Privacy Policy – Legal, Regulatory & Data Protection Framework

This Privacy Policy constitutes a comprehensive, legally binding, and exhaustive document that governs every single aspect of the collection, acquisition, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, or destruction of personal data, technical data, and any other information processed by Hostiera (“Company”, “we”, “us”, “our”). Hostiera operates the website www.hostiera.com and provides a complete suite of digital infrastructure solutions including shared web hosting, cloud hosting, virtual private servers (VPS), dedicated servers, domain name registration and management, SSL certificates, email hosting, website builders, and all associated support and management services.

This policy has been meticulously drafted to ensure full compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India, the Information Technology Act, 2000 (as amended in 2008 and subsequent years), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the Consumer Protection Act, 2019, and every other applicable statute, regulation, guideline, and notification issued by the Government of India, the Ministry of Electronics and Information Technology (MeitY), the Reserve Bank of India (where payment processing is involved), and any other relevant regulatory bodies. Furthermore, it incorporates internationally recognized data protection principles, including those inspired by the General Data Protection Regulation (GDPR) for any data subjects located in the European Economic Area, the California Consumer Privacy Act (CCPA) principles for global best practices, and the guidelines issued by the Internet Corporation for Assigned Names and Numbers (ICANN) specifically for domain registration and WHOIS data handling.

At Hostiera, we place the highest possible priority on transparency, accountability, security, fairness, and respect for individual privacy rights. This document is intentionally written in exhaustive detail so that every user, whether an individual blogger, a small business owner, a large enterprise, or a developer using our APIs, can fully understand exactly what information we collect, the precise reasons why we collect it, the detailed methods of collection, the specific ways in which we use and process the data, the limited circumstances under which we may share it with any third parties, the strict timelines and criteria for data retention, the robust technical and organizational security measures we implement, and – most importantly – the extensive rights you have as a data subject along with clear, step-by-step instructions on how to exercise those rights. Every section below includes multiple real-world examples tailored specifically to our hosting services so you can see exactly how the policy applies in practice when you sign up for a shared hosting plan, launch a VPS instance, register a new .com or .in domain, or contact our support team.

1. Scope and Applicability of This Privacy Policy

This Privacy Policy applies universally and without exception to every single visitor, registered user, account holder, customer, prospective customer, and any other individual or entity who interacts with Hostiera in any capacity. The scope covers the main website www.hostiera.com, all sub-domains, the client management panel located at https://hpanel.space/clientarea.php, any mobile-responsive interfaces, support ticket systems, live chat platforms, email communications, API endpoints, webhook notifications, affiliate portals, promotional landing pages, and any future digital properties that Hostiera may develop or operate. It governs every type of data processing activity from the moment you first land on our homepage until long after you may have closed your account.

Specific examples of covered activities include but are not limited to: browsing our pricing pages, comparing hosting plans, filling out the signup form for a 70% off promotional offer, verifying your email address during account creation, uploading website files via FTP or File Manager, creating databases in cPanel or similar control panels, configuring email accounts, purchasing and renewing domain names, requesting SSL installation, opening a support ticket about server performance, participating in customer satisfaction surveys, subscribing to our newsletter, or using our one-click installers for WordPress, Joomla, or other applications. This policy also extends to any automated background processes such as server monitoring, backup creation, or security scanning that occur after you have activated a service.

Important limitation: This policy does NOT apply to any personal data that our customers may process on their own hosted websites, applications, or databases where Hostiera functions solely as a neutral data processor. In those situations, the customer who owns the hosted content remains the sole data controller and bears full responsibility for their own privacy practices and compliance. Hostiera only processes such data as instructed by the customer and in accordance with our separate Data Processing Addendum.

Hostiera does not monitor or control the content hosted by customers. Users are solely responsible for ensuring that their hosted content complies with all applicable laws, including intellectual property, copyright, and anti-spam regulations. Hostiera reserves the right to suspend or terminate services and disclose relevant data if required by law or upon receiving valid legal requests.

