Privacy Policy

This policy is provided in compliance with Articles 13 and 14 of Regulation (EU) 2016/679 (hereinafter, the "GDPR") and of Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter, "LOPDGDD"). The information is provided in a concise, transparent, intelligible and easily accessible manner, using clear and plain language (Art. 12.1 GDPR).

1. Data controller

The controller of the personal data collected through the turbohost.es website and the associated services is:

No Data Protection Officer (DPO) has been appointed, as the conditions for mandatory designation under Art. 37 GDPR and Art. 34 LOPDGDD do not apply: the activity does not involve large-scale systematic monitoring nor the large-scale processing of special categories of data. For any matter relating to data protection, you may contact the controller through our contact form. The full identifying details of the provider are also set out in the Legal Notice.

2. Data we collect

In the course of providing the services, TurboHost processes the following categories of personal data:

• Identifying and billing data: name, email address, NIF/CIF (tax identification number) and postal address, required to manage the order, the registration of the service and billing.
• Payment data: handled entirely by Stripe (Stripe Payments Europe, Ltd. / Stripe, Inc.). TurboHost does not store card data or bank details; Stripe processes the data needed to handle the charge, invoices and subscriptions.
• Domain data: domain name and holder contact details required to register the .es domain through the registrar DonDominio.
• Mailbox content: with regard to the content of the email mailboxes hosted on TurboHost's infrastructure, the client is the data controller and TurboHost acts as data processor (Art. 28 GDPR).
• Browsing data: aggregated and anonymous statistics obtained through a self-hosted instance of Umami Analytics, without cookies and without identifiable personal data (no IP addresses are collected and no cross-site tracking is performed). In addition, subject to your consent, usage and navigation data are processed through Google Analytics 4 by means of analytics cookies (_ga, _ga_<id>), which involve pseudonymous identifiers, approximate location and device/browser information. These analytics cookies are only set if you accept them via the cookie banner.

Source of the data (Art. 14 GDPR): as a general rule, personal data are collected directly from the data subject. Where certain data are not obtained from the data subject, the controller will indicate their origin and provide the information required by Art. 14 GDPR.

3. Purposes of the processing

• Provision of the service: management of the order, registration and configuration of the domain, provisioning and maintenance of the email mailboxes.
• Billing and payments: issuance of invoices, management of subscriptions and charges through Stripe, and compliance with accounting and tax obligations.
• Customer care and support: handling requests for technical and administrative assistance, as well as responding to enquiries submitted through the contact form.
• Service communications: notices relating to the status of the service, expirations and renewals, maintenance and security communications.
• Security and improvement of the service: prevention of fraud and abuse and anonymous, aggregated analysis of the use of the site.

4. Legal basis for the processing (legitimisation)

• Performance of a contract or pre-contractual measures (Art. 6.1.b GDPR): for the provision of the domain and email service, account management and billing, as well as to handle requests made through the contact form.
• Compliance with a legal obligation (Art. 6.1.c GDPR): for compliance with the accounting, commercial and tax obligations applicable in Spain (in particular, Art. 30 of the Commercial Code, Law 58/2003 General Tax Law and Law 37/1992 on VAT).
• Consent of the data subject (Art. 6.1.a GDPR): for the use of non-exempt analytics cookies (in particular Google Analytics 4) and any other non-exempt cookies, and for sending commercial communications where applicable. Such analytics processing only takes place if the data subject accepts via the cookie banner, and consent may be withdrawn at any time (see section 8).
• Legitimate interest of the controller (Art. 6.1.f GDPR): to ensure the security and integrity of the service and to prevent fraud and abuse, following a balancing exercise against the rights and freedoms of the data subjects.

As regards cookies, the site uses a cookieless analytics solution (a self-hosted Umami instance) and only technical cookies that are exempt from consent in accordance with Art. 22.2 LSSI-CE. Additionally, where the data subject grants consent through the cookie banner, the site uses Google Analytics 4 analytics cookies; these are non-exempt cookies that are only set after consent and may be withdrawn at any time (see Cookie Policy).

5. Recipients of the data and data processors

Personal data may be disclosed to the following third parties, exclusively for the purposes indicated. Providers that process data on behalf of the controller act as data processors and are bound by a contract in accordance with Art. 28 GDPR:

• Stripe Payments Europe, Ltd. / Stripe, Inc. — management of payments, billing and subscriptions. TurboHost does not store card data.
• DonDominio (Soluciones Corporativas IP, S.L.U.) — Spanish registrar of .es domains, through which the domain registration is processed.
• Amazon Web Services EMEA SARL (AWS SES) — SMTP relay for outbound email, in the EU region (eu-west-1, Ireland).
• Cloudflare, Inc. — hosting of the website, DNS and orders database (Workers, D1, KV).
• Resend, Inc. — sending of transactional email (service confirmations and notifications).
• Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), with processing by Google LLC (USA) — Google Analytics 4 web analytics, only where the data subject has given consent through the cookie banner.
• PostHog Inc. (EU region, Frankfurt): analytics of the purchase and activation funnel. Data: visitor identifier, site and dashboard usage events, customer email and plan. Legal basis: consent (browser cookies) and legitimate interest in improving the contracted service (server events linked to the order).

