Privacy Policy

As a controller, we collect only what we need to provide and run the Services:

• Account and billing data (name, email, address, organisation, VAT number, payment status) — to create your account, take payment and meet our legal accounting obligations. Billing runs in our client area at my.2-host.com.
• Support and enquiry data (your messages, contact details) — to answer you and provide support.
• Technical and security logs (IP addresses, timestamps, request and error logs) — to operate the Services, keep them secure, and investigate abuse or incidents.
• Usage statistics — Google Analytics in the client area, only if you consent (see "Cookies and analytics" below).

• Performance of a contract — to provide the Services you order and manage your account.
• Legal obligation — to keep accounting and tax records, and to respond to lawful requests.
• Legitimate interests — to secure and improve our infrastructure, prevent abuse and fraud, and communicate with you about your service. We balance these against your rights.
• Consent — where we ask for it, for example any optional marketing. You can withdraw consent at any time.

When you use our hosting, you control the personal data your sites and applications store, and we process it on your behalf as your processor. The full terms are in our Data Processing Agreement (2-host.com/en/legal/dpa). In short:

• We process that data only to provide the Services and on your documented instructions, including these Terms.
• We keep it stored within the EU/EEA (our infrastructure is in a Tier-3 data centre in the EU).
• We apply appropriate technical and organisational measures to protect it, and keep our staff bound by confidentiality.
• We engage sub-processors only under contracts with equivalent data-protection obligations (see "Sharing and sub-processors").
• We will help you, so far as reasonably possible, to respond to data-subject requests and to meet your own GDPR obligations.
• We will notify you without undue delay if we become aware of a personal-data breach affecting your data.
• On termination we will delete or, where you ask and it is technically possible, return your data, except where we must keep it by law.

We do not sell your personal data. We share it only with service providers who help us run the Services, under contracts that require them to protect it and use it only as instructed. These include:

• An EU-based data-centre operator that provides the physical infrastructure in the EU.
• A payment provider that processes your payments (we do not store full card numbers).
• A domain registrar / registry, where you register or transfer a domain.
• Email delivery for transactional and support messages.
• Google, for reCAPTCHA spam protection on client-area forms, and for Google Analytics if you consent to statistics.
• tawk.to, for the live chat in the client area, if you consent to it.

The sub-processors that handle data you host with us are listed in our Data Processing Agreement. We may also disclose data where we are legally required to do so.

Your data and the data you host with us are stored and processed within the EU/EEA. Some providers we rely on (Google for reCAPTCHA and, with your consent, Google Analytics, and tawk.to for live chat) may process data outside the EU/EEA; where any transfer of personal data outside the EU/EEA is involved, we rely on an approved safeguard such as an adequacy decision or the European Commission’s Standard Contractual Clauses.

We keep account and support data for as long as you are a customer and for a reasonable period afterwards. Accounting and invoicing records are kept for the period required by Swedish law (currently seven years under the Bookkeeping Act, Bokföringslagen). Security logs are kept only as long as needed for security and operational purposes. Data you host with us is kept until you delete it or your service ends.

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw any consent you have given. To exercise any of these, contact us at privacy@2-host.com and we will respond within the time the GDPR allows (normally one month).

If your data is inside hosting you control, please contact the website or service operator (the controller) for those requests; we will support them as your processor. You also have the right to complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY, imy.se), or your local supervisory authority in the EU.

We ask for your consent before using any cookie that is not strictly necessary. On your first visit to 2-host.com or our client area at my.2-host.com, a banner lets you accept all, reject all, or choose per category. Your choice applies to both sites, is kept for 12 months, and you can change or withdraw it at any time with "Cookie settings" at the bottom of every page. Rejecting does not limit what you can buy or manage.

• Necessary (always on): the client-area session and security cookies that keep you logged in and protect forms, your shopping cart, and your language, currency and light/dark theme. The th_consent cookie stores your cookie choice. These do not need consent.
• Spam and abuse protection: client-area forms such as login, registration, checkout and contact use Google reCAPTCHA (our legitimate interest in security). Google receives technical data such as your IP address and browser details.
• Statistics (only with your consent): Google Analytics in the client area measures how pages are used, with the cookies _ga and _ga_* (kept up to 2 years). The data is processed by Google.
• Live chat (only with your consent): the tawk.to chat window in the client area. It sets its own cookies and, if you are logged in, receives your name and email address so we know who we are talking to.

This marketing website itself sets no tracking or advertising cookies and loads no third-party trackers. It remembers your theme and currency choice in your browser only.

The Services are intended for adults and businesses. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this policy from time to time. We will post the updated version here with a new date, and for significant changes we will let you know directly where appropriate.

For any privacy matter, contact 2-Host Web Hosting & Cloud Services at privacy@2-host.com, or write to Enköping, Sweden.