This notice describes how personal data are processed on the web server of Thomas Stadler (sthot-systems). The server is housed at STRATO GmbH and runs more than 50 websites, with PHP, relational databases and the Exim mail server, delivered through nginx.
Hosted websites link to this page so that visitors can see who operates the server and who processes the data in the data centre. The operator of each individual website remains responsible for that site’s content, forms, shops and member areas.
Italian data protection law applies. Regulation (EU) 2016/679 applies directly in Italy. Legislative Decree No. 196 of 30 June 2003 (the Personal Data Protection Code, referred to below as the Code) applies as amended by Legislative Decree No. 101 of 10 August 2018. This notice meets the information duty in Article 13 of Regulation (EU) 2016/679. Where the Code lays down its own rule for a processing activity, that rule is stated with the activity concerned.
The controller for the operation of this server and for this privacy notice is:
Thomas StadlerPlease send data protection requests in writing to this address. If your request concerns a particular website, form or mailbox, also contact the operator of that website. That operator determines the purposes of the content data collected there and is the controller within the meaning of Article 4(7) of Regulation (EU) 2016/679.
No data protection officer has been appointed.
Two layers apply on this server.
Content data of the hosted websites. Texts, form data, customer and member data, shop data and mailbox contents are processed by sthot-systems on behalf of the relevant website operator (Article 28 of Regulation (EU) 2016/679). The website operator determines the purpose and legal basis of those data. sthot-systems does not use them for its own purposes.
Technical operation of the server. Connection data produced by nginx, PHP-FPM and Exim are processed by the server operator in order to provide the service, find faults and prevent abuse. The legal basis is Article 6(1)(f) of Regulation (EU) 2016/679. The legitimate interest is the secure and stable operation of a server that holds many websites independent of one another. The logs are not used for advertising or for profiling.
Where performance of a customer engagement also requires these logs to be kept for the website operator, that processing is carried out in addition as processing on that operator’s instructions.
The server provides more than 50 websites. For each website it provides, in particular, storage space, a connection to the Internet, PHP, one or more databases and, where commissioned, email.
The categories of data subjects are visitors to the websites, people who complete forms or create accounts, email correspondents, and the customers and their staff.
The types of data, depending on the website and only to the extent the operator stores them there, are: identity data, contact data, contract and booking data, content data, credentials in the form stored by the application, and technical log data. Special categories of personal data under Article 9(1) of Regulation (EU) 2016/679 are not deliberately collected by the server operator. Such processing would be lawful only under an exception in Article 9(2) of the Regulation. If it is carried out for reasons of substantial public interest under Article 9(2)(g), Article 2-sexies of the Code additionally requires a statutory or regulatory basis that specifies the types of data, the operations, the public-interest ground and appropriate safeguards. Whether an individual website asks for such data is decided by its operator, who is responsible for that choice.
Provision of the hosting service is based on the contract with the website operator (Article 6(1)(b) of Regulation (EU) 2016/679). There is no statutory duty to use this particular server. Without the technical log data, however, the server cannot answer the request or be protected against abuse.
When a page is requested, nginx processes the data transmitted by the browser. The access log contains:
Error logs contain technical error messages and may also include IP addresses or requested addresses.
The purpose is delivery of the website, troubleshooting and defence against attacks. The legal basis is Article 6(1)(f) of Regulation (EU) 2016/679. These logs are created on the server. They are not storage of information on the end user’s device under Article 122 of the Code. Access logs are rotated daily and kept for ten generations, that is about ten days. They are then deleted.
Transmission is encrypted where the website in question is reachable over HTTPS.
Dynamic pages are executed with PHP (PHP-FPM). This produces session data where the application starts a session, and temporary files needed to handle a page request. Sessions keep one operation together across several requests, for example a shopping cart or a sign-in. They end when the session lifetime set by the application expires, or when they are deleted.
