1. CONTROLLER
The controller responsible for processing personal data in connection with the Hosting Panel is:
Pos-IT e.U.
Owner: Benjamin Pos
Herbststraße 71-75/8/2
1160 Vienna
Austria
Email: office@pos-it.at
Telephone: +43 664 2345701
Legal notice: https://pos-it.at/impressum/
Privacy enquiries and requests to exercise data subject rights may be sent to office@pos-it.at.
2. SCOPE
This Privacy Policy applies to the Pos-IT Hosting Panel, its login, customer, reseller and administration areas, and the associated background processes and interfaces.
The Hosting Panel is used in particular to manage customer accounts, hosting services, domains and DNS records, server information, contracts, invoices, payments, documents, roles and security functions.
The Privacy Policy published at https://pos-it.at/impressum/ also applies to the general Pos-IT corporate website and the content or services used there.
3. PURPOSES AND LEGAL BASES
Personal data is processed only where necessary to provide and secure the Hosting Panel, take steps prior to entering into a contract, perform contracts, process billing, provide customer support or comply with legal obligations.
Depending on the specific processing activity, the following legal bases apply in particular:
- Article 6(1)(b) GDPR for pre-contractual steps, contract administration, service delivery, billing and requested support services;
- Article 6(1)(c) GDPR for statutory documentation, retention, tax and evidence obligations;
- Article 6(1)(f) GDPR for secure, stable and economical operation, error analysis, prevention of misuse and the establishment, exercise or defence of claims;
- Article 6(1)(a) GDPR where voluntary consent is requested for an optional function.
Consent may be withdrawn at any time with effect for the future. This does not affect the lawfulness of processing carried out before the withdrawal.
4. TECHNICAL ACCESS AND LOG DATA
When the Hosting Panel is accessed, technically necessary data may be processed, including the IP address, date and time, requested address, HTTP method, response status, browser and device information, referrer, session identifier, and error and security events.
This data is required to deliver pages and functions, secure logins, investigate errors, and detect and prevent attacks and unauthorised access. Technical logs are deleted regularly. They are stored for longer only where necessary to investigate a specific security incident, preserve evidence or comply with a legal obligation.
5. USER ACCOUNTS, ROLES AND SECURITY
The following data in particular may be processed for user accounts:
- name, email address and internal user identifier;
- password hash, verification and login information;
- language, organisational position and technical system role;
- customer, reseller and team assignments and permissions;
- invitation, approval and account status;
- two-factor secret, confirmation time and protected recovery codes if the function is enabled;
- security locks, administrative measures and associated evidence.
Passwords are not stored in plain text. Technical roles determine access rights; a displayed company position does not automatically extend permissions. Security-relevant actions may be recorded with the acting user, time, reason and accompanying technical data.
Accounts are created or invited by Pos-IT or an appropriately authorised person. Registration or invitation alone does not create an entitlement to a particular role or activation.
6. CUSTOMER, RESELLER AND MASTER DATA
The following data in particular may be processed to manage customer relationships: customer name and number, company name, department, VAT number, billing type, address, country, user assignments, responsibilities and approved support permissions.
For reseller relationships, the assignment between a reseller and the supported customer and the roles and permissions granted for that purpose are also processed. Resellers can only view data and functions assigned to their tenant where permitted by their technical authorisation.
This data is processed to establish and administer the customer relationship, perform contracts, issue invoices and clearly assign services and contacts.
7. HOSTING, DOMAIN, DNS AND SERVER DATA
The Hosting Panel may process data relating to booked services, plans, storage and usage allowances, domains, DNS zones and records, technical destination addresses, servers, services, status values and metrics.
DNS and server data may be personal data in individual cases, for example where domain names, host names, IP addresses or technical contacts can be linked to a natural person. Changes and synchronisation processes may be recorded with before-and-after values, results, error text and the acting user.
Where an external DNS, data centre or infrastructure provider is used for the commissioned service, the data necessary for delivery is transmitted to that provider.
8. CONTRACTS, DOCUMENTS AND INVOICES
The following data in particular may be processed for contract and billing administration: contract and customer numbers, service items, prices, discounts, terms, cancellation requests, reasons, approvals, invoice data, payment references, due dates, payment status and delivery evidence.
Uploaded contract documents and final invoice PDFs are stored in a protected archive. File name, file type, file size, checksum, version, uploader and time may also be stored. Changes and approvals may be documented in an audit history containing the user, role, IP address and browser identifier.
This data is processed to perform contracts, provide traceable billing and customer information, preserve evidence and comply with statutory retention obligations.
9. PAYMENT AND BANK DATA
Depending on the agreed payment method, bank transfer, SEPA direct debit or recurring card payment may be supported.
