1. Who we are and what this Policy covers
1.1The controller of your personal data is MonsterASP.NET s.r.o., Jicinska 226/17, 130 00 Prague, Czech Republic, Company ID 21693421 (“MonsterASP”, “we”, “us” or “our”). You can contact us regarding personal data at support [at] monsterasp [dot] net or through the support ticket system in the control panel.
1.2This Privacy Policy describes how we process personal data of visitors of the website www.monsterasp.net (the “Site”) and of persons who register a customer account or use our hosting services (the “Services”), in accordance with Regulation (EU) 2016/679 (the “GDPR”) and Czech Act No. 110/2019 Coll. on personal data processing.
1.3This Policy forms part of our Terms of Service. Terms not defined here have the meaning given to them in the Terms of Service.
1.4Data hosted by our customers. This Policy does not apply to personal data that our customers or their users store or process through the Services (for example in customer websites, applications, databases or mailboxes). With respect to such data, the customer is the controller and we act only as a data processor on the customer’s instructions, under the Data Processing Agreement that forms part of the Terms of Service. If you are a user of a website or application hosted by one of our customers, please contact that customer directly regarding your personal data; we are not in a position to respond to such requests ourselves and will forward them to the customer.
2. What personal data we process, why and on what legal basis
We process personal data only for the purposes listed below. For each purpose we state the categories of data, the legal basis under Article 6 GDPR and the retention period.
| Purpose | Data | Legal basis | Retention |
|---|
| Registration and administration of your customer account |
E-mail address, password (stored only as a salted cryptographic hash), account identifiers, IP address, user agent and time of registration and of each login, two-factor authentication settings, session data, account settings and history of actions in the control panel |
Performance of a contract (Art. 6(1)(b)); legitimate interest in account security (Art. 6(1)(f)) |
For the duration of the account and 90 days after its termination; login and control panel security logs 12 months |
| Provision of the Services |
Account data, ordered Services, domain names, usernames of hosting accounts, technical configuration, resource usage statistics |
Performance of a contract (Art. 6(1)(b)) |
For the duration of the Service and 90 days after its termination |
| Billing, invoicing and accounting |
Name or company name, billing address, country, VAT identification number, e-mail address, invoices, payment history and payment status, last four digits and type of payment card (we never store full card numbers) |
Performance of a contract (Art. 6(1)(b)); legal obligation under tax and accounting law (Art. 6(1)(c)) |
10 years from the end of the tax year in which the invoice was issued, as required by Czech accounting and VAT law |
| Customer support and communication |
Content of support tickets and e-mails, contact form submissions, attachments, e-mail address, account identifiers, IP address and time of submission |
Performance of a contract (Art. 6(1)(b)); legitimate interest in resolving requests and keeping records of communication (Art. 6(1)(f)) |
For the duration of the account and 90 days after its termination; contact form submissions from non-customers 12 months |
| Security, fraud prevention and abuse protection |
IP address, approximate geographic location and network operator derived from the IP address, IP and e-mail reputation scores, detection of proxy, VPN, Tor or datacenter connections, user agent, registration and login attempts, intrusion-detection events, blocked requests |
Legitimate interest in protecting our infrastructure, other customers and ourselves against fraud, abuse and attacks (Art. 6(1)(f)) |
Security and intrusion-detection logs 12 months; records of rejected registrations 12 months |
| Operation of the Site and Services (server logs) |
IP address, date and time, requested URL, HTTP status, bytes transferred, user agent, referrer; for mail, FTP/SFTP and database servers also login name, sender and recipient addresses and result of the connection |
Legitimate interest in operating, securing and troubleshooting the Site and Services (Art. 6(1)(f)) |
6 months |
| Service e-mails |
E-mail address, account identifiers, information about ordered Services |
Performance of a contract (Art. 6(1)(b)); legitimate interest in informing customers about matters affecting their Services (Art. 6(1)(f)) |
For the duration of the account |
| Establishment, exercise or defence of legal claims |
Account, billing, communication and log data relevant to a dispute or claim |
Legitimate interest (Art. 6(1)(f)) |
For the duration of the limitation period of the relevant claims, typically 3 years, or until the dispute is finally resolved |
2.1Providing the data marked as necessary during registration and ordering (e-mail address, billing details) is a contractual requirement. Without it we cannot create your account or provide the Services.