If the application stores an identifier on the end user’s device for that purpose, Article 122(1) of the Code permits that storage without consent, to the extent strictly necessary to provide an information-society service explicitly requested by the user. Other information on the device that is not strictly necessary may be stored only by the relevant website operator, and only with consent under Article 122(1) of the Code.
PHP-FPM writes its own technical logs about the interpreter. They are used for troubleshooting and are kept for a few weeks under the system rotation. The legal basis is Article 6(1)(f) of Regulation (EU) 2016/679.
Which personal data a PHP application writes into a session or a database is determined by the website operator. sthot-systems processes those data only in order to run the application.
The websites store their application data in relational databases (MariaDB). Typical contents are content-management data, form entries, user accounts, orders and similar application data. Access is limited to the website concerned and to the server operator, for operation, backup and fault repair.
The purpose and retention of content data follow the website operator’s instructions and contract (Article 6(1)(b) and Article 28 of Regulation (EU) 2016/679). sthot-systems deletes databases and related files when the hosting engagement ends or the operator requests deletion, unless a statutory retention duty applies. Such a duty normally rests with the website operator; for business records it is in particular Article 2220 of the Italian Civil Code.
Backups protect against loss of data. They are subject to the same purpose limitation as the original data and are kept only for as long as they are needed for restoration.
Technical database logs (the database service’s error log) are rotated quickly and, as a rule, do not contain the contents of customers’ databases.
Mail transport runs through Exim. The server accepts email for the hosted domains, delivers it locally or forwards it, and sends email originating from the hosted applications or mailboxes.
The data needed for delivery are processed: sender and recipient addresses, message metadata (time, size, delivery status, servers involved) and the message content, for as long as the message is in the queue or in the mailbox. Mailbox contents are content data of the relevant customer and are stored only on that customer’s behalf.
The purposes are delivery of the message, troubleshooting and protection of the mail server against abuse, in particular unauthorised sending. The legal basis for technical operation is Article 6(1)(f) of Regulation (EU) 2016/679; for mailbox contents, the customer’s instructions under Article 28 of Regulation (EU) 2016/679 on the basis of that customer’s contract (Article 6(1)(b) of the Regulation). Message content is covered by the secrecy of correspondence under Article 15 of the Italian Constitution. Unlawfully learning of, suppressing or interrupting electronic communications is a criminal offence under Articles 616 and 617-quater of the Italian Criminal Code.
Article 123(2) and Article 132 of the Code impose longer periods only on providers of an electronic communications service available to the public: up to six months for traffic data used for billing, and twelve months for telematic traffic data for the investigation and prosecution of crime. No such public communications service is operated on this server. Exim mail logs are therefore kept, under the system rotation, as a rule for four weeks and are then deleted. Messages in the queue remain there until they are delivered or returned as undeliverable. Mailboxes remain until the customer empties them or the hosting engagement ends.
The server is housed at STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin. STRATO provides the data-centre service and the network connection. The software on the server (nginx, PHP, databases, Exim) is administered by Thomas Stadler. Website and mail data are processed on this server, IP addresses 85.214.126.69 and 93.90.204.165, STRATO customer number 62307754.
STRATO processes the personal data required for housing and for operation of the infrastructure as a processor under Article 28 of Regulation (EU) 2016/679. The data processing agreement, version 3.6, was concluded on 23 September 2026. Its text is set out in section 14. The version filed with STRATO is available as STRATO-AVV.pdf.
For the server product, STRATO’s service description states that data processing on the platform itself is carried out independently and on the customer’s own responsibility. STRATO processes the content data stored on the server and the account information needed for the service (in particular IP addresses and user names) under this agreement.
Further recipients are only the sub-processors named in the agreement, and only to the extent STRATO uses them for the service actually purchased. The homepage builder, shop software, HiDrive, mail archiving, Plesk and comparable STRATO products are not part of the operation described here. The general list of subcontractors is nevertheless part of the agreement and is reproduced in full below.
Data are not passed on for advertising. Disclosure to an authority takes place where the law requires it (Article 6(1)(c) of Regulation (EU) 2016/679).