2. Detailed Definitions of Key Terms – With Extensive Explanations and Examples

To eliminate any possible ambiguity and to ensure complete understanding, we provide the following comprehensive definitions. Each term is explained in plain language, followed by its legal meaning under the DPDP Act, and then illustrated with multiple practical examples directly relevant to Hostiera’s web hosting ecosystem.

These definitions form the foundation of the entire policy and are referenced repeatedly in the sections that follow to ensure consistency and clarity.

3. Comprehensive Categories of Information We Collect – Extremely Detailed Breakdown

Hostiera collects only the minimum data necessary to deliver reliable, secure, and high-performance hosting services. We have organized the collected information into clearly defined categories. For each category we explain exactly what is collected, when it is collected, why it is needed, and provide several concrete examples.

3.1 Identity and Contact Information

This category includes all data that directly identifies you as an individual or business. We collect it primarily during account creation, checkout, and account management.

• Full legal name (first name, middle name if provided, last name, or registered company name)
• Primary email address and any secondary or recovery email addresses
• Telephone number including country code and mobile number for SMS notifications
• Complete billing address (house number, street, locality, city, state, PIN code, country)
• Company-specific details such as GSTIN, PAN number, or CIN (for business accounts only)

Why collected: To create your legal account, generate accurate GST-compliant invoices, send important service communications, and comply with tax and KYC regulations. Example 1: When you choose the 70% off promotional hosting plan and proceed to checkout, your name and address are required to issue a proper tax invoice. Example 2: If you open a support ticket saying “I cannot log in,” we use your registered phone number to verify your identity before resetting credentials.

3.2 Account Authentication and Security Data

• Chosen username and encrypted password (stored as salted hash only)
• Two-factor authentication (2FA) configuration details and backup recovery codes
• Any security questions and answers you set up during registration
• API keys, OAuth tokens, SSH keys, or FTP credentials you generate
• Login history timestamps and associated IP addresses

Example: Every time you log into https://hpanel.space/clientarea.php from a new device, we record the IP and device fingerprint to help prevent unauthorized access and alert you if suspicious activity is detected.

3.3 Technical, Device, and Log Data (Automatically Collected)

• Internet Protocol (IP) address and Internet Service Provider (ISP) details
• Browser name and version, operating system name and version, device type and screen resolution
• Referring website URL, pages visited on our site, time spent on each page, and clickstream data
• Server-side access logs, error logs, bandwidth usage statistics, CPU and memory consumption metrics
• Date and time stamps for every action including login, file upload, database query, or email send

Example: If your shared hosting account suddenly starts sending 10,000 spam emails in one hour, our automated systems use the log data to isolate the issue and protect other customers on the same server.

3.4 Billing, Payment, and Financial Transaction Data

• Payment method type (credit/debit card, UPI, net banking, wallet)
• Tokenized payment details (never full card numbers)
• Complete transaction history, invoice numbers, payment references, and refund records
• Tax identification and exemption certificates if provided

3.5 Service Usage and Hosting-Specific Data

• Selected hosting plan details, domain names associated with your account, addon services purchased
• Resource consumption metrics: disk space used, monthly bandwidth transferred, number of databases, email accounts, sub-domains
• Website statistics from tools such as AWStats or Google Analytics (when you enable them)
• Support ticket content, live chat transcripts, and any files you attach to support requests

Example: For a VPS customer, we track CPU usage graphs so we can proactively suggest upgrading to a higher tier before your site experiences slowdowns.

3.6 Marketing, Preference, and Feedback Data

• Newsletter subscription status and preferred frequency
• Responses to customer satisfaction surveys or feedback forms
• Marketing consent flags and opt-out preferences
• Any preferences you set in the client area (currency display, language, dashboard layout)

4. Methods and Channels Through Which We Collect Information

We collect your information through four distinct and transparent channels. Each channel is explained below with detailed examples of when and how it occurs.

1. Direct collection from you: Every form you fill, every checkout process you complete, every support ticket you submit, every KYC document you voluntarily upload. This is the most common method and always happens with your active participation.
2. Automatic collection through technology: Server logs, cookies, pixels, Google Analytics scripts, and similar tools that operate in the background whenever you visit our website or use our services. No action is required from you beyond simply loading a page.
3. Collection from trusted third-party sources: Payment gateways confirming successful transactions, domain registries providing WHOIS verification data, or fraud detection services flagging risky signups.
4. Collection from publicly available sources: Limited to verifying business legitimacy for corporate accounts (e.g., checking MCA records for CIN validation).

