Data controller: CODECYBER s.r.o.
Registered office: Korunní 2569/108, 101 00 Prague 10
Company ID No.: 29690242
Data-protection contact: [email protected]
Effective from: 17 June 2026
1. Introduction and the Operator’s two roles
This Privacy Policy describes how the operator of the GigantHost online storage service processes personal data in accordance with Regulation (EU) 2016/679 (the “GDPR”) and Czech Act No. 110/2019 Coll.
The Operator acts in two roles:
- a) as a controller for account, payment and billing data, communications, operational and security logs, and marketing, as described in this Policy;
- b) as a processor for personal data of third parties that a User uploads to storage as part of the User’s Content. In this role the Operator acts on the User’s instructions, where the User is the controller. Further details are set out in the Data Processing Agreement (DPA) referred to in Section 8.
2. Personal data we process as a controller
a) Registration and account data: name or username, email address, password in hashed form and, where provided, telephone number.
b) Billing and payment data: billing name and address, Company ID and VAT ID for business customers, and payment and subscription history. Payment-card details are processed exclusively by the payment-service provider and are not stored by us.
c) Stored Content: files and data that you upload. We do not access Content except where necessary to operate the Service, comply with legal obligations or respond to a notice of illegal Content under the DSA Policy.
d) Technical and operational data: IP address, device and browser type, access date and time, log files, session identifiers and storage-usage data. We record the IP address at registration, successful login and visits by a signed-in user in order to secure the account, prevent misuse and investigate incidents.
e) Cookies and similar technologies: as described in Section 9.
f) Communications: the content of your communications with support.
3. Purposes and legal bases for processing
| Purpose | Legal basis under Article 6 GDPR |
|---|---|
| Creating and managing an account and providing the Service | Performance of a contract — point (b) |
| Processing payments and billing | Performance of a contract and compliance with a legal obligation — points (b) and (c) |
| Accounting and tax obligations | Compliance with a legal obligation — point (c) |
| Securing the Service and preventing misuse and fraud | Legitimate interests — point (f) |
| Responding to notices of illegal Content under the DSA | Compliance with a legal obligation and legitimate interests — points (c) and (f) |
| Customer support | Performance of a contract or legitimate interests — points (b) and (f) |
| Sending commercial communications and news | Consent or legitimate interests in relation to existing customers — points (a) and (f) |
| Improving the Service and analytics | Legitimate interests or consent — points (f) and (a) |
4. Retention periods
We retain personal data only for as long as necessary:
- Account data: for the life of the account and for 3 years afterwards to protect legal claims.
- Stored Content: for the life of the account; after a paid plan ends, Content remains available for export for no longer than 14 days and is then deleted. Technical backups are deleted within no more than 30 days.
- Billing and accounting records: for 10 years under Czech VAT and accounting laws.
- Security and operational logs: generally for 6 months and, in the event of an incident, for longer while the incident is investigated and resolved.
- IP address records (registration, login and signed-in page visits): 365 days, after which they are permanently deleted.
- Data processed on the basis of consent for marketing: until consent is withdrawn.
5. Recipients and transfers
5.1. We may disclose data to processors that support the operation of the Service, including server, cloud-hosting and data-centre providers; payment-service providers; email and communication services; analytics tools; accountants, tax advisers and legal advisers; and public authorities where required by law.
5.2. We enter into data-processing agreements with processors as required by Article 28 GDPR.
5.3. Transfers outside the EU/EEA. Where data is transferred outside the EU/EEA, we ensure appropriate safeguards under Articles 44 et seq. GDPR, such as Standard Contractual Clauses approved by the European Commission or an adequacy decision.
6. Your rights
As a data subject, you have the right of access under Article 15 GDPR, rectification under Article 16, erasure under Article 17, restriction of processing under Article 18, data portability under Article 20, objection under Article 21, withdrawal of consent under Article 7(3) without affecting the lawfulness of earlier processing, and the right not to be subject to automated decision-making under Article 22.
You may exercise your rights by emailing [email protected]. We will respond without undue delay and no later than one month after receiving your request.
You may lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz.
7. Data security
7.1. We implement appropriate technical and organisational measures, including TLS encryption in transit, access controls, server security and technical operational backups.
7.2. Technical backups are used to restore operation of the Service and do not constitute a separate backup service for User Content. The Operator does not guarantee recovery of individual User files from backups. Users should keep independent backups and encrypt sensitive data on their own side before uploading it.
7.3. Absolute security cannot be guaranteed. If a personal data breach presents a risk to your rights, we will notify you and the supervisory authority as required by Articles 33 and 34 GDPR.
8. User Content and the Data Processing Agreement (DPA)
8.1. For personal data that you upload as part of Content, such as a file containing data about third parties, you are the controller and the Operator is the processor acting on your instructions. You are responsible for ensuring that such processing is lawful.
8.2. A separate Data Processing Agreement (DPA) is available for business customers and other situations requiring an agreement under Article 28 GDPR. It forms an annex to this Policy and the contractual documentation.
9. Cookies
9.1. We use essential cookies for login and session functions without consent because they are necessary for the Service to operate.
9.2. We use analytics and marketing cookies only on the basis of your active consent given through the cookie banner. Withholding consent must be as easy as granting it, and consent may be withdrawn at any time in the settings.
10. Commercial communications (marketing)
We send commercial communications only with consent or to existing customers in relation to similar products under the conditions of Czech Act No. 480/2004 Coll. Every communication provides a simple way to unsubscribe.
11. Children
The Service is not intended for persons under 18 years of age. In the Czech Republic, the age threshold for a child’s consent in connection with information-society services is 15. We do not knowingly process children’s personal data without the consent of a legal representative.
12. Changes to this Policy
We may update this Policy. We will notify you of material changes by email or by a notice within the Service. The current wording is always available at https://giganthost.com.