Housing and processing on this server take place in a data centre in Germany, and therefore in the European Union.
The agreement with STRATO provides that processing takes place in a Member State of the European Union or in another state party to the Agreement on the European Economic Area, unless performance of the service requires a transfer to a third country. In that case STRATO must ensure that the conditions of Articles 44 et seq. of Regulation (EU) 2016/679 are met. The subcontractor list names EU standard contractual clauses under Article 46(2)(c) of Regulation (EU) 2016/679 for individual services that are not used as a product here (Switzerland, Singapore, United States). No such third-country transfer is intended for the operation of this server.
| Data | Period |
|---|---|
| nginx access and error logs | about 10 days (daily rotation, 10 generations) |
| Exim mail logs | as a rule 4 weeks |
| PHP-FPM logs | a few weeks, according to the system rotation |
| PHP sessions | until the session of the application concerned expires |
| Web and database contents, mailboxes | for the term of the hosting engagement and on the website operator’s instructions; deleted at the end of the contract unless a retention duty applies |
| Backups | only for the period needed for restoration |
| Data held by STRATO for the server contract | according to the service description for server products: at the latest 7 days after a cancellation of the function or contract confirmed online by the customer, and at the latest 30 days for other cancellations; diagnostic data 7 days after collection |
Subject to the statutory conditions, you have the following rights against the controller:
If you object to the technical logs, we check whether compelling legitimate grounds require the short further storage, for example to repel an ongoing attack. For content data of a website, the right addressee is the website operator, because that operator decides on purpose and erasure. sthot-systems assists the operator within the processing engagement.
You may withdraw consent for the future under Article 7(3) of Regulation (EU) 2016/679. The technical processing described on this server is not based on consent. For storage on the device that goes beyond what is strictly necessary, consent under Article 122(1) of the Code is a matter for the relevant website operator.
There is no automated decision-making, including profiling, under Article 22 of Regulation (EU) 2016/679.
You have the right to lodge a complaint with a supervisory authority under Article 77 of Regulation (EU) 2016/679. In Italy that right is exercised by a complaint (reclamo) to the Garante under Articles 140-bis and 141 of the Code; the form and content of the complaint are governed by Article 142 of the Code. The right to a judicial remedy remains open under Article 79 of Regulation (EU) 2016/679 and Article 140-bis of the Code. The authority competent for the server operator established in Italy is:
Garante per la protezione dei dati personaliYou may also contact the supervisory authority of your place of residence.
Within its area, the server operator takes the measures under Article 32 of Regulation (EU) 2016/679 that are appropriate to the risk. Since Legislative Decree No. 101/2018, the Code no longer contains its own catalogue of minimum security measures; Article 32 of the Regulation remains decisive. The measures include separation of the websites, restricted administrative access, encrypted delivery over HTTPS where the website is reachable that way, current system software and limited retention of the logs.
STRATO takes the measures within its area of responsibility, that is the data centre, the hardware and the network connection. STRATO publishes the description of those measures at https://www.strato.de/agb/tom/. Under the agreement, that description is technical and is not itself part of the contract. STRATO is certified to ISO 27001; STRATO makes the current certificate available on its website.
Transmission over the Internet cannot be secured completely against every access by third parties. That applies in particular to email, which may have unencrypted segments on the path between two servers.
The data processing agreement concluded by Thomas Stadler, as the customer, with STRATO GmbH, as the processor, is set out below. The version filed with STRATO prevails: STRATO-AVV.pdf. The reproduction is provided for transparency towards the operators of the hosted websites and towards data subjects. The text below is a translation of the agreement drawn up in German.
