Last updated: 14 October 2026
In short
Contents
The controller for the processing described here is:
INCUBATEC GmbH – Srl
Registered office: Via Scurcià 36, 39046 Ortisei (BZ), Italy
Headquarters: Zona industriale Pontives 17, 39040 Laion (BZ), Italy
VAT no. IT 02283140214
E-mail: [email protected] · PEC: [email protected]
This policy applies to www.webhosting24.com, our client area at console.webhosting24.com and the services you order there. webhosting24.de is operated by webhosting24 GmbH, Munich, which has its own privacy policy.
We have not appointed a Data Protection Officer. For all data protection questions, write to [email protected].
When you open our website or client area, your browser sends technical data: IP address, date and time, the page requested, the referring page, browser and operating system. We need this to deliver the pages and to protect them against attacks and abuse. Our websites are delivered through the network of Cloudflare, Inc. (USA), which filters malicious traffic and may show a security check.
Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). Log files of our website are kept for 30 days. Logs of the client area, such as logins, orders and domain transactions, are kept for 6 months, because the ICANN Registrar Accreditation Agreement requires 180 days for domain transactions. We keep logs longer only to investigate a specific attack or abuse.
We only use cookies and similar technologies that the website needs to work, unless you agree to more. Our consent banner is provided by CookieYes Limited (United Kingdom), which keeps a record of your choice. You can change your choice at any time with “Cookie settings” at the bottom of every page.
Necessary cookies:
Legal basis: Art. 6(1)(f) GDPR and Art. 122 of the Italian Privacy Code (Legislative Decree 196/2003), under which technically necessary cookies do not require consent. Any other cookies are set only with your consent (Art. 6(1)(a) GDPR).
We count visits to our website and client area with Matomo, an open-source tool that runs on our own servers. No data is passed to third parties. IP addresses are shortened by two bytes before they are stored, and no cookies are used for tracking. We use the statistics only in aggregated form to improve our website.
Legal basis: our legitimate interest in understanding how our website is used (Art. 6(1)(f) GDPR), in line with the Italian data protection authority’s guidelines on cookies and other tracking tools of 10 June 2021. Raw data is deleted after 6 months. You can object at any time with the switch below; your choice is stored in a cookie on your device.
Our homepage shows customer reviews from Trustpilot A/S (Copenhagen, Denmark). The review box is loaded only after you accept functional cookies. Your browser then connects to Trustpilot, which receives your IP address and may set cookies. Legal basis: your consent (Art. 6(1)(a) GDPR).
Some icons on our pages are loaded from an external content delivery network (stackpath.bootstrapcdn.com), which receives your IP address when a page loads. Legal basis: our legitimate interest in displaying the website correctly (Art. 6(1)(f) GDPR).
When you search for a domain name, the search term is sent to our server, which checks availability with the domain registries (RDAP and WHOIS) and with our registrar Own Identity. To limit abuse and to see which names are popular, we log the search term with a pseudonym that changes every day; your IP address is not stored. The log is deleted after 90 days. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).
The Facebook, X and LinkedIn icons on our website are plain links. No data is sent to these networks unless you click them.
When you create an account or place an order, we process your name, company, address, e-mail address, phone number, VAT number (for businesses), login data, order and contract details, invoices and payment status, and the IP address used for the order.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and, for invoices and accounting records, our obligations under Italian tax and commercial law (Art. 6(1)(c) GDPR).
To protect you and us against fraudulent orders, we check new orders for plausibility. For this we send order data such as the IP address, e-mail address and billing address to MaxMind, Inc. (USA) and compare it with our own database of previously detected fraud. Orders that look suspicious are reviewed by our staff; we do not make decisions based solely on automated processing that have legal or similarly significant effects on you. Legal basis: our legitimate interest in preventing fraud (Art. 6(1)(f) GDPR).
We send e-mails that are part of the service: order confirmations, invoices, renewal and expiry notices, and notices about outages, planned maintenance, updates and changes such as new PHP versions. As they are needed to provide the service, you cannot unsubscribe from them while you are a customer.
