Privacy Policy

Controller: Kever IT di Colaizzi Edwin
Registered office: Viale delle Rimembranze 33, 21052 Busto Arsizio (VA), Italy
VAT ID: IT03794450126 — REA: VA-367924
Privacy / general email: support@keverhosting.com
Billing: billing@keverhosting.com
Abuse: abuse@keverhosting.com
Client Area: https://central.keverhosting.com

No Data Protection Officer (DPO) is currently appointed under GDPR Article 37, as the conditions are not met. To exercise the rights in Article 8, write to the contacts above.

We may process data relating to:

• Website visitors (browsing, information requests);
• Customers and Client Area users (contract, billing, support);
• Representatives / contacts of business customers;
• Abuse reporters and persons mentioned in reports.

Data categories, depending on context:

• identification and contact data (name, company name, address, email, phone);
• tax and billing data (VAT / tax code, billing address, payment details tokenised by the payment provider);
• account data (username, access logs, tickets, preferences);
• technical browsing data (IP, user agent, referrer, timestamp) and, with consent where required, cookies/analytics;
• content of communications with support;
• data required for domain registration (including WHOIS/RDAP data required by the registry);
• system and security logs strictly necessary to deliver and protect the Services.

We do not normally require special categories of data (GDPR Art. 9). If spontaneously provided (e.g. in a ticket), we process them only to handle the request and within legal limits.

3.1 Contract performance and pre-contractual steps (GDPR Art. 6.1.b)

• managing Orders, activation, renewal and termination of Services;
• creating and managing the Client Area account;
• delivering hosting, VPS, email, domains, SSL and add-ons;
• technical support and tickets;
• invoicing, payments, reminders, credit management.

3.2 Legal obligations (GDPR Art. 6.1.c)

• tax, accounting and AML duties where applicable;
• responding to competent authorities;
• mandatory document retention.

3.3 Legitimate interest (GDPR Art. 6.1.f)

• network security and prevention of abuse, fraud and incidents;
• service improvement and aggregated usage analysis (anonymised/pseudonymised where possible);
• judicial and extrajudicial protection of the Controller’s rights;
• service communications about purchased Services (non-promotional).

You may object to processing based on legitimate interest within the limits of GDPR Art. 21.

3.4 Consent (GDPR Art. 6.1.a)

• non-essential cookies / third-party measurement or marketing tools, where used;
• newsletters or commercial communications, where requested and not otherwise justified;
• any further processing for which consent is required by law.

Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

Providing data needed to conclude and perform the contract is mandatory: without it we cannot activate or manage the Services. Providing data for marketing or non-essential cookies is optional.

Data may be disclosed, within the stated purposes, to:

• infrastructure providers (EU datacenters, virtualisation platforms, mail systems);
• registrars / registries and TLD authorities for domain registration and management;
• Certificate Authorities for SSL issuance;
• payment processors and banks;
• platform providers used for billing and the Client Area (e.g. WHMCS or equivalents) and support tools;
• advisors (accountant, lawyer, technical) bound to confidentiality;
• public authorities when required by law.

Parties processing data on our behalf are appointed as Processors under GDPR Art. 28 where applicable. An updated list of main processors can be requested via the contacts in Article 1.

We do not sell personal data to third parties.

Data is preferably processed within the European Economic Area. If a provider involves a transfer to a third country, we do so only with an adequate legal basis (adequacy decision, Standard Contractual Clauses, supplementary measures, or other Chapter V GDPR safeguard) and, where required, with notice to the data subject.

Some optional third-party services (e.g. Microsoft Exchange Online, international CAs, analytics tools) may involve processing under their own notices; the Customer’s use of such services implies acceptance of those terms.

We retain data for as long as necessary for the purposes, in particular:

• contract and account data: for the relationship and, after termination, for ordinary limitation periods and legal duties (typically up to 10 years for tax/accounting documents);
• tickets and support correspondence: for as long as useful for handling and disputes, usually not beyond a few years after closure, unless defence needs apply;
• security and system logs: for limited periods consistent with security and diagnostics (typically weeks to months, unless an investigation is ongoing);
• marketing data with consent: until withdrawal or objection;
• browsing / cookie data: according to durations stated in the banner/cookie policy.

After the periods expire, data is deleted or anonymised, unless further mandatory retention applies.

Within GDPR limits, you may exercise rights of:

• access (Art. 15);
• rectification (Art. 16);
• erasure (Art. 17);
• restriction (Art. 18);
• portability (Art. 20), where applicable;
• objection (Art. 21), including to direct marketing;
• withdrawal of consent (Art. 7), where processing is consent-based.

Requests should be sent to support@keverhosting.com (subject: “Privacy – rights request”), preferably from the email linked to the account. We may ask for additional information to verify identity.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante) (www.garanteprivacy.it) or the supervisory authority of the EU Member State where you habitually reside, work or where the alleged infringement occurred.

We adopt technical and organisational measures appropriate to the risk (access control, encryption in transit where applicable, environment segregation, backups, incident response procedures, training of authorised staff). No system is risk-free: in case of a relevant personal-data breach under GDPR Arts. 33–34, we will make the required notifications.

The website may use:

• technical / essential cookies needed for operation (session, language preferences, security) — basis: legitimate interest / ePrivacy exception;
• analytics or third-party cookies (e.g. traffic measurement tools), where present — basis: consent, collected via banner where required.

You can manage preferences via the cookie banner (if active) and browser settings. Disabling technical cookies may impair some website or Client Area features.

The Client Area and control panels may set their own session cookies, distinct from the marketing site.

The Services are not intended for persons under 18. We do not knowingly collect minors’ data. If we learn of data collected in breach of this rule, we will delete it without undue delay.

When the Customer uses hosting, VPS, email or domains to process third-party data (e.g. visitors of its website, email recipients), the Customer is generally the Controller of that processing. KeverHosting provides the infrastructure and, to the extent it processes such data on the Customer’s behalf, acts as Processor under GDPR Art. 28.

In that context:

• we process data only to deliver and maintain the Services, according to documented instructions (Order, panel, tickets, DPA);
• we do not use Customer Content for our own marketing;
• infrastructure sub-processors (datacenters, anti-spam, etc.) may be involved under contract;
• on Service termination, data is made unavailable/deleted according to the Terms of Service, unless legal duties require otherwise.

The Customer is responsible for providing notices and legal bases to its data subjects and for correctly configuring applications and mailboxes.

We may update this Privacy Policy for organisational, technical or regulatory reasons. The current version is always published on this page with an update date. For material changes we may provide an additional notice by email or in the Client Area.