The General Data Protection Regulation (DSGVO) referred to in the agreement is Regulation (EU) 2016/679. It applies directly to the customer established in Italy, together with the Code. Under clause 12.4, the agreement itself is governed by the law of the Federal Republic of Germany, because the processor has its seat in Berlin. The German secrecy duties of the processor stated in clause 5.4 (§ 3 TDDSG, § 203 of the German Criminal Code) correspond, on the side of the Italian customer, to the secrecy of correspondence under Article 15 of the Italian Constitution, to the criminal provisions in Articles 616 and 617-quater of the Italian Criminal Code, and to professional secrecy under Article 622 of the Italian Criminal Code.
Data processing agreement
under Article 28(3) of Regulation (EU) 2016/679.
Version 3.6
Customer number 62307754
Concluded on 23 September 2026.
between
Thomas Stadleras the customer – referred to below as the customer –
and
STRATO GmbHas the processor – referred to below as the processor –
1.1. The subject matter of the agreement is the rights and duties of the parties in the performance of the service under the service description and the general terms (referred to below as the main contract), insofar as STRATO GmbH (referred to below as the processor) processes personal data as a processor for the customer as controller (referred to below as the customer) under Article 28 of Regulation (EU) 2016/679. This covers all activities the processor carries out to perform the engagement and that constitute processing on behalf of a controller. It also applies where the engagement does not expressly refer to this data processing agreement.
1.2. The duration of the processing follows the actual processing of the customer’s personal data by the processor.
2.1. The nature of the processing covers all types of processing within the meaning of Regulation (EU) 2016/679 that are required to perform the engagement.
2.2. The purposes of the processing are all purposes required to provide the contractually agreed service (see also Annex 1, service description), in particular in the fields of cloud services, hosting, software as a service (SaaS) and IT support.
3.1. The customer determines the types of data processed through the choice of product, the configuration, the use of the services and the transmission of data. See also the service description in Annex 1.
3.2. The customer determines the categories of data subjects through the choice of product, the configuration, the use of the services and the transmission of data. See also the service description in Annex 1.
4.1. Within this contract, the customer alone is responsible for compliance with data protection law, in particular for the lawfulness of passing data to the processor and for the lawfulness of the processing (“controller” within the meaning of Article 4(7) of Regulation (EU) 2016/679). This also applies to the purposes and means of processing governed by this agreement.
4.2. Instructions are initially laid down by the main contract and may afterwards be changed by the customer, in writing or in an electronic format (text form), by individual instructions. Oral instructions must be confirmed in writing or in text form without delay. If changes are proposed, the processor tells the customer what effects they have on the agreed services, in particular on the ability to provide them, on deadlines and on remuneration. If implementing the instruction cannot reasonably be required of the processor, the processor may end the processing and terminate the contract for cause. The customer’s duty to pay ends when the processor stops the service. An instruction cannot reasonably be required, in particular, where the services are provided on infrastructure used by several customers of the processor (shared services) and a change of processing for individual customers is not possible or cannot reasonably be required.
4.3. The agreed processing takes place in a Member State of the European Union or in another state party to the Agreement on the European Economic Area, unless performance of the service requires a transfer to third countries. If a transfer to a third country takes place, the processor ensures that the conditions of Articles 44 et seq. of Regulation (EU) 2016/679 are met.
5.1. The processor may process data of data subjects only on documented instructions from the customer. The instructions are laid down at the outset by the contract. There is no duty to follow instructions where an exception under Article 28(3)(a) of Regulation (EU) 2016/679 applies (an obligation under the law of the European Union or of a Member State). This also covers transfers of personal data to third countries or international organisations. If processing is mandatory contrary to an instruction, the processor informs the customer of the legal requirement before the processing, unless the law prohibits that information on important grounds of public interest. The processor informs the customer without delay if it considers that an instruction infringes applicable law. The processor may suspend implementation of the instruction until the customer confirms or amends it. The customer documents the instructions and keeps them at least for the term of the contractual relationship.
5.2. Taking into account the nature of the processing, the processor assists the customer, so far as possible, with appropriate technical and organisational measures in fulfilling the claims of data subjects under Chapter III of Regulation (EU) 2016/679. The processor may charge a reasonable fee for these services, unless the assistance was required because of a breach of law or contract by the processor. The processor provides the customer with cost information in advance.