5. Detailed Purposes for Processing Your Personal Data – Expanded with Multiple Scenarios

Hostiera processes personal data exclusively for the specific, explicit, and legitimate purposes listed below. We never engage in processing that is incompatible with these purposes. Each purpose is accompanied by several real-life scenarios to illustrate practical application.

• Contract Performance and Service Delivery: Creating and maintaining your hosting environment, provisioning servers, enabling control panel access, sending automated renewal reminders. Scenario 1: On the day your 70% off plan activates, we use your email to send welcome instructions and login details. Scenario 2: When you purchase a domain, we process the registration using the contact details you provided.
• Customer Support and Issue Resolution: Responding to inquiries, troubleshooting technical problems, providing guidance on control panel usage. Scenario: You report slow loading times; we cross-reference your account ID with recent server logs to identify the root cause.
• Billing, Invoicing, and Financial Management: Generating GST invoices, processing payments and refunds, handling subscription renewals and upgrades.
• Security, Fraud Prevention, and Abuse Detection: Monitoring for unauthorized access, preventing DDoS attacks, detecting malware uploads, and protecting the shared server environment. Scenario: Multiple failed login attempts from an unusual country trigger an automatic security email to you.
• Legal and Regulatory Compliance: Fulfilling tax obligations, responding to lawful government or court requests, maintaining audit-ready records. Scenario: We retain invoice data for the full period required under GST law even after you cancel your account.
• Service Improvement, Analytics, and Product Development: Using fully anonymized or aggregated data to understand usage patterns and decide on infrastructure upgrades. Scenario: We notice that 60% of VPS customers use more RAM at night, so we adjust resource allocation algorithms accordingly.
• Marketing and Promotional Communications (only with explicit consent): Sending occasional emails about new features, discounts, or service upgrades. You can withdraw this consent instantly at any time.

In cases of account suspension due to non-payment, policy violations, or security concerns, access to services may be temporarily restricted. Users may request limited access to their data or backups by contacting support, subject to verification and applicable legal restrictions.

6. Lawful Bases for Processing Under Indian Law – Full Compliance Mapping

The DPDP Act requires a valid lawful basis for every instance of processing. Hostiera maintains an internal record mapping each processing activity to its corresponding basis. The table below provides a complete overview.

6.1 Consent Collection, Logging, and Withdrawal Mechanism

Hostiera implements a clear and verifiable consent mechanism for all processing activities that rely on user consent. Consent is collected through unticked checkboxes, cookie banners, and explicit opt-in forms. We maintain secure logs of consent including timestamp, IP address, and method of capture to demonstrate compliance with applicable laws.

Users may withdraw consent at any time by:

• Clicking the “unsubscribe” link in marketing emails
• Disabling cookies via the consent banner or browser settings
• Submitting a request through the client area

7. Data Sharing, Disclosure, and Third-Party Processors – Exhaustive List and Safeguards

Hostiera does not sell, rent, or trade your personal data for monetary gain. Any sharing is strictly limited, purpose-bound, and protected by robust contractual safeguards including Data Processing Agreements (DPAs) that mirror the protections in this policy.

All third-party service providers act either as independent data controllers or as data processors under binding agreements. Their roles are defined based on the nature of services provided, and they are obligated to process data only for specified purposes.

In the event of a corporate merger, acquisition, or asset sale, your data may be transferred as part of the business assets, but any successor company will remain bound by this policy or an equivalent standard.

In the event of suspected fraud, chargebacks, or payment disputes, Hostiera reserves the right to share relevant transaction data, account activity logs, and identity verification information with payment processors, banks, and legal authorities strictly for investigation and dispute resolution purposes.

