Privacy Notice
1. Who we are
NLH is a brand of Northlight Ventures s. r. o., a company registered in the Slovak Republic, Jesenského 3500/51, 080 01 Prešov, IČO 57 946 230 ("we", "us"). We are the controller of the personal data described in sections 2 to 6, and a processor for the data described in section 7.
Questions about this notice go to privacy@nlh.sk or hello@nlh.sk. We have not appointed a data protection officer; we are below the thresholds that require one.
2. What we collect and why
| When | What | Why |
|---|---|---|
| You enquire through the website or by email | Name, company, email address, phone number if you give it, what you tell us about your setup | To reply to you and, if you ask, to quote |
| You become a client | Billing name and address, VAT number, the domains and services on your account, invoices and payment records, support correspondence | To provide the service, invoice you, meet tax and accounting law, and keep a record of what was agreed |
| You pay | Card or bank details are collected and held by Stripe, not by us. We see the last four digits, the card brand and the payment result | To take payment |
| You use the control panel or client area | Login email, login times, IP addresses, actions taken in the panel | Security, abuse prevention and support. This is also our record if something goes wrong |
| You contact support | What you send us, including screenshots or files | To fix the problem and to keep a history of your account |
| Your site or mailbox receives traffic | Server logs: IP addresses, requested URLs, timestamps, user agents, mail transaction logs | Security, debugging, abuse handling and capacity planning |
We do not buy data about you, we do not profile you, and we do not sell or rent your data to anyone.
3. Legal bases
- Contract (Art. 6(1)(b) GDPR) — everything needed to provide the service you've bought, invoice it and support it.
- Legal obligation (Art. 6(1)(c)) — keeping invoices and accounting records for the period Slovak tax law requires.
- Legitimate interests (Art. 6(1)(f)) — security logging, abuse prevention, replying to enquiries, and keeping a reasonable record of our relationship. We have weighed these against your interests; none of them involves anything you wouldn't expect from a hosting provider.
- Consent (Art. 6(1)(a)) — only where we ask for it explicitly, for example if we ever send a newsletter. We don't at present.
4. Who processes data on our behalf
We use a small number of suppliers to run the service. Each is bound by a data processing agreement and may only use your data to provide their service to us.
| Supplier | What they do | Where |
|---|---|---|
| netcup GmbH (Germany) | The server your websites run on | Vienna, Austria |
| Openprovider B.V. (Netherlands) | Mailboxes and webmail | EU data centres operated on Google Cloud — see section 5 |
| Stripe Payments Europe Ltd (Ireland) | Payment processing | EU, with Stripe's own transfer safeguards for its US group companies |
| WHMCS Ltd | Billing and client area software | Vienna, Austria (netcup) |
| Enhance Technologies Ltd | Control panel software licensed to run on our server | Runs on our server in Vienna; licence verification only |
| Cloudflare, Inc. — DNS only, EU and global anycast | Serving DNS records | Global — DNS records are public by nature |
We also share data where the law requires it, for example with the tax authority, or with a court or regulator on a valid request. We will tell you if we are allowed to.
5. Where data is stored
Website hosting data — your sites, databases and server logs — is stored on hardware in Vienna, Austria, operated by a German company. It does not leave the EU.
Mailbox data is stored in EU data centres by Openprovider, which runs its service on Google Cloud's European regions. Google is a US company. Openprovider's arrangements with Google rely on the EU–US Data Privacy Framework and Standard Contractual Clauses. We say this plainly because it is true: mail is in the EU and GDPR-compliant, and it is not run by an EU-only operator. If that matters to you, tell us before onboarding.
Billing data is held by Stripe in the EU, with Stripe's standard safeguards for its US group.
6. How long we keep it
- Enquiries that don't become clients: 12 months, then deleted.
- Account and service data: for the life of the account, then 90 days to allow for reinstatement, then deleted. Backups containing it expire on their own schedule, at most a further 30 days.
- Invoices and payment records: 10 years, as Slovak accounting law requires.
- Server and mail logs: 90 days, unless needed longer for a specific security incident.
- Support correspondence: for the life of the account plus 12 months.
7. Your clients' data on our platform
If you host a website or mailboxes with us that hold other people's personal data — your customers, your staff, your visitors — then you are the controller and we are your processor. We process that data only on your instructions, as set out in our Terms of Service and the data processing terms within them. We don't look at it except where needed to provide support you've asked for, to deal with abuse, or where the law requires. You are responsible for having a lawful basis to collect it and for telling your own users what you do with it.
8. Your rights
Under GDPR you can ask us to: give you a copy of your data; correct it; delete it; restrict what we do with it; give it to you in a portable format; and object to processing based on legitimate interests. Where processing is based on consent, you can withdraw it at any time. Write to privacy@nlh.sk. We reply within one month, and we'll ask you to confirm your identity first if we need to.
Some data we can't delete on request — invoices during the retention period, for example — and we'll tell you if that applies.
9. Cookies and this website
This website sets no cookies and uses no analytics. It loads fonts from Google Fonts, which involves a request to Google's servers; Google's handling of that request is covered by Google's privacy policy. The latency figure on the homepage is measured by your browser against our own server and is not recorded anywhere.
The client area and control panel set cookies that are strictly necessary to keep you logged in. They are not used for tracking.
10. Contact and complaints
Write to privacy@nlh.sk, or to Northlight Ventures s. r. o., Jesenského 3500/51, 080 01 Prešov.
If you're not satisfied with our answer, you can complain to the Slovak supervisory authority: Úrad na ochranu osobných údajov Slovenskej republiky, Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk. You can also complain to the authority in your own EU country.
We'll update this notice when the service changes. The version number and date at the top tell you which one you're reading.