5.3. Taking into account the nature of the processing and the information available to it, the processor assists the customer in complying with the duties in Articles 32 to 36 of Regulation (EU) 2016/679. The processor may charge a reasonable fee for these services, unless the assistance was required because of a breach of law or contract by the processor. The processor provides the customer with cost information in advance.
5.4. The processor warrants that the employees and other persons engaged in processing the customer’s data are forbidden to process the data outside the instruction. The processor further warrants that the persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory duty of secrecy. The same applies to social secrecy, to telecommunications secrecy under § 3 TDDSG and, in awareness of criminal liability, to the protection of secrets of professional secrecy holders under § 203 of the German Criminal Code. The duty of confidentiality and secrecy continues after the engagement ends.
5.5. The processor informs the customer without delay if it becomes aware of a personal data breach affecting the customer’s data. The processor takes the measures required to secure the data and to mitigate possible adverse consequences for the data subjects.
5.6. The processor warrants the written appointment of a data protection officer who carries out that activity under Articles 38 and 39 of Regulation (EU) 2016/679. Contact details are published on the processor’s website.
5.7. After the processing services have been completed, the processor, at the customer’s choice, either deletes all personal data or returns them to the customer, unless Union law or the applicable law of a Member State requires the personal data to be stored. If the customer does not exercise this choice, deletion is agreed. If the customer chooses return, the processor may charge a reasonable fee. The processor provides the customer with cost information in advance.
5.8. If data subjects assert claims for compensation under Article 82 of Regulation (EU) 2016/679, the processor assists the customer in defending the claims, within the processor’s means. The processor may charge a reasonable fee unless the claims are based on a breach of law or contract by the processor.
6.1. The customer informs the processor without delay and in full if, while the engagement is being carried out, the customer finds errors or irregularities relating to data protection rules.
6.2. On termination, the customer undertakes to delete, before the contract ends, the personal data the customer has stored in the services.
6.3. At the processor’s request, the customer names a contact person for data protection matters.
The processor informs the customer without delay of every request it has received from the data subject. It does not answer the request itself unless the customer has authorised it to do so. Taking into account the nature of the processing, the processor assists the customer in the duty to answer requests from data subjects to exercise their rights. In doing so, the processor follows the customer’s instructions. The processor is not liable if the data subject’s request is not answered by the customer, or is not answered correctly or in time.
8.1. Within its area of responsibility, the processor takes appropriate technical and organisational measures to ensure that processing is carried out in accordance with Regulation (EU) 2016/679 and that the rights and freedoms of the data subject are protected. Within its area of responsibility, the customer takes appropriate technical and organisational measures under Article 32 of Regulation (EU) 2016/679 to ensure the ongoing confidentiality, integrity, availability and resilience of the systems and services related to the processing.
8.2. The processor’s current technical and organisational measures can be viewed at the following link: https://www.strato.de/agb/tom/. The processor states that the measures listed at that link are technical descriptions only and are not to be regarded as part of this agreement.
8.3. The processor operates a procedure for regularly testing the effectiveness of the technical and organisational measures for the security of processing under Article 32(1)(d) of Regulation (EU) 2016/679.
8.4. The processor adapts the measures over time to developments in the state of the art and to the risk. The processor reserves the right to change the technical and organisational measures, provided the level of protection under Article 32 of Regulation (EU) 2016/679 is not reduced.
9.1. The processor makes available to the customer all information necessary to demonstrate compliance with the duties laid down in Article 28 of Regulation (EU) 2016/679 and, in an individual case, allows audits, including inspections, carried out by the customer or by another auditor mandated by the customer. The processor may require a confidentiality undertaking from the customer and from the auditor, which must not prevent the customer from itself demonstrating compliance to the competent supervisory authority. The processor may reject as auditors direct competitors of the customer, or persons acting for direct competitors of the customer.
