. Legal bases

Performance of the contract: for account management, activation and operation of the services, and support.

Legal obligation: for accounting, invoicing, prevention/investigation of offences.

Legitimate interest: for network security, fraud prevention, and analysis of website usage.

Consent: for marketing/newsletter communications, withdrawable at any time.

6. Marketing and newsletter

Marketing communications are sent exclusively on the basis of your express consent, given separately (via a distinct tick-box at order or in the Client Account) — marketing consent is not conditioned on acceptance of the Terms & Conditions. You can unsubscribe at any time via the link in each email, from the Client Account, or by contacting us. We do not sell or transmit data to third parties for their marketing purposes.

7. How long we keep data

We keep personal data only as long as necessary for the purpose for which it was collected. Financial and accounting documents are kept for at least 10 years, in accordance with the law. Upon expiry of the retention period, data is deleted or anonymized.

8. Recipients and processors

For certain features we rely on third-party providers (processors), selected to comply with the GDPR, including: payment processors, domain registries and suppliers, email-marketing services, courier services, traffic analytics services. The up-to-date list of subcontractors is available at https://www.hostx.eu/subprocessors. We may also disclose data to the competent authorities in the cases provided for by law.

9. International transfers

Data is stored in Romania. To the extent that some processing involves transfers outside the EU/EEA (e.g., certain service providers), these are carried out only on the basis of a valid mechanism — an adequacy decision of the European Commission or standard contractual clauses — with appropriate safeguards under the GDPR.

10. Data security

• data collection and transmission are carried out over secure connections (HTTPS/SSL);
• infrastructure protected by firewalls and intrusion-detection systems;
• logging of access to systems that store personal data;
• passwords are stored in encrypted form;
• systems monitored, tested, and reviewed periodically;
• equipment in data centers certified ISO/IEC 27001, with access control, video surveillance, and motion detection.

The full technical and organizational measures are described in the Annex – Technical and Organizational Measures.

11. Your rights

Under the GDPR, you have the following rights regarding your data:

• right of access to the data;
• right to rectification;
• right to erasure ("right to be forgotten");
• right to restriction of processing;
• right to data portability;
• right to object to processing (including direct marketing);
• right not to be subject to a decision based solely on automated processing, including profiling;
• right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP, www.dataprotection.ro).

You can exercise your rights from the Client Account or by request to privacynospam-do-not-harvest​@hostx.ro. For consumers, the ANPC/SAL mechanisms and the European Commission's ODR platform are also available.

12. Cookies

The www.hostx.ro website uses cookies. Their use, the types of cookies, and your options are described in the Cookie Policy, available at https://www.hostx.eu/cookies.

13. External links

The site may contain links to pages that do not belong to us and that have their own privacy policies, for which we assume no responsibility. We recommend consulting them before submitting personal data.

14. Changes to the policy

We may periodically update this policy. The version in force, together with the date and version number, is published on the site; previous versions remain accessible on the "Updates to Legal Documents" page.

15. Contact

HostX Web Services SRL — data protection: privacynospam-do-not-harvest​@hostx.ro. Supervisory authority: ANSPDCP, www.dataprotection.ro.