PRIVACY POLICY

Version: 1.0 | Effective date: 14.09.2026

TABLE OF CONTENTS

1. Who we are and how to contact us
2. Scope and our roles
3. What data we process, for what purpose and on what basis
4. Fraud prevention and automated decisions
5. Marketing communications
6. Who we share data with
7. Transfers outside the European Economic Area
8. How long we keep data
9. How we protect data
10. Your rights
11. Data contained in hosted services (us as processor)
12. Domain names and WHOIS
13. Cookies and similar technologies
14. Minors
15. Changes to this policy

1. WHO WE ARE AND HOW TO CONTACT US

1.1. The controller of your personal data is S.C. CROCKY S.R.L., a Romanian limited liability company, CUI RO50515950, registered with the Trade Register under no. J2024020698007, with its registered office at Str. Drăgaica nr. 5, sat Balasan, mun. Băilești, jud. Dolj, postal code 205101, Romania, operating under the trade names "CrockyHost" and "Crocky" ("we", "the Provider").

1.2. For any question or request regarding your data: gdpr@crocky.host. For other requests: contact@crocky.host, telephone +40 750 265 179. We are not legally required to appoint a data protection officer (DPO); the address gdpr@crocky.host is monitored directly by the company's administrator.

2. SCOPE AND OUR ROLES

2.1. This policy describes how we process the personal data of: (a) visitors to the website https://crocky.host; (b) persons who create a client account or order services (including representatives and contact persons of corporate clients); (c) persons who contact us by e-mail, forms, tickets or telephone; (d) domain name holders; (e) persons who report abuse to us.

2.2. For all of the above data, we act as controller within the meaning of Regulation (EU) 2016/679 ("GDPR").

2.3. For data contained in the websites, applications, databases, e-mails and servers we host for our clients (for example the data of visitors to a client's website), the client is the controller and we act as processor, in accordance with Section 11 and the Data Processing Agreement (Annex H to our Terms and Conditions, published at https://crocky.host/legal/terms-of-services).

2.4. We process data in accordance with the GDPR, Romanian Law no. 190/2018 on measures implementing the GDPR and Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector.

3. WHAT DATA WE PROCESS, FOR WHAT PURPOSE AND ON WHAT BASIS

3.1. Visiting the website

• Data: IP address, date and time of access, pages accessed, browser and operating system type, referring page, technical errors.
• Purpose: operation and security of the website, attack detection, error diagnosis, aggregated traffic statistics based on server logs.
• Legal basis: our legitimate interest in ensuring the operation and security of the website (art. 6(1)(f) GDPR).
• Note: we do not use third-party traffic analytics tools (such as Google Analytics or Meta Pixel) and we do not engage in behavioural advertising.

3.2. Creating an account and ordering services

• Data: first and last name, company name (if applicable), postal address, e-mail address, telephone number, tax identification number and registration number (for companies), password (stored exclusively as a hash), billing currency, order history, active services, IP addresses used at login, support tickets and correspondence.
• Purpose: conclusion and performance of the contract, provision, administration and invoicing of services, technical support, operational notifications (due dates, suspensions, incidents, maintenance), account authentication and security.
• Legal basis: performance of the contract (art. 6(1)(b) GDPR); legal invoicing and archiving obligations (point (c)); legitimate interest in securing the account (point (f)).

3.3. Payments

• Data: tokenised identifier of the payment method, last four digits of the card, card type, expiry date, cardholder name, IBAN (for bank transfer or SEPA Direct Debit), transaction history, PayPal, Klarna or paysafecard references.
• Purpose: collecting payments, automatic renewal, handling refunds and payment disputes.
• Legal basis: performance of the contract (point (b)); legal accounting obligations (point (c)).
• Note: full card details are processed exclusively by the PCI-DSS certified payment processors Stripe and Mollie. We never store them.

3.4. Invoicing and tax obligations

• Data: identification and billing data, value and content of invoices, payment data.
• Purpose: issuing invoices, submitting them through the national RO e-Factura system to ANAF (the Romanian tax authority), bookkeeping, tax returns.
• Legal basis: legal obligations under the Romanian Fiscal Code, Accounting Law no. 82/1991 and e-Factura legislation (point (c)).

3.5. SMS notifications

• Data: mobile telephone number.
• Purpose: sending two-factor authentication codes, security alerts and urgent operational notifications (for example imminent suspension).
• Legal basis: performance of the contract and legitimate interest in securing the account (points (b) and (f)).
• Note: SMS messages are sent through the providers Web2SMS (Romania) and Vonage. We do not send marketing SMS.

3.6. Support, correspondence and abuse reports

• Data: name, e-mail address, content of messages, attachments, IP address and technical headers of the message; for abuse reports, the notifier's data and the reported content.
• Purpose: responding to requests, resolving technical issues, handling notices under Regulation (EU) 2022/2065 (DSA) and the Acceptable Use Policy, defending our rights.
• Legal basis: performance of the contract (point (b)) or legitimate interest in responding to requests and handling abuse (point (f)); legal obligations under the DSA (point (c)).

