// Legal

Privacy Policy

Effective date · 2 November 2026

What changes

  • Named providers. We replace “Stripe or equivalent” with Stripe Payments Europe (Ireland) and add Neon (database, hosted in Frankfurt) and OVH as our email provider.
  • Automation and invoicing. We add our cloud server provider in the EU, which hosts our automation servers (they run scheduled tasks, send internal alerts to the team and prepare the invoice register from payments), and the invoicing platform and tax advisory firm in Spain with which we issue invoices and keep our accounts and tax filings.
  • Google, only with your permission. If you accept campaign measurement in the cookie banner, when you place an order and on each renewal charged in the 90 days after the click we send Google Ireland the click identifier from its ad, the amount and the order reference, and we let it know about refunds. Google processes them under its own terms.
  • What data we process and why. We add account security data (sign-ins, two-step verification and a record that you accepted these documents), campaign measurement data and site analytics, the last two only with your consent. Usage data now reflects what we actually collect: server traffic and power status, not CPU or RAM usage.
  • How long. We used to say that technical logs were kept for a maximum of 12 months; they are now kept for longer. Emails sent, the log of administration actions and the record that you accepted these documents are kept while you have an account and, after that, until the limitation period expires for the legal actions in which they may serve as evidence: as a general rule, 5 years from the closure of your account (or longer if the applicable law sets a longer period), or until an ongoing claim is resolved. Sign-ins are deleted when you delete your account. Campaign measurement data is unlinked from your account 90 days after the click or when you withdraw consent. Enquiries sent through the contact form and quote requests are kept for 24 months from the last contact and are then deleted.
  • Where data is processed. We clarify that the Vercel servers that handle the website and the customer panel are in the USA, and that Neon, Stripe and Google may also process data there, with the safeguards of the EU-US Data Privacy Framework or the Standard Contractual Clauses. You can ask us for a copy of those safeguards.
  • Required data and automated decisions. We explain which data is needed to order and that we do not make solely automated decisions, except that Stripe’s fraud prevention may decline a payment.
  • Exercising your rights. We no longer ask for a copy of your ID document: it is enough to write from your account email, and we only ask for something more if there are reasonable doubts.

At PulsarHost we protect your personal information with the same rigour we apply to protecting your uptime. This document explains what data we collect, what we use it for and what rights you have over it, in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).

1. Data controller

  • Owner: Juan D. Piqueras González (self-employed professional, trade name PulsarHost)
  • Tax ID (NIF): 53083952K
  • Tax domicile: C/ Alfonso Castelao, 31 · 17300 Blanes (Girona), Spain

For any queries about your personal data, or to exercise your rights under the GDPR, you can write to private@pulsarhost.es.

2. Data we collect

  • Contact details: name, email, phone number and postal address when you order a service or contact support.
  • Billing data: tax ID (NIF), company name and tax address for issuing legally required invoices.
  • Technical data: IP address, browser type, operating system and access logs necessary for providing the service and for security.
  • Usage data: your server’s traffic and power status, to monitor the service, warn you if you are approaching your traffic limit and verify outages.
  • Account security data: a record of sign-ins, your two-step verification data and a record that you accepted these documents (date, IP address and browser).
  • Campaign measurement data (only if you accept it in the cookie banner): the identifier of the click on our ad, landing page, campaign and date, linked to your email or your account when you sign in, place an order or ask us for a quote.

3. Purposes of processing

  • Provision of the hosting service you have ordered.
  • Provision of technical and sales support.
  • Issuing invoices and complying with tax obligations.
  • Detection and prevention of fraud or abusive use.
  • Operational notifications (incidents, maintenance, expiry dates).
  • Marketing communications only if you have given express consent.
  • Measurement of our advertising campaigns and website analytics, only if you accept them in the cookie banner.
  • Keeping evidence of your acceptances and of technical records in order to establish, exercise or defend legal claims.

4. Legal basis for processing

  • Performance of the contract (Art. 6(1)(b) GDPR) for providing the service.
  • Compliance with legal obligations (Art. 6(1)(c) GDPR) in tax and commercial matters.
  • Legitimate interests (Art. 6(1)(f) GDPR) for security, fraud prevention and service improvement, and for keeping evidence of your acceptances and the technical records with which to defend ourselves against possible claims. For as long as they remain necessary for that purpose, they are not erased even if you ask us to (Art. 17(3)(e) GDPR).
  • Consent (Art. 6(1)(a) GDPR) for marketing communications, non-essential cookies, website analytics and campaign measurement.