2.2We do not use your personal data for direct marketing and we do not send newsletters. The e-mails we send are service messages relating to your account, your Services, security, billing and changes to our terms; they are part of the Services and cannot be opted out of while your account is active.
2.3We do not sell, rent or trade your personal data, and we do not share it with third parties for advertising or profiling purposes.
3. Fraud and abuse screening during registration
3.1To protect our platform against fraud and abuse, registrations and orders are screened automatically. The screening evaluates the reputation of the IP address and e-mail address used, whether the connection comes from a proxy, VPN, Tor or datacenter network, the country of origin and the number of recent registrations from the same network.
3.2The screening does not decide on its own whether you may use our Services. It only flags registrations and orders that appear risky for manual review by our team, who make the final decision. If your registration or order has been held or declined and you believe this was in error, you may contact us at support [at] monsterasp [dot] net and we will look into it.
4. Who receives your personal data
4.1Within MonsterASP, access to your personal data is limited to persons who need it to perform their duties and who are bound by confidentiality.
4.2We use the following categories of processors and recipients, each bound by a written contract and processing data only on our instructions:
| Recipient | Purpose | Location |
|---|
| Hetzner Online GmbH, Germany | Datacenters and servers on which the Site, the control panel, our internal systems and the Services run | Germany and Finland (EU); United States only for Services that the customer chooses to operate in the USA location |
| FIBERSTATE, LLC, United States | Datacenter and servers for Services that the customer chooses to operate in the USA location | United States |
| Stripe Payments Europe, Ltd. and Stripe, Inc. | Processing of card and other online payments; Stripe receives your name, e-mail address, billing address and payment details directly and acts as an independent controller for the payment transaction under its own privacy policy | EU; United States |
| Cloudflare, Inc. | Bot protection (Turnstile) on the registration and contact forms; Cloudflare processes the IP address and browser characteristics of visitors of these forms | EU; United States |
| Anti-fraud service provider | Reputation checks of the IP address and e-mail address used during registration and ordering (see section 3); the provider receives the IP address and e-mail address | EU; United States |
| External accountant | Bookkeeping, tax returns and statutory accounting; receives invoices and billing data | Czech Republic |
4.3System and service e-mails are sent exclusively from our own mail servers; we do not use third-party e-mail marketing or delivery services.
4.4We may disclose personal data to public authorities, courts, law enforcement agencies or other third parties where we are legally obliged to do so, where it is necessary to comply with a valid legal order, or where it is necessary to protect our rights, property or safety, or those of our customers or the public, for example in connection with abuse reports.
4.5In the event of a merger, acquisition or sale of our business or assets, personal data may be transferred to the successor, who will be bound by this Policy.
5. Transfers outside the European Economic Area
5.1We store and process your account, billing and support data in the European Union. Some of our processors listed in section 4 are established in, or may access data from, the United States. Such transfers are based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the Standard Contractual Clauses adopted by the European Commission, together with additional safeguards where appropriate.
5.2If you choose to operate your Services in our USA datacenter location, the data of those Services is stored in the United States on your instruction. Your own account and billing data remain in the European Union.
5.3You may request a copy of the safeguards used for a particular transfer at support [at] monsterasp [dot] net.
