Privacy Notice

Effective: October 17, 2026Last updated: October 17, 2026Version 1.5

This notice explains which personal data Karajohn Hosting processes when you visit our websites, become a customer or contact us — why, for how long, who else receives it, and your rights. We collect as little as we need, and we do not sell data or use it for advertising.

1Who is responsible

The controller is Karajohn Hosting, operated by KARAJOHN GROUP Ι.Κ.Ε. (Karajohn Group P.C., in formation), Κιλελέρ 11, 71414 Heraklion, Crete, Greece. Contact for all data protection questions: legal@karajohnhosting.com. Full legal details are in §18 of our Terms of Service.

This notice covers our websites karajohnhosting.com, cp.karajohnhosting.com (control panel), docs.karajohnhosting.com and status.karajohnhosting.com, our customers, and people who contact us.

Your own websites and mailboxes: for the personal data in websites and mailboxes that customers host with us (for example their visitors or their own customers), the customer is the controller and we act only as their processor under the data processing terms in §10 of the Terms of Service.

2When you visit our websites

Server logs: IP address, date and time, requested page, status code, browser (user agent) and referring page. Purpose: operating the websites, security and abuse prevention. Legal basis: legitimate interests (Art. 6(1)(f) GDPR). Kept for up to 30 days on our proxy server (Germany) and up to 5 weeks on our hosting servers (Greece).
Security blocks: IP addresses that repeatedly fail to log in or send abusive traffic are blocked automatically for a limited time. Legal basis: legitimate interests (protecting our systems and customers). The block ends automatically; the related log entries are deleted with the server logs.
Cloudflare: our main website karajohnhosting.com is delivered through Cloudflare's network, which processes your IP address and request data to deliver the page and protect it against attacks (see §6).
No tracking: we use no analytics, advertising or social-media trackers and no third-party fonts or scripts. Our live chat runs on our own server and loads only when you click the chat button (see §3 and §5).

3Cookies and browser storage

We use only what is strictly necessary, so no consent banner is needed:

Sign-in cookie (kh_session) on cp.karajohnhosting.com — keeps you signed in to the control panel. It is httpOnly, secure, sent only to our own server, and deleted when you sign out or the session expires.
Referral code — if you open a referral link, the code is stored in your browser's local storage on karajohnhosting.com so it can be applied at checkout. It never leaves your browser until you check out, and is removed after use.
Language choice — the language you choose for our legal pages is remembered in your browser's local storage.
Live chat — nothing loads until you click the chat button. Once you do, our chat (chat.karajohnhosting.com) stores cookies (cw_conversation, cw_user_…) on karajohnhosting.com so your conversation continues on the next page and on our other sites, and our site remembers in local storage that you opened the chat, so it loads on later visits and you see our replies. You can remove both by clearing your browser data for our sites.

4When you are a customer

Account data: name, email address, username, password (stored only as a secure hash), two-factor authentication secret and passkeys if you set them up. Legal basis: contract (Art. 6(1)(b)). Kept while your account exists; deleted when you delete your account, except the records below that the law requires us to keep.
Orders and billing: what you ordered, prices, invoices, billing name and address, VAT details, payment status, and the version of the Terms you accepted with the time of acceptance. Card details are processed only by Stripe; we never see them. Legal basis: contract and legal obligation (Art. 6(1)(b), (c)). Kept for 5 years (Greek tax law).
Sign-in and activity history: time, IP address and action of sign-ins and important account changes (shown to you under Account → Activity), and sign-in notification emails. Purpose: security of your account. Legal basis: legitimate interests. Kept for 12 months.
Service data: your domains, plan, usage figures (disk, bandwidth), uptime checks of your sites and deployment history. Legal basis: contract. Uptime checks are kept for 30 days, deployment history for 12 months, the rest while the service exists.
Domain registrations: for domains you register through us, the owner details you give at checkout (name, address, email address and phone number) are passed to our registrar Name.com and the domain registry, because you become the domain's registrant. They may appear in the public registration data (WHOIS/RDAP) where the registry's rules require it; most registries hide personal data of individuals. Legal basis: contract. Kept while the domain is registered through us and as the registry requires.
Service emails: we send emails that are needed for the service (order confirmation, password, sign-in alerts, billing, warnings and outages). We send no marketing without your separate consent.

5When you contact us

If you email support@, legal@ or abuse@karajohnhosting.com, we process your email address, the content of your message and any attachments to answer you, and — for reports of illegal content — to handle the report under the Digital Services Act. Legal basis: contract, legitimate interests, and legal obligation for DSA reports. We keep this correspondence until the matter is closed and for up to 2 years afterwards, unless it is needed longer for legal claims.

Live chat: if you use the chat on our websites, we process your messages and attachments, the name and email address you give, and technical data (IP address, browser, the page you were on and the approximate location derived from your IP address). When you are signed in to the control panel, the chat also receives your name, email address, customer number, username and number of websites, so we know who we are talking to. If you leave your email address, we may answer you by email. The chat runs on our own software (Chatwoot, open source) on our own servers; no chat provider receives your messages. Purpose and legal basis: answering you (contract, or legitimate interests before you are a customer). Conversations are kept for up to 2 years after the last message, like email.

6Who receives data

We use these service providers, bound by data processing agreements:

Hetzner Online GmbH (Germany) — the server for email, DNS and the network proxy in front of all websites.
Stripe Payments Europe, Ltd. (Ireland) — payments and card storage; Stripe, Inc. (USA) may receive data.
Cloudflare, Inc. (USA) — DNS and the network in front of karajohnhosting.com.
Name.com, Inc. (USA) — domain registration, and through it the domain registries.

Transfers to the USA are based on the EU–US Data Privacy Framework (adequacy decision of the European Commission) where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses.

We disclose data to authorities only where the law requires it (for example a court order). We do not sell personal data.

7Your rights

You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format (Account → Download my data), and to object to processing based on legitimate interests. Where processing is based on consent, you can withdraw it at any time without affecting earlier processing.

Write to legal@karajohnhosting.com. We answer within one month (up to three months for complex requests). You can also complain to the Hellenic Data Protection Authority (www.dpa.gr) or the authority in your country.

Providing account and billing data is necessary for the contract; without it we cannot provide the service. We do not make decisions based solely on automated processing that significantly affect you.

8Security and changes

We protect data with encrypted connections, encrypted storage of stored credentials, isolated customer websites, key-only administrative access, regular updates, monitoring and backups. Backups are kept as described in §11 of the Terms.

We update this notice when our processing changes and show the date at the top. Material changes are announced to customers by email.