Legal Information

Privacy Policy

Effective date: 31 October 2026

1. Controller

The controller within the meaning of the GDPR is:

Melvin Delp
Waldstraße 33
64385 Reichelsheim
Germany

Email: info@nexorahost.com
Phone: +49 6164 5509615

No data protection officer has been appointed. Send privacy requests to the email above. You may also lodge a complaint with a supervisory authority. The competent authority is the Hessian Commissioner for Data Protection and Freedom of Information, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

2. What data we process

a) When visiting the website

When you access our website, technically necessary access data are processed (including IP address, date/time, requested URL, browser/OS, referrer). Legal basis: Art. 6 (1) (f) GDPR (operation and security of the website).

b) Registration, orders and customer account

We process master data (name, email, address, phone if provided, company, VAT ID), contract and order data, payment data depending on the chosen method, and usage data of booked services. Legal basis: Art. 6 (1) (b) GDPR (contract) and (c) (statutory duties).

c) Support (tickets) and live chat

If you contact us by ticket or live chat, we process the content you submit and technical metadata (e.g. time, referrer page for chat). Legal basis: Art. 6 (1) (b) or (f) GDPR.

d) Newsletter

If you subscribe to the newsletter, we process your email address and subscription status. You can subscribe via a checkbox at registration or in account settings and unsubscribe at any time (link in each email or customer area). Legal basis: Art. 6 (1) (a) GDPR.

e) Partner / affiliate attribution

If you reach our site via a partner link, we store the partner ID in a cookie (nh_aff, 30 days) so a later order can be attributed to the partner. Legal basis: Art. 6 (1) (f) GDPR (traceability of partner commissions).

3. Purposes

Providing and securing the website and customer area
Preparing and performing contracts (hosting, domains, add-ons)
Payments, invoicing and bookkeeping (including our FameAccounting system at buchhaltung.nexorahost.com – controller remains Melvin Delp)
Support and communication
Statutory retention and documentation duties
Abuse and fraud prevention
Newsletter (only with consent)
Partner programme

4. Recipients and services used

Data are disclosed only where required for the contract, based on consent, or by law:

Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, the Netherlands – payment processing for methods offered via Mollie at checkout. Legal basis: Art. 6 (1) (b) GDPR.
PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg – PayPal payments. Legal basis: Art. 6 (1) (b) GDPR.
Bank transfer – if you pay by transfer, our bank receives the data needed to credit the payment. Legal basis: Art. 6 (1) (b) GDPR.
Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA – website delivery and protection (CDN, DNS, DDoS, Turnstile). IP address and technical request data may be processed. Legal basis: Art. 6 (1) (f) GDPR. Transfers to the USA are based on an adequacy decision (EU-US Data Privacy Framework) and/or standard contractual clauses.
maincubes, data centre FRA01, Frankfurt am Main – server infrastructure as a processor (Art. 28 GDPR). Legal basis: Art. 6 (1) (b) GDPR.
DENIC eG and other registries – for domain registration/transfer. Legal basis: Art. 6 (1) (b) GDPR.
paywise (PayWise GmbH) – debt collection / receivables management in case of default. Legal basis: Art. 6 (1) (b) and (f) GDPR.
OpenPLZ (openplzapi.org), Zippopotam.us and Nominatim/OpenStreetMap – address/postal-code checks at registration. Legal basis: Art. 6 (1) (f) GDPR.
EU VIES (European Commission) – validation of a VAT ID you provide. Legal basis: Art. 6 (1) (c) or (f) GDPR.
Public authorities where we are legally obliged to disclose data (Art. 6 (1) (c) GDPR).

We do not store full card numbers on our servers. Transactional emails are sent via our own mail server (Mailcow).

5. Cookies

Session/auth cookie – sign-in (necessary).
CSRF cookie – form protection (necessary).
Cart cookie – shopping cart (necessary for the shop).
Language / display cookies – storing your choice.
Live-chat cookie (nh_live_chat) – chat session.
Affiliate cookie (nh_aff, 30 days) – partner attribution.
Cloudflare security cookies – delivery and abuse protection (necessary).

We do not use third-party analytics or advertising cookies (no Google Analytics, Matomo, etc.).

6. Retention

Contract and accounting records: according to statutory periods (German commercial/tax law).
Customer account: for the business relationship and thereafter until retention periods expire; then deletion or anonymisation.
Website server logs: usually 14 days, longer if needed for a security incident.
Server access/error logs of booked services: for the contract term plus a short follow-up, unless needed longer for abuse investigation.
Newsletter data: until consent is withdrawn.
Affiliate cookie: 30 days.
Live chat: for handling and reasonable traceability, then deletion or anonymisation.

7. Hosting content of our customers (processing on behalf)

Data you store on servers we provide are generally processed by us as a processor under Art. 28 GDPR. You are the controller for those data. Where required, this is covered by a data processing agreement.

8. Your rights

You have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20) and objection (Art. 21 GDPR). You may withdraw consent at any time with effect for the future. Contact: info@nexorahost.com. In the customer area you can update master data, disable the newsletter and request account deletion.

9. Security

We apply technical and organisational measures to protect your data (including TLS, access controls, encryption of particularly sensitive fields, logging of critical access).

10. Obligation to provide data

Without the data required for contract and billing we cannot conclude or continue a contract. Voluntary information (e.g. newsletter) can be omitted or disabled.

11. No solely automated decision-making

We do not make decisions based solely on automated processing that produce legal effects concerning you within the meaning of Art. 22 GDPR. Security checks (e.g. Turnstile) protect the platform and do not replace human review where a contractual decision requires it.

12. Changes

We may update this privacy policy when the law, our services or processing change. The version published on this page applies.