1. Scope

This Privacy Policy explains how OffshoreKaka (“we”, “us”) handles personal data in connection with our hosting services and this website. It applies to visitors, prospective customers and customers.

Our servers are located in the Netherlands and Germany, and our Terms of Service are governed by Dutch law. Where the EU General Data Protection Regulation (GDPR) applies to your data, this policy is written to meet it.

2. Data We Collect

2.1 Account and billing data

When you order a service we collect what is needed to create and bill an account: name, email address, and where a payment method requires it, a billing address and phone number. A company name is optional.

We do not ask for identity documents or proof of address. Where a payment provider requires verification, that is carried out by the provider under its own policy; we do not receive or store those documents.

2.2 Payment data

Card, UPI, bank transfer and cryptocurrency payments are handled by third-party payment providers. We never see or store full card numbers. We retain only the transaction reference, amount, currency and status needed for accounting.

2.3 Technical data

We log IP addresses used to access the client area and support system, with timestamps, for security and fraud prevention. Our web servers keep standard access logs. Support tickets and their contents are retained as part of your account history.

2.4 Content on your service

Files, databases, email and anything else you place on your hosting service are your content, not data we collect about you. We do not read, index, scan or analyse it, and we do not use it for any purpose of our own. Section 6 sets out the narrow circumstances in which content or account data may have to be disclosed.

3. Why We Process It, and On What Basis

To provide the service you ordered — performance of a contract.
To invoice you and keep accounting records — performance of a contract, and legal obligation for tax records.
To provide support — performance of a contract.
To prevent fraud, abuse and attacks on our network — our legitimate interest in running a stable, non-abusive network.
To send service notices such as maintenance windows, invoices and security alerts — performance of a contract. These are operational, not marketing, and cannot be opted out of while you hold an active service.
To send marketing email — only with your consent, withdrawable at any time.

4. How Long We Keep It

Account records: while the account is active, and for 12 months after the last service is terminated.
Invoices and accounting records: up to 7 years, where required by tax law.
Client area and support access logs: 90 days.
Web server access logs: 30 days.
Support tickets: life of the account plus 12 months.
Server content after termination: deleted on our normal reclamation cycle. Do not rely on us as your backup.

5. Who We Share It With

We do not sell personal data, and we do not share it for anyone else’s marketing. We share the minimum necessary with:

Payment providers, to take payment and handle refunds and chargebacks.
Our datacentre and network partners, where an operational or abuse matter requires it.
Domain registries and SSL issuers, where you order those products and the registry requires registrant data.

6. Lawful Disclosure — What We Can and Cannot Promise

We would rather be straightforward about this than make a promise no host can keep.

What we do not do: we do not hand over customer data on the basis of an informal request, a demand letter, a copyright complaint, a competitor’s approach, or pressure from any party without legal standing. Requests of that kind are declined.

What we must do: where we receive a valid, properly constituted order from a competent authority with jurisdiction over us or over the equipment concerned, we are legally obliged to comply, and we will.

What we will do for you: we review every request for validity and scope, we disclose only what the order actually compels, and where the law permits us to notify you, we will, so you have the opportunity to respond.

7. Your Rights

Where the GDPR applies, you have the right to access the personal data we hold about you, have inaccurate data corrected, have data erased where we have no continuing legal basis to keep it, restrict or object to certain processing, receive your data in a portable format, and withdraw consent to marketing at any time.

To exercise any of these, email [email protected] from the address on your account. We respond within 30 days. You also have the right to complain to a data protection supervisory authority in your country.

8. Security

Access to customer records is restricted to staff who need it. The client area and support system are served over TLS, and administrative access to our systems requires multi-factor authentication.

You are responsible for the security of your own account credentials, server passwords and SSH keys, and for anything done using them. Enable two-factor authentication in the client area.

9. Cookies

This website uses cookies that are strictly necessary for it to function, including a session cookie and your theme and currency preferences. We do not use advertising or cross-site tracking cookies here. The client area sets its own session and authentication cookies, which are required to log in.

10. Changes and Contact

We may update this policy. Where a change materially affects how we handle your data, we will notify active customers by email. The current version is always the one published here.

Privacy and general enquiries: [email protected]. Abuse reports: via our abuse reporting form.

Last updated: 9 August 2026