Web analytics is carried out through a self-hosted Umami instance, hosted by the controller, which does not use cookies or collect identifiable personal data; there is no transfer of data to any Umami entity. In addition, subject to the data subject's consent, web analytics is also carried out through Google Analytics 4 (Google Ireland Limited, with processing by Google LLC in the United States), which acts as a recipient/data processor for analytics purposes and uses analytics cookies. Google Analytics operates under Google Consent Mode: until consent is given — and if it is refused — it transmits only aggregated, cookieless signals to Google, without setting cookies or using identifiers; cookie-based analytics processing takes place only after acceptance and may be withdrawn at any time. The content of the email mailboxes is hosted on the controller's own infrastructure (mail server mail.turbohost.es, Modoboa software). TurboHost does not sell, rent or transfer users' personal data to third parties for marketing purposes.

6. International data transfers

Some of the providers indicated are based or may process data outside the European Economic Area, in particular in the United States:

• Stripe, Inc. and Cloudflare, Inc. (USA): the transfers are covered by the EU-US Data Privacy Framework and/or by the Standard Contractual Clauses (SCC) adopted by the European Commission through Implementing Decision (EU) 2021/914 (Art. 46.2.c GDPR).
• Google (Google LLC, USA): where Google Analytics 4 is used on the basis of consent, the related data may be transferred to the United States; such transfers are covered by the EU-US Data Privacy Framework and/or by the Standard Contractual Clauses (SCC) adopted by the European Commission (Art. 46 GDPR).
• AWS SES: outbound email is processed in the European Union region (eu-west-1, Ireland).

The data subject may request a copy of the safeguards adopted by writing through our contact form.

7. Retention period

• Account data: for the duration of the contractual relationship.
• Billing data and accounting documentation: for the applicable legal periods. In particular, accounting documentation and supporting records (including invoices) are retained for 6 years from the last entry pursuant to Art. 30 of the Commercial Code; the 4-year tax limitation period under Arts. 66 et seq. of Law 58/2003 General Tax Law also applies. The longer applicable period prevails.
• Mailbox content: until the service is terminated plus a reasonable grace period, after which it is permanently deleted.
• Data collected through the contact form: for the time necessary to handle the request and, where applicable, until a contractual relationship is formalised.
• Analytics (Umami): aggregated and anonymous data; no identifiable personal data are retained.
• Analytics (Google Analytics 4): where consent is given, data are retained according to the retention period configured in Google (e.g. up to 14 months for event data) and for the duration of the relevant cookies (the _ga cookie lasts up to 2 years).

8. Rights of the data subject

In accordance with Arts. 15 to 22 of the GDPR and the LOPDGDD, the data subject has the right to:

• Access (Art. 15): to know what personal data are being processed.
• Rectification (Art. 16): to request the correction of inaccurate or incomplete data.
• Erasure (Art. 17): to request the deletion of their data, on the terms provided for in the regulations.
• Restriction of processing (Art. 18): to request the restriction of processing in the cases provided for by law.
• Objection (Art. 21): to object at any time to processing based on legitimate interest or for direct marketing purposes.
• Portability (Art. 20): to receive their data in a structured, commonly used and machine-readable format.
• Withdrawal of consent (Arts. 7.3 and 13.2.c GDPR): where the processing is based on consent, to withdraw it at any time without affecting the lawfulness of processing carried out prior to its withdrawal.

To exercise these rights, the data subject may send a request through our contact form, stating their request and proving their identity. TurboHost will respond within the periods provided for in the GDPR (as a general rule, one month, extendable in the permitted cases).

9. Supervisory authority

The data subject has the right to lodge a complaint with the competent supervisory authority, in accordance with Arts. 13.2.d and 77 of the GDPR. In Spain, the competent supervisory authority is:

The data subject may turn to the AEPD, in particular, where they consider that the processing of their data infringes the applicable regulations, without prejudice to the possibility of first contacting the controller.

10. Security

Appropriate technical and organisational measures are applied to protect personal data against unauthorised access, loss or destruction. The website and the panels are served over an encrypted HTTPS connection, and the email service applies the industry-standard email authentication measures (SPF, DKIM and DMARC).

11. Changes to this policy

TurboHost reserves the right to update this Privacy Policy at any time. Changes will be published on this page with an indication of the date of the last update. In the event of substantial changes, registered users will be informed by email.

This document has been drafted for informational purposes and does not constitute legal advice. We recommend consulting a professional to verify its compliance with the applicable regulations. This is a translation of the original Spanish text; in the event of any discrepancy, the Spanish version shall prevail.