ThunderHosting

Privacy policy

Privacy Policy

Legally binding: the Italian version

Version 1 · October 18, 2026

Version 1 · effective from 18/10/2026 · This is a translation for convenience; the Italian version is the legally binding text.

1. Controller

The controller for personal data collected through the platform https://beta-manager.thunderhosting.com (the "Platform") and its related services is ThunderHosting GmbH, Via Rubiana 20, 6925 Gentilino, Switzerland. For any data protection question: info@thunderhosting.com.

This policy applies to customers, invited users, visitors of the Platform and contact persons of our customers. The Italian version is binding; translations are provided for convenience.

2. Applicable law

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and, to the extent we offer services to persons in the European Union or the European Economic Area, the General Data Protection Regulation (GDPR).

3. Which data we process

  • Account data: first and last name, e-mail address, password (encrypted), language, roles and permissions, registration date, e-mail confirmation.
  • Organization and billing data: company name or name of the private person, address, country, register or VAT numbers (businesses only), contact and billing e-mail addresses, phone.
  • Payment data: chosen payment method, identifiers ("tokens") issued by the payment provider, card brand and last four digits, e-mail address of the PayPal account, payment status, fees. We never store full credit card numbers.
  • Contract data: ordered services, subscriptions, invoices, payments, reminders, cancellations, accepted version of the terms, confirmations (age, third-party licences) with date, time and IP address.
  • Technical and usage data: IP address, browser and operating system, date and time of access, pages and functions used, security and error logs, session data.
  • Customer content: the data, files, websites, e-mails, databases and servers the customer hosts or runs on our services. We process them solely to deliver the service; the customer remains responsible for them.
  • Communications: support requests (tickets), e-mails, messages to the support chatbot if used.
  • Public data: for Swiss companies we may consult the commercial register (Zefix) to verify and complete organization data.
  • Performance of the contract: opening and managing the account, delivering the ordered services, invoicing, collection, support (Art. 6(1)(b) GDPR).
  • Legal obligations: bookkeeping and retention of business records, tax duties, responses to lawful requests from authorities (Art. 6(1)(c) GDPR).
  • Legitimate interests: security of the Platform and services, prevention of abuse and fraud, defence of legal claims, improvement of services, contract-related communications (Art. 6(1)(f) GDPR).
  • Consent: where required, e.g. for optional functions such as the support chatbot; consent can be withdrawn at any time (Art. 6(1)(a) GDPR).

We make no automated decisions with legal effects and do not use data for advertising profiling.

5. Where we store data

Our main systems and databases are located in our own data center in Switzerland and in partner data centers in Switzerland. For redundancy and backups we additionally use partner data centers in Germany and Finland (European Union).

Some of our portals are served through the content delivery network (CDN) and proxy of Cloudflare: traffic passes through Cloudflare's servers, which process IP addresses and technical connection data for security and attack protection. Personal data is stored in Switzerland and the European Union.

Exceptions are services expressly offered as global and services for which the customer chooses a location outside Switzerland and the European Union (e.g. a server in a specific region): in that case the service data resides in the chosen location, shown at the time of the order.

6. Recipients and processors

We pass personal data to third parties only as far as necessary for the purposes above. Our providers are bound by contracts ensuring an adequate level of protection. The main categories:

  • Payments: FlowAlp Pay (card and TWINT payment service operated through a payment partner based in Switzerland) and PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg). Payment providers process payment data under their own responsibility.
  • Infrastructure and hosting: partner data centers in Switzerland, Germany and Finland (e.g. Hetzner Online GmbH for backup storage); Cloudflare, Inc. for CDN, DNS and protection.
  • Domain registration: domain registrars and registries (e.g. OpenProvider), to which we pass the holder data required by the rules of the respective registry and ICANN.
  • Software licences and third-party platforms: software producers (e.g. WebPros for Plesk) for licence activation; download sources for game server software (Mojang/Microsoft, Modrinth, CurseForge, PaperMC etc.), which receive no customer personal data.
  • Communication: e-mail delivery services (e.g. Mailgun) and, for customers who request it, the postal service Pingen AG (Switzerland) for paper invoices.
  • Sign-in: Microsoft Entra ID (Microsoft Ireland Operations Ltd.) for customers who choose to sign in with their Microsoft account.
  • Support chatbot: if enabled and used, messages may be processed by an artificial intelligence service (Google) after separate acceptance.
  • Authorities: upon lawful request of authorities or courts.

The current list of processors is available on request.

7. Transfers abroad

Data is processed mainly in Switzerland and the European Union. The European Union is recognised by Switzerland as providing an adequate level of protection, and Switzerland is recognised as adequate by the European Union. Where a provider processes data in the United States or another country without an adequate level of protection (e.g. Cloudflare, PayPal, Mailgun, Google), the transfer is based on the Data Privacy Framework (Switzerland–US / EU–US) where the provider is certified, or on recognised standard contractual clauses, with additional measures where necessary.

8. Retention

  • Account and contract data: for the duration of the contract and, after its end, until the limitation periods expire, generally 10 years.
  • Invoices, payments and accounting records: 10 years (retention duty under the Swiss Code of Obligations).
  • Proof of acceptance of terms, confirmations and licences: for the duration of the contract and the subsequent limitation periods.
  • Technical and security logs: generally 12 months, unless needed for incident investigations.
  • Customer content: deleted 30 days after the end of the service, subject to legal duties.
  • Backups: overwritten according to rotation cycles, at the latest within 90 days.

9. Your rights

You have the right to obtain information about the personal data concerning you, to have it corrected or deleted, to restrict its processing, to receive it in a structured format (portability) and to object to processing based on legitimate interests. Where processing is based on consent, you can withdraw it at any time with effect for the future.

To exercise your rights write to info@thunderhosting.com. We may ask you to verify your identity. You may also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, if you reside in the European Union, with the supervisory authority of your country.

Deleting the account deletes or anonymises personal data, except data we must keep for legal duties (e.g. invoices).

10. Security

We protect data with appropriate technical and organisational measures, including encrypted connections (TLS), encryption of sensitive data and backups, role-based access control, secure authentication, separation of customer systems, monitoring and regular updates.

11. Minors

Our paid services are intended for persons at least 18 years old or minors with the consent of their legal representative. We do not knowingly collect data of children under 16 without such consent.

12. Cookies

The Platform uses only cookies and similar technologies (local storage) necessary for its operation: sign-in and session, abuse protection, preferences such as language and theme. We use no tracking or advertising cookies. Details are in the Cookie Notice.

13. Changes

We may update this policy. The current and previous versions, with their effective dates, can be viewed on the Platform. In case of material changes we inform customers on the Platform or by e-mail.

ThunderHosting GmbH · Via Rubiana 20, 6925 Gentilino, Switzerland · info@thunderhosting.com