9.2. As a rule, the existing ISO 27001 certification is sufficient for the customer as demonstration of compliance with the duties in Article 28 of Regulation (EU) 2016/679. The processor makes the current certificate available on its website.
9.3. If, on the basis of concrete indications, the customer raises justified doubts that the certifications referred to are sufficient or accurate, or if particular incidents within the meaning of Article 33(1) of Regulation (EU) 2016/679 in connection with the processing carried out for the customer justify it, the customer may carry out on-site checks. These may take place during usual business hours without undue disruption of operations, as a rule after notice, unless a check without notice is required because otherwise the purpose of the check would be jeopardised. The customer’s right of inspection is aimed at verifying compliance with the duties of a processor under the Regulation and this contract. The processor actively cooperates in carrying out the check.
9.4. The processor may charge a reasonable fee for information and assistance, unless the check was required because of a breach of law or contract by the processor. The processor provides the customer with cost information in advance.
10.1. The customer gives the processor general authorisation to engage further processors within the meaning of Article 28 of Regulation (EU) 2016/679 in order to perform the contract.
10.2. The further processors currently engaged are listed in Annex 2. The customer agrees to their engagement.
10.3. The processor informs the customer if it intends to add or replace further processors. The customer may object to such changes.
10.4. An objection to the intended change may be raised only for an objective reason, within 14 days of receipt of the information, and must be addressed to the processor. If there is an objection, the processor may, at its choice, provide the service without the intended change or, if providing the service without the intended change cannot reasonably be required of the processor, discontinue the affected service towards the customer within a reasonable period (at least 14 days) after receipt of the objection. From the time the processor discontinues the service, the customer’s duty to pay ceases.
10.5. If the processor engages further processors, it must pass on to them its data protection duties under this contract. In particular, through regular checks, the processor ensures that the further processors comply with the technical and organisational measures.
11.1. If a data subject asserts a claim for compensation under Article 82 of Regulation (EU) 2016/679, the parties undertake to support each other and to contribute to clarifying the underlying facts.
11.2. The liability rules agreed between the parties in the main contract for performance of the service also apply to claims under this data processing agreement and, in the internal relationship between the parties, to third-party claims under Article 82 of Regulation (EU) 2016/679, except where something else is expressly agreed.
12.1. The agreement begins when the customer concludes it. It ends when the last contract under the relevant customer number ends. If processing on behalf of the customer still takes place after this contract ends, the provisions of this agreement continue to apply until the processing actually ends.
12.2. The processor may amend the agreement in its reasonable discretion, with reasonable notice. In particular, it expressly reserves the right to amend this agreement unilaterally if material legal changes relating to the agreement occur. The processor separately informs the customer of the significance of the intended change and also gives the customer a reasonable period in which to object. In the notice of change, the processor points out that the change takes effect if the customer does not object within the period set. If the customer objects, the processor has a right of termination for cause.
12.3. The customer acknowledges this agreement as part of the general terms https://www.strato.de/agb/ for the products the customer has booked. In the event of conflict, the provisions of this data processing agreement prevail over the provisions of the main contract. If individual parts of this agreement are invalid, the validity of the remainder is unaffected.
12.4. The exclusive place of jurisdiction for all disputes arising out of or in connection with this contract is the seat of the processor. This applies subject to any exclusive statutory jurisdiction. This contract is governed by the statutory provisions of the Federal Republic of Germany.
12.5. If the customer’s data at the processor are endangered by attachment or seizure, by insolvency or composition proceedings, or by other events or measures of third parties, the processor informs the customer without delay. The processor informs all persons responsible in that connection, without delay, that control of and title to the data lie exclusively with the customer as “controller” within the meaning of Regulation (EU) 2016/679.
The service description from the agreement is reproduced here. For this server, the description of the server products is the relevant one. The other products are relevant only if they are actually booked under the customer number.
Service description: If you order a domain from us, we take care of connecting it and registering it with the competent registry. Maintaining the registration, domain transfers and cancellation are also part of the contract. The same applies to the SSL certificates based on your domains.
