09Contracts & legal
Data protection at Nexthosting and the DPA (AVV)
Which data Nexthosting processes, how long it is stored, what rights you have and how to conclude the data processing agreement (DPA, AVV) in your customer account.
In short
Nexthosting processes your data to manage your account and contracts, handle payments and operate the servers securely. If you store other people’s data on your server or website – visitors, players, customers – you are responsible for it and generally need a data processing agreement (DPA, German: Auftragsverarbeitungsvertrag, AVV; Art. 28 GDPR). You conclude it yourself in the customer account under Einstellungen (settings).
Who is responsible
Section titled “Who is responsible”The controller for data processing is Friedl & Friedl GbR (Nexthosting), represented by Erik Friedl, Vetschauer Straße 19, 01237 Dresden, Germany. The contact details for privacy questions are in the privacy policy under “Hinweis zur verantwortlichen Stelle” (notice on the responsible body).
Which data is processed, and what for
Section titled “Which data is processed, and what for”| Area | Which data | What for |
|---|---|---|
| Customer account | Name, email, possibly phone and address; for business customers company, legal form, representation, VAT ID | Opening the account, concluding and billing contracts |
| Login with Discord, Google, Twitch, Steam | Identifier at the service, display name, email (not with Steam), timestamps | Matching the login to your account. Nexthosting does not receive your password at the service. |
| Payment | Payment data via payment service providers (SOFORT, Google Pay, Apple Pay, Stripe, Mollie, PayPal, Klarna) | Processing payments |
| Orders | Order, contact, device and transaction data | Fraud prevention and risk checks, especially for higher order values |
| Game server monitoring | Status, load, player count, map, version | History charts, crash detection, notifications |
| “Problem melden” (report a problem) | Server details, monitoring history, last console lines (can be deselected) | Handling your ticket; access credentials are masked |
| Own IP and Nexthosting Schutz (protection) | Connection data of senders (IP address, port, time, volume) | Protection against attacks; content is not analysed |
| Cancellation via the form | Your details in the form, time of receipt | Handling and proving the cancellation |
| Website | Connection data via Cloudflare and the host | Secure and fast delivery |
Statistics and marketing services only run with your consent. You can change your decision at any time under cookie settings with Akzeptieren (“accept”) or Ablehnen (“decline”).
How long data is stored
Section titled “How long data is stored”| Data | Storage period |
|---|---|
| Customer account | as long as you are registered |
| Invoice data | 10 years (German Fiscal Code, German Commercial Code) |
| Links to login services | until you disconnect them in your profile or the account ends |
| Cancellations via the form | until the end of the 3rd calendar year after receipt; declarations that cannot be matched, 90 days after processing is complete |
| Receipt page of a cancellation | retrievable for 30 days |
| Game server metrics | detailed 48 hours, hourly 35 days, events 30 days |
| Nexthosting Schutz | metrics 30 days, attack data up to 2 months, settings up to 60 days after the IP is released or the contract ends |
| Reports via the abuse form | until completion, then usually 3 years |
| Cookie decision | cookie nh_cookie_consent_v1 180 days, identifier nh_visitor_uuid_v1 365 days |
What happens to the data on your server after a contract ends is explained in Data after contract end.
Your rights
Section titled “Your rights”Under the GDPR (DSGVO) you have the right to:
- information about your stored data – free of charge,
- rectification of incorrect data and erasure of data no longer needed (unless a retention duty applies),
- restriction of processing,
- data portability in a common, machine-readable format,
- objection to processing based on legitimate interests and to direct marketing,
- withdrawal of consent, for example for cookies or the newsletter,
- complaint to a data protection supervisory authority.
To exercise them, use the contact address in the privacy policy or write a ticket.
The data processing agreement (DPA, AVV)
Section titled “The data processing agreement (DPA, AVV)”When you need one
Section titled “When you need one”A data processing agreement under Art. 28 GDPR provides that Nexthosting processes personal data that you store on your products only on your instructions. You are then the controller and Nexthosting the processor.
Nexthosting offers the DPA to all customers – private and business. For business customers it must be concluded before data processing begins, where legally required (AGB B2B § 21; AGB = General Terms and Conditions).
How to conclude the DPA
Section titled “How to conclude the DPA”- Log in to your customer account and open Einstellungen (nexthosting.net/account/settings), and there the data protection (DSGVO) area with the card “AV-Vertrag” (DPA).
- Choose the data categories that apply to your use, for example master data, communication data or log data.
- Choose the group of data subjects, for example your own customers or the visitors to your website.
- Generate the agreement, check the preview and confirm it.
- The agreement is stored permanently in your customer account. You can download it there at any time – for example as proof to a supervisory authority.
Your own responsibility
Section titled “Your own responsibility”- You are yourself responsible for third parties’ personal data that you process through your products (AGB § 17).
- Your website needs its own privacy policy and, if you run it commercially, an imprint (Impressum). This also applies to a commercially operated server page (add-on terms 9c).
- Console and log lines of your game server can contain player names and IP addresses. Do not share them publicly.
Frequently asked questions
Section titled “Frequently asked questions”As a private customer, do I have to conclude a DPA?
Section titled “As a private customer, do I have to conclude a DPA?”Only if you process other people’s data that is not purely private – for example through a public website or a public community server. The DPA is available to you as a private customer in the same way.
Where is my data?
Section titled “Where is my data?”Game servers and VPS run in the data centre in Frankfurt am Main. Backups, web hosting and parts of the infrastructure are in Falkenstein (Saxony) and Nuremberg. Dedicated servers from the catalogue are located in Falkenstein or Helsinki (Finland); the location is stated with the respective server. Login services such as Discord, Google and Twitch also process data in the USA – their privacy notices apply for that.
How do I get information about my data?
Section titled “How do I get information about my data?”Write to the contact address in the privacy policy or open a ticket. The information is free of charge.