6. Cookies and similar technologies
6.1The Site and the control panel use only cookies that are strictly necessary for their operation. These cookies do not require your consent under Article 89 of the Czech Electronic Communications Act and Article 5(3) of Directive 2002/58/EC. We do not use analytics, advertising or tracking cookies, and we do not use third-party analytics services.
| Cookie | Purpose | Duration |
|---|
| Session cookies (ASP.NET session and authentication) | Keeping you signed in to the control panel and maintaining the state of forms and wizards | Session, or up to 90 days when you choose “remember me” |
| Anti-forgery and security cookies | Protection of forms against cross-site request forgery and session hijacking | Session |
| Cloudflare Turnstile | Bot protection on the registration and contact forms | Session |
6.2You can delete or block cookies in your browser settings. Blocking the necessary cookies will prevent you from signing in to the control panel and from using some parts of the Site.
7. How we protect your data
7.1We implement technical and organisational measures appropriate to the risk, including: TLS encryption of data in transit available for the Site, the control panel and all Services (HTTPS, FTPS/SFTP, encrypted database and e-mail connections), which you may use for your own websites and connections; storage of passwords only as salted cryptographic hashes; optional two-factor authentication for customer accounts; role-based and need-to-know access for our staff, protected by individual credentials and multi-factor authentication; network segmentation and firewalls; intrusion detection and automated blocking of malicious traffic; antivirus and endpoint detection on our servers; regular security updates; and backups stored in access-controlled, separate locations.
7.2Our infrastructure is located in ISO/IEC 27001 certified datacenters. No method of transmission over the Internet or of electronic storage is completely secure; we therefore cannot guarantee absolute security, but we will notify you and the competent supervisory authority of a personal data breach affecting you where and when the GDPR requires it.
7.3You are responsible for keeping your account credentials confidential and for the security of the applications and content you host with us.
8. Your rights
8.1Under the GDPR you have the right to:
- access your personal data and obtain a copy of it, together with information about how we process it;
- rectification of inaccurate or incomplete data; most account and billing data can be updated directly in the control panel;
- erasure of your data where it is no longer needed for the purposes described above, subject to our legal retention obligations (in particular for invoices) and to the defence of legal claims;
- restriction of processing in the circumstances set out in Article 18 GDPR;
- data portability of the data you have provided to us and which we process on the basis of a contract, in a structured, commonly used and machine-readable format;
- object to processing based on our legitimate interests on grounds relating to your particular situation; we will then stop the processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms;
- withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before the withdrawal;
8.2To exercise your rights, contact us at support [at] monsterasp [dot] net or through a support ticket. We may ask you to verify your identity, typically by writing from the e-mail address registered on your account. We respond within one month; this period may be extended by two further months where necessary, in which case we will inform you. Exercising your rights is free of charge unless requests are manifestly unfounded or excessive.
8.3Please note that deleting your account or requesting erasure results in the termination of your Services and the deletion of the data hosted in them in accordance with the Terms of Service. Export any data you wish to keep before making such a request.
8.4You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement. The supervisory authority in the Czech Republic is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, www.uoou.gov.cz. We would appreciate the opportunity to address your concerns before you approach the authority.
9. Children
9.1Our Site and Services are intended for adults. We do not knowingly collect personal data from persons under 18 years of age without the involvement of a parent or legal guardian. If you believe that a minor has provided us with personal data without such involvement, please contact us and we will delete the data.
10. Links to other websites
10.1The Site may contain links to third-party websites, including websites operated by our customers and by our payment provider. We are not responsible for the privacy practices or the content of those websites. Please review their privacy policies before providing them with personal data.
11. Changes to this Policy
11.1We may update this Policy from time to time to reflect changes in law, in our Services or in our processing activities. The current version is always published at www.monsterasp.net/Privacy/. We will notify registered customers of material changes by e-mail or through the control panel before they take effect. Your continued use of the Site or Services after the changes take effect constitutes acknowledgement of the updated Policy.
12. Contact
12.1If you have any questions about this Policy or about how we handle your personal data, please write to support [at] monsterasp [dot] net, submit a support ticket in the control panel, or use our contact form. Postal address: MonsterASP.NET s.r.o., Jicinska 226/17, 130 00 Prague, Czech Republic.