Privacy Policy

1. Who is responsible for your data

The data controller is GMH SYSTEMS Sp. z o.o., registered office at Marcina Kasprzaka 31/119, 01-234 Warsaw, Poland (VAT ID PL5273203762). For any privacy matter, contact us at gamehost@gmhsystems.pl.

2. What personal data we collect

Account and billing data

Email address, username, a securely hashed password, and billing details (name or company name, address and VAT ID where provided).

Service operational data

Server configuration, IP allocations, subdomains, and data you store on or transmit through your server. We access server content only as needed to operate or secure the Services, or where legally required.

Technical and usage data

IP address, device and browser information, access and server logs, and analytics and cookie data (see the cookies section).

Fraud-prevention data

Signals from our anti-abuse tools (for example Cloudflare Turnstile) and from Stripe used to detect and prevent fraud and abuse.

3. Purposes and legal bases

We use personal data to:

• create and manage your account and provide the Services (performance of a contract, Art. 6(1)(b) GDPR);
• process payments, renewals, invoices and VAT (contract and legal obligation, Art. 6(1)(b) and (c));
• keep the Services secure, prevent fraud and abuse, and troubleshoot (legitimate interests, Art. 6(1)(f));
• provide support and communicate about your Service (contract or legitimate interests);
• run marketing, advertising and analytics (consent, Art. 6(1)(a), which you can withdraw at any time).

4. Who we share your data with

We share data only with providers that help us run the Services, under appropriate data-processing agreements:

• Stripe — payment processing and fraud prevention;
• Cloudflare — network security, CDN and Turnstile anti-abuse;
• our data-centre and infrastructure providers in Germany and Poland — server hosting;
• Google (Analytics and Ads), TikTok and Hotjar — analytics and advertising, with your consent;
• our email and support providers;
• authorities or advisors where required by law or to establish, exercise or defend legal claims.

5. International transfers

Some providers (for example Google, TikTok, Hotjar and Stripe) may process data outside the EU/EEA, including in the United States. Where this happens, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision.

6. How long we keep your data

We keep account and Service data while your account is active. Invoicing and accounting records are kept for the period required by law (in Poland, generally five years). Data stored on your server is deleted after your Service ends, following a short retention window. We keep only what we need for the purposes above or to meet legal obligations.

7. Your rights

Under the GDPR you have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent at any time (without affecting processing already carried out). To exercise these rights, contact gamehost@gmhsystems.pl.

8. Cookies and similar technologies

We use cookies and similar technologies, managed through our own consent tool — no third-party consent platform is involved, and the record of your choice stays on our infrastructure. Strictly necessary cookies keep the site and checkout working; analytics cookies (Google Analytics and Hotjar) and advertising cookies (Google Ads) load only after you agree. We also use Cloudflare Turnstile to protect our checkout and forms. You can review or change your choices at any time, and a full list of every cookie, its purpose and its retention is in our Cookie Policy.

We use Hotjar to understand how visitors move through our website and ordering process, using heatmaps and session recordings of on-page behaviour such as mouse movement, clicks and scrolling. Recordings run only after you accept analytics cookies and cover only the ordering pages, not the rest of your account panel. The personal details you enter at checkout — your name, address, VAT ID, email and password — are automatically masked and are never captured in a recording.

9. How we protect your data

We use technical and organisational measures such as encryption in transit, access controls and monitoring to protect personal data. No system is completely secure, so we cannot guarantee absolute security; keeping your account credentials confidential is your responsibility.

10. Children’s privacy

The Services are not directed to children under 16. If you are under the age of digital consent in your country, please use the Services only with the involvement of a parent or guardian.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here and, for material changes, provide additional notice where appropriate.

12. Complaints

If you believe we have mishandled your data, please contact us first so we can help. You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO), or the authority in your country of residence.