Legal
Privacy policy
1. Controller
Ejgil Møller Hovedskou, trading as Headwood Hosting, Åvænget 2, 5463 Harndrup, Denmark, e-mail Headwoodhosting@gmail.com is the controller for the processing of personal data about customers and visitors to this website. Questions about your data can be sent to Headwoodhosting@gmail.com.
2. What data, why and on what legal basis
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| E-mail, encrypted (hashed) password, session data, chosen language | Creating and running your account and keeping you logged in. The account is created when you order and activated on payment. | Art. 6(1)(b) (contract) |
| Acceptance of the terms and privacy policy and any marketing consent, with time stamp | Documenting the agreement and your consent | Art. 6(1)(c) and (f) (duty to document) and section 10 of the Danish Marketing Practices Act |
| News and offers by e-mail (only if you said yes) | Sending marketing | Art. 6(1)(a) (consent), cf. section 10 of the Danish Marketing Practices Act |
| Orders, plans, server names, configuration and files you upload | Providing and managing your Minecraft server | Art. 6(1)(b) (contract) |
| Payment information (via Stripe: payment ID, amount, last 4 digits of the card, country) | Collecting payment and issuing receipts | Art. 6(1)(b) and (c) (contract and the Danish Bookkeeping Act) |
| IP address and action log (e.g. login, start/stop, deletion) | Protecting against abuse and unauthorised access, and troubleshooting | Art. 6(1)(f) (legitimate interest in secure operation) |
| Support requests | Answering and documenting requests | Art. 6(1)(b) and (f) |
We only send news and offers by e-mail if you have actively said yes when ordering or in your account settings. The box is never pre-ticked. You can withdraw your consent at any time in the control panel under Account or via the unsubscribe link in every e-mail. We send service messages about your account, payments and servers (e.g. order confirmation, receipts and operational notices) regardless, because they are part of the agreement. We do not profile you or sell your data.
Country from your IP address
To show prices in the right currency and choose the language, we look up your IP address in a local database (IP to Country Lite from DB-IP, licence CC BY 4.0) on our own server. Your IP address is not sent to DB-IP or anyone else, and the country is not stored. If you use a VPN, the country of the VPN connection counts. The legal basis is Art. 6(1)(f) (legitimate interest in showing correct prices and language).
We process information about the players who log in to your server as a processor on your behalf (see section 14 of the terms).
3. Recipients and processors
| Recipient | Role | Location |
|---|---|---|
| Contabo GmbH | Hosting provider and processor: hosting of the website, control panel and Minecraft servers. Server data (accounts, orders, server files and worlds) and backups are stored on Contabo's servers in Germany. | Germany (EU) |
| Stripe Payments Europe Ltd. | Payment processing. Stripe is an independent controller for certain data, for example fraud prevention. | Ireland (EU). Stripe may transfer data to the USA on the basis of the EU-U.S. Data Privacy Framework and the EU standard contractual clauses. |
| Pterodactyl (open source, self-hosted) | Managing the servers. Runs on our own server, so no data is shared with third parties. | Germany (EU) at Contabo |
| Modrinth | When you search for and install plugins and mods in the control panel, our server fetches search results and files from Modrinth. The server only sends the search terms, server type and Minecraft version, not information about you. However, the icon images in the search results are loaded directly by your browser from cdn.modrinth.com, so Modrinth receives your IP address when you view them. Modrinth is an independent controller for this information. | USA (Rinth, Inc.) |
| Public authorities | When required by law, for example the Danish Tax Agency or the police | Denmark |
We have or will enter into data processing agreements with our processors. We do not yet use an external e-mail provider; this list will be updated before we start using one. We keep our own books, and accounting records are kept for 5 years under the Danish Bookkeeping Act (see section 4).
4. How long we keep the data
- Unpaid orders: the account and the order are deleted automatically after 48 hours if the payment is not completed.
- Account: for as long as you have an account and 6 months after the last active subscription, unless you ask us to delete it sooner.
- Server files, worlds and backups: deleted 30 days after the agreement ends.
- Login sessions: expire after 30 days of inactivity and are deleted automatically.
- Login attempts (IP addresses): kept in memory only, for 10 minutes, to protect against guessing attacks.
- Consents: for as long as the account exists and then 2 years as documentation of the consent.
- Action log: 12 months.
- Accounting records (invoices, payments): 5 years from the end of the financial year they relate to, under the Danish Bookkeeping Act.
5. Security
Passwords are only stored as a salted hash (scrypt). All traffic is encrypted with TLS. Access to the systems is restricted and protected with key-based login, a firewall and automatic blocking of repeated login attempts. Card details are handled exclusively by Stripe.
6. Your rights
You have the right to:
- access the data we process about you,
- have incorrect data rectified,
- have data erased,
- have the processing restricted,
- receive your data in a common machine-readable format (data portability), and
- object to processing based on our legitimate interest.
Write to Headwoodhosting@gmail.com. We reply within one month. The right to erasure does not apply to data we are required by law to keep.
7. Complaints to the Danish Data Protection Agency
You can complain about our processing of your personal data to Datatilsynet (the Danish Data Protection Agency), Carl Jacobsens Vej 35, 2500 Valby, Denmark, datatilsynet.dk.
8. Cookies
See the cookie policy.