3.7. Identity verification

• Data: in high-risk cases, copies of the identity document (with non-essential data masked), proof of address, certificate of incorporation, confirmation of ownership of the payment instrument.
• Purpose: preventing fraud and fraudulent use of payment instruments, complying with payment processor requirements.
• Legal basis: our legitimate interest and that of third parties in preventing fraud (point (f)).
• Note: documents are deleted within 30 days at most after verification is completed, unless the law requires their retention.

3.8. Technical service logs

• Data: IP addresses and login data for control panels (cPanel, WHM, Virtualizor, Proxmox, Pterodactyl/WISP), web and mail server logs, administrative access logs, resource usage data.
• Purpose: infrastructure security, detecting and investigating incidents and abuse, diagnostics, compliance with legal obligations.
• Legal basis: legitimate interest in securing the infrastructure (point (f)); legal obligations (point (c)).

3.9. Defence of rights and compliance

• Data: any of the above data, to the extent necessary.
• Purpose: establishing, exercising or defending legal claims, handling payment disputes, responding to requests from authorities.
• Legal basis: legitimate interest (point (f)); legal obligations (point (c)).

4. FRAUD PREVENTION AND AUTOMATED DECISIONS

4.1. All orders and payments are subject to automated risk analysis through the FraudLabs Pro service (Hexasoft Development Sdn. Bhd., Malaysia). We transmit to this service: IP address, e-mail address, name, billing address, country, telephone number, partial payment instrument data (BIN, last digits), order value and device identifier. The service returns a risk score calculated by correlating these data with its own databases (IP addresses associated with proxies, VPN, Tor, temporary e-mail addresses, known fraud patterns).

4.2. The legal basis for this processing is our legitimate interest in preventing fraud and the fraudulent use of third parties' payment instruments (art. 6(1)(f) GDPR), an interest expressly recognised by recital 47 GDPR.

4.3. We do not make decisions based solely on automated processing that produce legal effects concerning you. An order flagged as high risk is always reviewed by a person before being refused, and you may request a review, express your point of view and provide additional information by writing to gdpr@crocky.host.

4.4. Risk scores are retained for 12 months from the order date, to identify repeated fraud patterns.

5. MARKETING COMMUNICATIONS

5.1. We may send our clients, by e-mail, newsletters, offers and information about new services, exclusively if: (a) they have given their consent by ticking the dedicated option when creating the account or later from the account (art. 6(1)(a) GDPR and art. 12 of Law no. 506/2004); or (b) they are existing clients to whom we present services similar to those already contracted, in which case the exception under art. 12(2) of Law no. 506/2004 applies, with the possibility to object at any time.

5.2. You may unsubscribe at any time, free of charge, via the link in each message or from the account settings. Unsubscribing does not affect operational and billing notifications, which are necessary for the performance of the contract.

5.3. We do not sell, rent or share your data with third parties for marketing purposes. We do not profile for marketing purposes.

6. WHO WE SHARE DATA WITH

6.1. We disclose data only to the extent necessary for the above purposes, to the following categories of recipients:

6.2. Providers processing data on our behalf are contractually bound to comply with the GDPR, to process data only on our instructions and to implement appropriate security measures. Payment processors, the domain registrar and registries, ANAF and authorities act as independent controllers, in accordance with their own policies.

6.3. In the event of a reorganisation, merger or sale of the business, data may be transferred to the successor, with notice to you and without affecting your rights.

7. TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA

7.1. Data stored in hosted services (websites, databases, e-mail, servers) remain exclusively in data centres within the European Union (France, Germany, Poland, the Netherlands).

7.2. The following providers process data outside the EEA, exclusively for the indicated purposes:

• FraudLabs Pro (Malaysia): fraud prevention, on the basis of the standard contractual clauses adopted by the European Commission (Decision 2021/914);
• Vonage (USA): SMS delivery, on the basis of its certification under the EU-US Data Privacy Framework and standard contractual clauses;
• Stripe: the contracting entity is Stripe Payments Europe (Ireland), but certain data may be processed by Stripe Inc. (USA), on the basis of the Data Privacy Framework and standard contractual clauses;
• Google (reCAPTCHA): the contracting entity is Google Ireland Ltd., but data may be processed by Google LLC (USA), on the basis of the Data Privacy Framework;
• gTLD registries (for example Verisign, USA) and the ICANN escrow agent: for generic domain names, in accordance with ICANN policies, on the basis of standard contractual clauses or the necessity of performing the contract (art. 49(1)(b) GDPR).

7.3. You may request a copy of the applicable safeguards at gdpr@crocky.host.

8. HOW LONG WE KEEP DATA

8.2. Upon expiry of these periods, data are deleted or irreversibly anonymised. Data may be retained longer only where the law so requires or where necessary for establishing, exercising or defending a legal claim.

9. HOW WE PROTECT DATA

9.1. We implement appropriate technical and organisational measures, including: encryption of all communications (TLS 1.2 and 1.3); storage of passwords exclusively as hashes (bcrypt); two-factor authentication for staff and available to clients; account isolation (CloudLinux CageFS and LVE, containers, virtual machines); firewall, WAF and detection systems (Imunify360, LiteSpeed WAF); network-level DDoS protection through infrastructure providers; regular security updates; daily and weekly backups in separate locations; logging of administrative access; ISO 27001 certified data centres; data access limited to persons who need it; confidentiality clauses with collaborators.