For SEPA direct debits, the account holder, IBAN, BIC, mandate type, mandate reference and signature date may be processed and included in payment files. Bank statement imports may process booking date, amount, currency, remittance information, counterparty account, account holder and technical import data in order to allocate payments to invoices.
When a direct EBICS connection is used, the Hosting Panel communicates with the bank configured by Pos-IT. Credentials and key material are used only for bank communication and stored in protected storage areas.
If an optional open-banking connection is expressly activated, the account information approved for the connection and retrieval is processed through the provider identified during setup. The provider, data scope and applicable terms must be reviewed separately before activation.
Stripe may be used for card payments. Full card details are entered on a payment page provided by Stripe. The Hosting Panel stores in particular provider customer and payment method identifiers, card brand, last four digits, expiry month and year, status, consent evidence and payment attempts. Full card numbers and card verification codes are not stored in the Hosting Panel.
10. EMAILS, NOTIFICATIONS AND SUPPORT
The Hosting Panel may send emails and notifications concerning invitations, logins, security events, contracts, invoices and payments. This may involve processing the recipient address, subject, message text, dispatch time, status and any errors.
When support is requested, we process the contact, contract and technical information provided to the extent necessary to handle the request. Emails may be delivered through the mail service provider configured by Pos-IT.
11. COOKIES, SESSIONS AND BROWSER STORAGE
The Hosting Panel uses technically necessary cookies, in particular for sessions, login, CSRF protection and, where selected, the “remember me” function. Protected areas cannot be provided securely without these cookies.
Language, colour scheme, text size, contrast and colour perception settings may be stored in the session or the browser's local storage. These settings are used solely for usability and display and can be deleted using browser functions.
Under its current functionality, the Hosting Panel does not use analytics or marketing cookies. If optional services requiring consent are added in the future, they will be activated only after appropriate information has been provided and consent obtained.
Bunny Fonts may be embedded to display the typeface. When font files are retrieved, the service technically receives the IP address and browser information in particular. The font is embedded to provide a consistent and efficient presentation of the service on the basis of our legitimate interest in a user-friendly interface.
12. RECIPIENTS AND PROCESSORS
Within Pos-IT, access is restricted to persons who require it for their duties and whose system role permits it. In addition, data may be transmitted, to the extent necessary for the relevant purpose, to the following categories of recipients:
- hosting, data centre, backup and infrastructure service providers;
- email and communications service providers;
- DNS and domain providers;
- banks, EBICS participants and payment service providers;
- tax advisers, accounting providers and legal or technical advisers;
- public authorities, courts or other bodies where disclosure is legally required.
Personal data is not sold. Service providers are selected in accordance with legal requirements and, where required, contractually engaged as processors.
13. PROCESSING OUTSIDE THE EEA
Individual technical or payment service providers may process data outside the European Union or European Economic Area. Such transfers take place only where the legal requirements are met, in particular on the basis of an adequacy decision or appropriate safeguards such as the EU Standard Contractual Clauses.
Whether a third-country transfer takes place depends on the providers actually activated, their infrastructure and the selected function. Further information is available in the privacy information of the relevant provider.
14. RETENTION AND ERASURE
Personal data is stored only for as long as necessary for the relevant purpose. The following criteria apply in particular:
- account data until the account is deactivated or deleted, unless further retention is required;
- contract, invoice, payment and accounting data in accordance with statutory retention periods;
- documents and audit evidence for as long as required for contract administration, evidence or the defence of claims;
- technical logs and error messages only for the period necessary for operation and security;
- data in backups until scheduled overwriting, unless longer preservation is required.
Once the purpose no longer applies, data is erased or anonymised unless a legal obligation or overriding legitimate reason requires continued storage.
15. DATA SUBJECT RIGHTS
Subject to the applicable legal requirements, data subjects have the right in particular to access, rectification, erasure, restriction of processing, data portability and objection. Where processing is based on consent, that consent may be withdrawn at any time for the future.
Proof of identity may be required when handling a request to prevent personal data from being disclosed or changed for an unauthorised person. Requests may be sent to office@pos-it.at.
16. RIGHT TO LODGE A COMPLAINT
Data subjects have the right to lodge a complaint with a data protection supervisory authority. In Austria, this is in particular the Austrian Data Protection Authority, available at https://www.dsb.gv.at/.
17. DATA SECURITY
Pos-IT uses appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration and disclosure. Depending on the protection required, these measures include encrypted transmission, role-based access, password hashing, two-factor authentication, security locks, logging, separate archives and backups.
No technical system can guarantee absolute security. Security-related anomalies or suspected unauthorised access should be reported immediately to office@pos-it.at.
18. CHANGES AND LANGUAGE VERSIONS
This Privacy Policy may be updated when functions, providers or legal requirements change. The version currently published in the Hosting Panel applies.
The German and English versions serve the same information purpose. In the event of differences in interpretation, the German version prevails to the extent legally permissible.