Contact details and billing data are required to place an order: without them we cannot provide the service or issue the invoices required by law.

We do not make decisions that significantly affect you based solely on automated processing. When processing a payment, Stripe may automatically decline it if its anti-fraud system considers it risky; if this happens to you, write to us and we will review it with you.

5. Retention period

We keep your data for as long as the contractual relationship lasts and, once it has ended, for the legally required periods (a minimum of 6 years for tax and commercial records, Art. 30 of the Spanish Commercial Code, the Código de Comercio). Technical and security records (the emails we send you and the log of the actions we take from our administration panel on your account or your services) and the record that you accepted these documents (date, version, IP address and browser) are kept for as long as you have an account with us and, afterwards, until the limitation period expires for the legal actions in which they may serve as evidence: as a general rule, 5 years from the closure of your account (the period for personal actions, Art. 1964 of the Spanish Civil Code, the Código Civil), or longer if the applicable law sets a longer period or, if a claim is ongoing, until it is resolved. When you delete your account, the record of your acceptances is kept separately, with the email address the account had, for this purpose only. We also note separately the date you closed the account, with that email address, only to count the period. Once that period has passed, the emails and acceptances are deleted and your data is removed from the log of administration actions. The sign-in log is kept for as long as you have an account and is deleted when you delete it. Campaign measurement data is unlinked from your account 90 days after the click, or earlier if you withdraw your consent. Enquiries sent through the contact form and quote requests are kept for 24 months from the last contact and are then deleted.

6. Recipients of your data

We only disclose your data to third parties where required by law, where you give us your consent or in the cases explained in this section. We work with the following providers, which process the data on our behalf (data processors):

  • Data centre providers in the Netherlands (EU): physical hosting of the VPS servers and of the dedicated servers in Amsterdam.
  • Data centre providers in the United Kingdom: physical hosting of the dedicated servers in London.
  • Vercel Inc. (USA): hosting of the website and the customer panel. The servers that handle sign-in, the panel, ordering and sending emails are located in the USA.
  • Neon Inc. (USA): database for the customer panel, hosted in Frankfurt (Germany, EU).
  • OVH SAS (France, EU): sending and receiving email.
  • Stripe Payments Europe, Limited (Ireland, EU): payment processing and tax calculation.
  • Invoicing platform and tax advisory firm in Spain: issuing invoices and keeping our accounts and tax filings.
  • Cloud server provider in the EU: hosting of our automation servers, which run scheduled tasks, send internal alerts to the team and prepare the invoice register from payments.

In addition, only if you accept campaign measurement in the cookie banner, when you place an order and on each renewal charged in the 90 days after the click we send Google Ireland Limited (Ireland, EU) the click identifier from its ad, the amount and the order reference, and we let it know if we later refund that payment, to measure our Google Ads campaigns. Google processes that data under its own terms and privacy policy.

7. International transfers

Some data is transferred outside the European Economic Area (EEA): the Vercel servers that handle the website and the panel are located in the USA, and Neon, Stripe and Google may also process data in the USA. Each of those transfers is based on the EU-US Data Privacy Framework (an adequacy decision of the European Commission, Art. 45 GDPR) if the provider is certified under it or, failing that, on Standard Contractual Clauses approved by the Commission (Art. 46(2)(c) GDPR). You can ask us for a copy of those safeguards by writing to private@pulsarhost.es.

The dedicated servers in London are hosted in the United Kingdom, which is covered by an adequacy decision of the European Commission (Art. 45 GDPR).

8. Your rights

As a data subject you have the right to:

  • Access your personal data.
  • Rectify it if it is inaccurate.
  • Request its erasure when it is no longer necessary.
  • Restrict, or object to, its processing in certain circumstances.
  • Request the portability of your data.
  • Withdraw your consent at any time.
  • Lodge a complaint with the Agencia Española de Protección de Datos, the Spanish data protection authority (aepd.es).

To exercise these rights, write to us at private@pulsarhost.es from your account email. If we have reasonable doubts about your identity, we will ask you for the additional information needed to confirm it.

9. Changes to this policy

We may update this policy to reflect changes in the law or in the service. The date at the top reflects the latest revision. Account holders will be notified of substantial changes by email.