8. Cross-Border Data Transfers and International Safeguards

Certain infrastructure partners and processors are located outside India (primarily in Europe, the United States, and Singapore). Whenever personal data leaves Indian borders, Hostiera ensures adequate protection through one or more of the following mechanisms: Standard Contractual Clauses approved by the European Commission and adapted for India, Binding Corporate Rules where applicable, adequacy decisions recognized by the Indian government, or additional contractual and technical safeguards such as encryption and regular audits. We conduct Data Protection Impact Assessments (DPIAs) prior to any new international transfer arrangement and maintain a current record of all such transfers.

Primary user data may be stored on servers located in India or other jurisdictions depending on service configuration. Sensitive personal data is handled with enhanced safeguards and, where required by law, may be stored within India in compliance with applicable data localization requirements.

9. Cookies, Tracking Technologies, and Similar Tools – Complete Technical Disclosure

We use cookies and comparable technologies (pixels, web beacons, local storage) to enable core functionality, enhance user experience, and analyze usage. Below is a full categorized list with duration and purpose.

You can manage or delete cookies through your browser’s privacy settings at any time. However, disabling strictly necessary cookies will prevent you from using core features such as logging into your client area or completing a purchase.

Upon your first visit, Hostiera displays a cookie consent banner allowing you to Accept, Reject, or Customize cookie preferences. Non-essential cookies are not activated until explicit consent is provided. You may update your preferences at any time through the cookie settings link available on our website.

10. Robust Security Measures – Technical, Organizational, and Administrative Controls

Hostiera implements multiple layers of protection to safeguard your data against unauthorized access, loss, alteration, or disclosure. These include but are not limited to:

• End-to-end encryption using TLS 1.3 on every single page and API call
• Automated encrypted daily backups stored in geographically separate locations
• Advanced Web Application Firewall (WAF), DDoS mitigation, and intrusion prevention systems
• Regular third-party penetration testing, vulnerability scanning, and code audits
• Strict role-based access control and multi-factor authentication for all internal staff systems
• Comprehensive employee training programs on data protection, phishing awareness, and confidentiality
• Incident response plan tested quarterly

While Hostiera performs regular backups, these are provided as a best-effort service and are not guaranteed. Users are strongly advised to maintain independent backups. Hostiera shall not be held liable for any data loss arising from system failures, user actions, or third-party incidents.

11. Data Retention Framework – Detailed Schedule with Justification

We retain personal data only for the minimum period necessary to fulfill the purposes outlined earlier. The table below provides a complete retention schedule with legal and operational justifications.

12. Your Rights as a Data Subject – Exhaustive Explanation and Step-by-Step Exercise Guide

The DPDP Act grants you powerful and enforceable rights regarding your personal data. Hostiera honors every right fully and responds to valid requests without undue delay and usually within 30 calendar days. All requests are free of charge unless they are manifestly unfounded or excessive (in which case a reasonable administrative fee may apply). Below is a detailed breakdown of each right with practical examples and exact instructions on how to exercise it.

12.1 Right of Access

You have the right to obtain confirmation whether we process your personal data and, if so, to receive a complete copy of that data along with information about the purposes, categories, recipients, and storage period. Example: You can request a full data export containing every field we hold about your account. How to exercise: Log into the client area → Support → New Ticket with subject “Data Access Request” or email [email protected].

12.2 Right to Rectification

You can ask us to correct any inaccurate or incomplete personal data. Example: Update your billing address before your next domain renewal to avoid delivery issues with invoices.

12.3 Right to Erasure (Right to be Forgotten)

You may request deletion of your personal data when it is no longer necessary, consent is withdrawn, or processing is unlawful. Certain legal retention obligations may limit this right. Example: After cancelling all services and waiting the mandatory retention window, you can request full account deletion.

12.4 Right to Restriction of Processing

You can request that we temporarily stop processing your data while a complaint or dispute is being resolved.

12.5 Right to Data Portability

You can receive your data in a structured, commonly used, and machine-readable format (such as JSON or CSV) and transmit it to another service provider.

12.6 Right to Object and Withdraw Consent

You can object to processing based on legitimate interests or withdraw any previously given consent for marketing or non-essential processing. Withdrawal is simple and takes immediate effect for future processing.