Purpose of processing: registration, transfer, configuration and administration of the domain name.
Types of personal data: domain name and contact data (name, address, email, telephone number, and company where applicable).
Categories of data subjects: customers.
Deletion periods: changes to the domain are stored for 12 months. Otherwise, the duration of processing corresponds to the term agreed in the contract. Data subject to a retention duty are stored for up to 10 years after the end of the contract.
Service description: If you have an email product with us, you can create email addresses for your domains and administer and use the related services. On your instructions we set up a mailbox which you can access through the STRATO webmailer and through email clients. According to the scope of the service and the engagement, we carry out forwarding, notifications, autoresponders, mailing lists and virus protection for you. A configurable spam filter is also part of the product. According to the service booked, you can manage contacts, appointments and tasks in the STRATO webmailer. You can also purchase email archiving and thus store your emails in a revision-proof manner.
Purpose of processing: provision of email services (receiving, sending, storing and archiving), including creating, configuring and deleting email addresses and managing contacts, appointments and tasks.
Types of personal data: emails, contacts, appointments, tasks, domain and log files.
Categories of data subjects: customers, the customer’s staff, the customer’s contacts.
Deletion periods: email services at most 30 days after the end of the contract term. Log files at most 6 months after they are created. Email archiving 60 days after the end of the contract.
Service description: Our cloud storage allows you to store your data in our data centre so that you can access the data from anywhere and at any time. Depending on the package ordered, you can, for example, create several users or make other configurations. You can also grant shares and manage them.
Purpose of processing: provision of an online storage solution.
Types of personal data: data you store in the cloud, log files.
Categories of data subjects: customers, the customer’s staff, users.
Deletion period: up to two months after the end of the contract, unless the customer deletes the data earlier. Log files are stored for a maximum of 12 months.
Service description: The basis of the hosting products is the storage space on which a website can be published. We provide this web space and connect it to the Internet. Depending on the product or the scope of the service, the following components are available in particular: services to install and operate external software (for example WordPress); databases and administrative access; homepage editors for creating a website by means of templates and modules; services to connect the website (for example IP, domain, SSL certificates). Functional extensions: SiteLock Scan helps to keep your web space free of malware by scanning the website and informing you if anything is found. Web Analytics supports statistical evaluation of visitor traffic.
Purpose of processing: providing the web space for publication on the Internet; providing tools and services for creating and operating websites.
Types of personal data: website content data, domain, log files.
Categories of data subjects: customers’ staff, visitors to the website.
Deletion periods: log files on visitors to your website are stored for a maximum of 7 days. Content data are deleted within 2 months after the end of the contract. Other log data are deleted after a maximum of 12 months.
Service description: With a STRATO web shop you can set up an online shop and sell your goods. We provide SaaS software with the functions needed to operate an online shop within a website or also through various social-media channels. It is up to you, as the shop operator, to fill the shop with your own content, for example the choice of shipping and payment methods. Further features of external partners can be added to the shop solution in order to extend its functionality. If you wish to use those features, they require their own contracts directly between you and the relevant partners; they are not part of this product.
Purpose of processing: web hosting, provision of the shop infrastructure.
Types of data processed: master data of the shop (such as product data, prices, general shop settings), further data insofar as they are needed to handle sales (address and customer data, shipping and payment information, stock, orders and so on), log files.
Categories of data subjects: shop operator, shop customers and visitors to the website.
Deletion periods: logs and statistical data are kept for one year. Further data, such as master data, are stored without limit for contracts that have not been deleted. Data of cancelled contracts are deleted after 60 days.
Service description: Online marketing products such as marketingRadar, rankingCoach, listingCoach or adCoach can support the customer’s commercial success. Depending on the product chosen, company contacts are published in business directories and on other platforms, search results at Google are optimised, advertising is placed at Google, or newsletters are sent. Each of these applications supports, in its specific context, sales, the initiation of business contacts and the conveyance of information, and thereby contributes to reach, awareness and customer loyalty.