9.2. No measure guarantees absolute security. In the event of a personal data breach presenting a risk to your rights, we will notify you without undue delay, in accordance with art. 34 GDPR, and will notify the ANSPDCP within 72 hours, in accordance with art. 33 GDPR.

10. YOUR RIGHTS

10.1. Under the GDPR, you have the following rights:

• right of access (art. 15): to obtain confirmation that we process data about you and a copy thereof;
• right to rectification (art. 16): to correct inaccurate or incomplete data; most data can be updated directly from the account;
• right to erasure (art. 17): to request deletion of data when no longer necessary, when you have withdrawn consent or objected to processing, within the limits of our legal retention obligations;
• right to restriction of processing (art. 18);
• right to data portability (art. 20): to receive the data you provided in a structured, commonly used and machine-readable format;
• right to object (art. 21): to object to processing based on legitimate interest, including fraud prevention, in which case we will cease processing unless we demonstrate compelling legitimate grounds; objection to direct marketing is always accepted;
• right not to be subject to a decision based solely on automated processing (art. 22), in accordance with Section 4;
• right to withdraw consent at any time, without affecting the lawfulness of prior processing;
• right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, Bucharest, telephone +40 318 059 211, e-mail anspdcp@dataprotection.ro, website https://www.dataprotection.ro, or with the supervisory authority in your state of residence;
• right to seek a judicial remedy.

10.2. To exercise your rights, write to gdpr@crocky.host from the e-mail address associated with the account or open a ticket from the account. If the request comes from another address, we may ask for additional information to verify your identity. We respond within 30 days at most, a period that may be extended by a further 60 days for complex requests, with notice to you. Exercising your rights is free of charge, except for manifestly unfounded or excessive requests.

10.3. Deletion of data necessary for the performance of the contract (for example the e-mail address or billing data) may make it impossible to continue providing the services; in this case we will inform you before proceeding.

11. DATA CONTAINED IN HOSTED SERVICES (US AS PROCESSOR)

11.1. The websites, applications, databases, mailboxes, virtual servers, game servers and dedicated servers we host contain data that our clients upload or collect from their own users. For these data, the client is the controller and we are the processor: we store, transmit and back them up exclusively on the client's instructions and access them only to the extent strictly necessary for requested technical support, security or compliance with the law.

11.2. If you are a user of a website or service hosted by us and wish to exercise your rights regarding data processed by that website, please contact the operator of that website (usually identified in the website's privacy policy). We cannot respond on behalf of our client, but we can, at their request, support them technically.

11.3. We do not proactively monitor hosted content and have no general monitoring obligation, in accordance with Regulation (EU) 2022/2065.

11.4. The full conditions of processing as processor (subject matter, duration, nature, obligations, sub-processors, security measures, audit) are set out in the Data Processing Agreement, Annex H to our Terms and Conditions.

12. DOMAIN NAMES AND WHOIS

12.1. When registering a domain name, the data of the holder and contacts (name, address, e-mail, telephone, identification number where required) are transmitted to the registrar NETIM and to the registry of the relevant extension, which process them as independent controllers, in accordance with ICANN or registry rules. For generic domains, certain data are also transmitted to the escrow agent designated by ICANN.

12.2. Data publicly displayed in WHOIS/RDAP differ per extension. For extensions that allow it, we enable contact data protection (WHOIS privacy) by default or on request. Full details in the Domain Registration Agreement, published at https://crocky.host/legal/domain-registration-agreement.

13. COOKIES AND SIMILAR TECHNOLOGIES

13.1. The website https://crocky.host uses a minimal number of cookies: (a) strictly necessary cookies for the operation of the client platform (session, authentication, shopping cart, language preference, CSRF protection), which do not require consent under art. 4(6) of Law no. 506/2004; (b) cookies placed by Google reCAPTCHA, used to protect the registration, contact, order and login forms against bots and automated attacks, which we consider necessary for the security of the service, on the basis of our legitimate interest (art. 6(1)(f) GDPR); Google may also process the associated data for its own purposes, in accordance with its privacy policy.

13.2. We do not use analytics, advertising or cross-site tracking cookies.

13.3. The full list of cookies, their durations and how to manage them are described in the Cookie Policy, published at https://crocky.host/legal/cookie-policy.

14. MINORS

14.1. Our services are intended for persons aged 18 or over. We do not knowingly collect data from minors. If we learn that a minor has provided us with data without the consent of their legal representative, we delete them as soon as possible. Parents or guardians may contact us at gdpr@crocky.host.

15. CHANGES TO THIS POLICY

15.1. We may update this policy to reflect changes in processing, providers or legislation. The current version, with the date of last update, is permanently published at https://crocky.host/legal/privacy-policy. Significant changes are notified by e-mail or by display in the account at least 30 days before they take effect, except those required by law.

15.2. The policy is drafted in Romanian; translations, including this English version, are for information purposes.