General instructions for exercising any right: Preferred method is to submit a ticket inside your client area at https://hpanel.space/clientarea.php with the subject line clearly stating the right you wish to exercise. Alternatively, email [email protected]. We may request identity verification (such as a copy of government ID) to prevent unauthorized requests. We will acknowledge your request within 48 hours and provide a substantive response within 30 days.

13. Automated Decision-Making, Profiling, and Artificial Intelligence Tools

Hostiera uses limited automated decision-making systems primarily for fraud detection, risk scoring of new signups, and security threat identification. These systems analyze patterns in login behavior, payment attempts, and resource usage to flag potential abuse. You have the right to request human review of any automated decision that produces legal effects or similarly significant impact on you. We do not use automated tools for credit scoring or any decisions that would deny you service without human oversight.

Users may request a manual review of any automated decision by submitting a support ticket with the subject “Automated Decision Review.” Hostiera will complete such reviews within 7–14 business days and provide a clear explanation of the outcome.

14. Protection of Children’s Privacy

Our services are designed exclusively for individuals who are at least 18 years of age. We do not knowingly collect, process, or store personal data from children under the age of 18. If we discover that we have inadvertently collected data belonging to a child, we will delete that data immediately and permanently. Parents or legal guardians who believe their child’s information has been submitted should contact [email protected] without delay.

15. Third-Party Websites, Links, and Embedded Content

For your convenience, our website and client area may contain hyperlinks to external third-party websites, payment gateways, or blog articles. Once you click any such link and leave the Hostiera domain, this Privacy Policy no longer applies. We strongly encourage you to review the privacy policy and security practices of every external website you visit. Hostiera bears no responsibility for the data handling practices of those third parties.

16. KYC, Identity Verification, and Anti-Money Laundering Procedures

To comply with applicable anti-money laundering (AML), counter-terrorism financing (CFT), and “Know Your Customer” (KYC) regulations, Hostiera may request government-issued identification documents (such as PAN card, Aadhaar, passport, or driving license) for certain accounts or high-value transactions. All such documents are collected through secure encrypted channels, stored with military-grade encryption, and deleted automatically once the mandatory retention period expires. Providing KYC information is voluntary except where legally required; refusal may result in account suspension until compliance is achieved.

17. Data Breach Response and Notification Procedure

In the unlikely event that a security incident results in a personal data breach that is likely to risk your rights and freedoms, Hostiera follows a documented incident response plan that includes:

• Immediate internal investigation within 24 hours of discovery
• Notification to the relevant Indian authorities (where required by law) within 72 hours
• Direct notification to affected users via email and in-site messages as soon as practicable and no later than 7 business days where legally mandated
• Provision of clear information about what data was involved, the potential impact, and the remedial steps we have taken

We maintain cyber insurance and work with specialized forensic experts to minimize any harm.

In case of a data breach, users are advised to immediately:

• Change account passwords and enable two-factor authentication
• Review recent account activity for unauthorized actions
• Contact our support team for assistance

18. Policy Updates, Revisions, and Notification of Changes

Hostiera reserves the absolute right to revise, amend, or update this Privacy Policy at any time to reflect changes in our services, legal requirements, technological advancements, or industry standards. Whenever a material change is made, the “Last Updated” date at the bottom of this page will be refreshed. We will notify existing customers of significant changes by email or a prominent banner inside the client area at least 30 days before the new version takes effect (where feasible). Your continued use of any Hostiera service after the effective date of any updated policy constitutes your acceptance of the revised terms. We encourage you to review this page periodically for the latest information.

Hostiera maintains an internal archive of previous versions of this Privacy Policy. Users may request access to prior versions for reference or audit purposes.

19. Governing Law and Dispute Resolution

This Privacy Policy, and any disputes or claims arising out of or in connection with it, shall be governed by and construed exclusively in accordance with the laws of the Republic of India. Any legal proceedings shall be brought exclusively before the competent courts located in Haryana, India. You agree to submit to the personal jurisdiction of such courts for the purpose of litigating any such claims.

20. Contact Information and Grievance Redressal Mechanism

Last Updated:

This Privacy Policy is subject to periodic review and may be updated from time to time to reflect changes in legal requirements, regulatory guidelines, or our business practices. We encourage users to review this page regularly to stay informed of any updates.