Purpose of processing: increasing reach and awareness, placing advertising, publishing company data, sending newsletters, optimisation for search-engine results.
Types of data processed: company data, contact data, content data, usage data.
Categories of data subjects: staff, customers, visitors to the website.
Deletion periods: customers’ data are deleted from the systems 30 days after cancellation; the product partner likewise deletes all data 30 days after cancellation.
Service description: You can order a variety of server products from us. Depending on the product chosen, we provide hosted servers on individually used hardware of your own (dedicated servers) or in a virtualised environment, storage space that is only shared (virtual servers). Set-up, administration, operation and backup are supported by us with automated processes and tools. Data processing on the platform itself is carried out independently and on your own responsibility as the customer.
Purpose of processing: provision and operation of the server infrastructure.
Types of data processed: content data you store on the server; user-account information (IP addresses, MAC addresses, user names).
Categories of data subjects: customers, users.
Deletion periods: user-account information needed to provide the service, and customer data stored on the server, are deleted at the latest within seven days in the case of cancellations of the function or the contract confirmed online by the customer, and at the latest within 30 days for all other cancellations of the contract. User-account information collected for fault diagnosis is deleted 7 days after collection.
Status of the list: 18 March 2024.
| Subcontractor | Address | Short description of the service | Safeguards in the case of a third-country transfer |
|---|---|---|---|
| we22 Solutions GmbH | Otto-Ostrowski-Straße 7, 10249 Berlin | STRATO homepage design service; development, maintenance and care of the homepage builder | – |
| ePages GmbH | Pilatuspool 2, 20355 Hamburg | Development, maintenance and care of the web-shop software | – |
| Ionos SE | Elgendorfer Straße 7, 56410 Montabaur | Provision, operation and maintenance of products, in particular operation, maintenance and care of the automatic updater for apps (Installatron); provision of the physical environment for operation of STRATO mail archiving (Dropsuite Ltd.); operation of the platform and provision of dedicated and virtual servers and cloud solutions | – |
| Dropsuite Ltd. | PTE, Ltd. 01-12 Block 71, Ayer Rajah Crescent, Singapore 139951, Singapore | Development, maintenance, care and operation of the STRATO mail-archiving software | EU standard contractual clauses under Article 46(2)(c) of Regulation (EU) 2016/679 |
| Virtuozzo International GmbH | Vordergasse 59, 8200 Schaffhausen, Switzerland | Virtualisation software for virtual servers, including support | EU standard contractual clauses under Article 46(2)(c) of Regulation (EU) 2016/679 |
| rankingCoach GmbH | c/o wework, Friesenplatz 4, 50672 Cologne | Applications to improve a website’s visibility in search engines | – |
| Hewlett-Packard GmbH | Herrenberger Straße 140, 710 Böblingen | Support for a virtual-server platform | – |
| Acronis Germany GmbH | Landsberger Straße 105, 80339 Munich | Operation and support of the backup product | – |
| SiteLock, LLC | 8701 East Hartford Drive, Suite 200, Scottsdale, AZ 85255, USA | Detection and removal of malware | EU standard contractual clauses under Article 46(2)(c) of Regulation (EU) 2016/679 |
| Eleven GmbH | Heidestraße 10, 10557 Berlin | Spam filter for email | – |
| Plesk International GmbH | Vordergasse 59, 8200 Schaffhausen, Switzerland | Provision of the Plesk server administration software | EU standard contractual clauses under Article 46(2)(c) of Regulation (EU) 2016/679 |
| ServerGuard24 GmbH | Fritz-Schäffer-Straße 1, 53113 Bonn | Operation of a monitoring service for dedicated and virtual servers | – |
| Open-Xchange GmbH | Olper Hütte 5f, 57462 Olpe | Use of OX App Suite and OX Premium mailboxes | – |
This privacy notice was updated on 23 September 2026.