Payment providers also process data for their own purposes, such as fraud checks and anti-money laundering obligations, as independent controllers; their privacy policies apply. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
To register and manage a domain name, we pass the data of the registrant and the contacts (name, organisation, address, e-mail address, phone number) to Own Identity, Inc., our group’s ICANN-accredited registrar (IANA ID 985), which we operate from our headquarters in Italy, and to the registry of the domain extension, for example Verisign for .com, EURid for .eu, Registro.it for .it or DENIC for .de.
For generic domains such as .com, .net and .org, ICANN rules require the registrar to deposit registration data with an approved data escrow agent, DENIC eG (Frankfurt am Main, Germany), and to provide it to ICANN on request. Whether data appears in the public WHOIS or RDAP depends on the rules of each registry; for private individuals in the EU, most registries publish only limited data.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in meeting the obligations of the ICANN Registrar Accreditation Agreement (Art. 6(1)(f) GDPR).
For SSL certificates, the certificate authority (DigiCert for RapidSSL and GeoTrust, Sectigo for Comodo and Sectigo certificates) receives the domain name and the contact data needed for validation. Every certificate is published in public Certificate Transparency logs, which show the domain names and, for organisation-validated certificates, the organisation name.
Websites, e-mails, databases and data on servers you rent are under your control. For this data you are the controller and we are your processor (Art. 28 GDPR): we process it only to provide the service, to keep it secure and on your instructions. We provide a data processing agreement on request; write to [email protected].
Your data is stored at the location you choose: Munich (Germany), New York, Los Angeles or Miami (USA), Singapore, Tokyo (Japan) or Sydney (Australia). If you choose a location outside the EU, you decide on that transfer as the controller.
As a rule, we make a full backup of our hosting services every two weeks and an incremental backup every day; some plans differ. Our backups protect our own operations and do not replace yours: you are responsible for backing up your data. When a contract ends, we delete your content within a few days, and the backups containing it after about two weeks.
If you order Microsoft 365 or ESET licences, we pass the data needed to set them up to our distributor Ingram Micro and to Microsoft Ireland Operations Ltd. or ESET, spol. s r.o. (Slovakia). Their terms and privacy policies apply to the services they provide. Hosted Exchange and SharePoint run either on Microsoft 365 or on our own servers in Munich, Germany, depending on the plan.
If you contact us by ticket, e-mail or phone, we process your contact data and the content of your request to answer it. Tickets stay in your client area so that you can follow them. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) for customers and our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR) for everyone else. We keep tickets and e-mails for up to 10 years after the contract ends, because Italian law requires us to keep business correspondence for that long (Art. 2220 Italian Civil Code).
We send marketing e-mails only if you have opted in (Art. 6(1)(a) GDPR, Art. 130 Italian Privacy Code). You can withdraw your consent at any time in your client area or with the link in each e-mail. Without your consent, you only receive messages about your services, as described under “Service e-mails”. We contact you by phone for marketing only with your consent.
After an order, we may invite you by e-mail to review us on Trustpilot. For the invitation, Trustpilot A/S (Copenhagen, Denmark) receives your name, e-mail address and an order reference. Whether you write a review is up to you. Legal basis: our legitimate interest in customer feedback (Art. 6(1)(f) GDPR); you can object at any time, and we will stop sending invitations.
We do not sell personal data and do not use it for third-party advertising.
You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16) or deleted (Art. 17), to restrict its processing (Art. 18) and to receive it in a portable format (Art. 20). You can object to processing based on our legitimate interests and to direct marketing at any time (Art. 21). If you have given consent, you can withdraw it at any time with effect for the future (Art. 7(3)).
To exercise your rights, write to [email protected]. We answer within one month and may ask you to confirm your identity.
You also have the right to lodge a complaint with a supervisory authority, in particular the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, Italy (www.garanteprivacy.it), or the authority in the EU country where you live or work.
You need to provide the data marked as required in our order forms to conclude a contract; without it we cannot provide the service. For domain registrations, ICANN and the registries require accurate and complete registrant data.
We use encrypted connections (TLS), restrict access to personal data to the staff who need it and keep our systems up to date.
We update this policy when our services or the law change. The date at the top shows the current version.