Terms of Service and Privacy Policy

Operator: CODECYBER s.r.o.

Registered office: Korunní 2569/108, 101 00 Prague 10

Company ID No.: 29690242

Contact email: [email protected]

Effective from: 17 June 2026

1. Introductory provisions and definitions

1.1. These Terms of Service (the “Terms”) govern the rights and obligations between the operator identified above (the “Operator”) and a user (the “User”) in connection with use of the online storage and file-sharing service available at https://giganthost.com (the “Service”).

1.2. Together with the Privacy Policy, the Policy for Reporting Illegal Content (DSA) and, where applicable, the Data Processing Agreement, these Terms constitute the complete contractual documentation.

1.3. By registering, creating an account or beginning to use the Service, the User confirms that they have read, understood and agreed to these Terms.

1.4. Legal relations are governed by the laws of the Czech Republic, particularly Czech Act No. 89/2012 Coll., the Civil Code, as amended, and directly applicable legislation of the European Union.

1.5. Definitions:

• Account — a user account created during registration.
• Content — all files, data and materials uploaded, stored or shared by the User through the Service.
• Subscription — a paid plan that entitles the User to use the Service to the agreed extent.
• Sharing — a function that allows Content to be made accessible to third parties, for example by link.
• Consumer — a User who is a natural person and enters into the agreement outside the scope of their trade, business or profession.

2. Description of the Service

2.1. The Service is a private online cloud-storage service and hosting service that allows the User to upload, store, manage, download and share the User’s own data files within the limits of the selected plan, including storage capacity, number of files, bandwidth, available export methods and similar parameters. Content is private by default and accessible only to the User. It is made available to a third party solely by the User through targeted Sharing, for example by sending a link to selected persons.

2.2. For legal purposes, the Service is a digital-content service or digital service within the meaning of Sections 2389a et seq. of the Czech Civil Code.

2.3. Supported limits, formats, technical interfaces, available export methods and any technical restrictions are stated in the plan description or Service help materials. The Operator provides only the updates and technical support stated for the plan or required by applicable law.

2.4. Availability and backups. The Service is not supplied with a guarantee of uninterrupted availability or speed and does not include a guaranteed service level agreement. The Operator does not provide a separate backup service for User Content. Warranties and liability are addressed in Section 9.

2.5. No critical use. Unless expressly agreed otherwise, the Service is not intended to be the sole repository for critical data, statutory archiving, medical records, regulated financial services, state secrets or any other use requiring guaranteed availability, auditability or special certification. The User must maintain independent backups of their Content.

2.6. Advanced encryption. If the User enables advanced file encryption, the User is responsible for keeping the password and recovery phrase secure. If either is lost or unavailable, it may become impossible to decrypt the files and access to the data may be permanently lost. The Operator cannot retrieve or restore the password or recovery phrase and, to the extent permitted by applicable law, is not liable for loss of data caused by their loss or unavailability.

3. Registration, age and Account security

3.1. Use of the Service requires registration and creation of an Account. The User must provide true, accurate and current information and keep it up to date.

3.2. Age. The Service is intended for persons over 18 years of age. Younger persons, who must be at least 15 years old, which is the age threshold for a child’s consent in connection with information-society services in the Czech Republic, may use the Service only with the consent and supervision of a legal representative.

3.3. Security. The User is responsible for safeguarding login credentials and for all activity under the Account. The User must use a strong, unique password; enable two-factor authentication where available; set permissions on shared links appropriately; and encrypt sensitive data on the User’s own side before uploading it. The Operator is not liable for misuse of an Account resulting from breach of these obligations.

3.4. A User may create only one Account unless agreed otherwise. The Operator may reject a registration or terminate duplicate or fraudulent Accounts.

4. Plans, price, payment and automatic renewal

4.1. The Operator provides storage and data-sharing space for a fee within the limits of the selected plan. Current plans and prices are published within the Service, and each price is identified as including or excluding VAT as applicable.

4.2. Order involving an obligation to pay. Before completing an order, the User is shown the price, the length of the billing period, information about automatic renewal and any minimum commitment period. The order is completed using a button clearly labelled “Order involving an obligation to pay” or with equivalent wording.

4.3. A Subscription is paid in advance on a monthly, annual or other agreed billing cycle. Access to paid features is conditional on payment.

4.4. Automatic renewal. Unless stated otherwise, the Subscription renews at the end of each period for the same period at the price applicable at the time of renewal. The User may cancel automatic renewal in the Account settings at any time before the current period ends. The Operator will generally send a reminder before renewal.

4.5. Payments are processed by payment-service providers. The Operator does not store payment-card details.

4.6. Price changes. A price change affecting an existing Subscription will be announced at least 30 days in advance and will apply only from the next billing period. If the price increases materially, the User may terminate the agreement without penalty before the change takes effect.

4.7. Late payment. If a Subscription is not paid, the Operator will notify the User and provide a reasonable remedy period of at least 7 days. If payment remains outstanding after that period, the Operator may restrict or suspend access to the Service and proceed under Section 7 concerning deletion of data. Action may be immediate in the event of a serious breach of security or applicable law.

5. User Content and licence

5.1. All Content remains the property of the User or other authorised persons. The Operator does not acquire ownership or copyright in the Content.

5.2. The User grants the Operator a royalty-free, non-exclusive licence to Content solely to the extent necessary for technical operation of the Service, including storage, technical processing, transmission and making Content accessible on the User’s instructions. The licence ends when the Content is deleted, except for necessary technical backups retained for the technically necessary period.

5.3. The User represents and warrants that they are authorised to upload and share the Content and that doing so does not infringe the rights of third parties.

5.4. When Sharing Content by link, the User is responsible for deciding who receives access and to what extent. The Operator is not responsible for further dissemination of shared Content by its recipients.

6. Prohibited use and Sharing

6.1. The User is solely responsible for all Content they upload, store or share. The User agrees not to store, share or disseminate through the Service any Content that:

• a) infringes the laws of the Czech Republic or the European Union;
• b) infringes third-party intellectual-property rights, including copyright and trade marks;
• c) is illegal, fraudulent, deceptive, defamatory or otherwise harms third-party rights;
• d) constitutes child sexual abuse material, depicts unlawful violence or terrorism, or incites hatred or criminal activity;
• e) contains malware, viruses or malicious code;
• f) constitutes unsolicited commercial communication or is used for phishing;
• g) infringes the privacy or personality rights of third parties.

6.2. The User must not use the Service in a way that places a disproportionate load on it, disrupts its security or operation, circumvents technical restrictions or enables unauthorised access.

6.3. Unless expressly permitted by the selected plan, the User must not use the Service for large-scale public file distribution, Sharing protected Content without the necessary authorisation, or as a substitute for a content-delivery network beyond ordinary private use.

6.4. Fair Use Policy (FUP). Each Account is subject to a monthly data-transfer limit determined by the storage capacity of the selected plan. The aggregate volume of data uploaded to and downloaded from the Service during one calendar month must not exceed ten times the storage capacity of that plan.

6.5. The User must not use the Account or allow it to be used in a manner that results in active connections from two or more different IP addresses at the same time.

6.6. The Operator is not required to monitor Content actively but may act on notices submitted under the DSA Policy.

7. Export, Account termination, non-payment and deletion of data

7.1. Export. While the Account is active, the User may download Content at any time using the ordinary functions of the Service.

7.2. Termination by the User. The User may terminate the Account at any time through the Account settings or by sending a request to the contact email.

7.3. Termination by the Operator. If these Terms or applicable law are breached, the Operator may, without prior notice, restrict, block, suspend or terminate the Account and remove Content. The Operator may take the same measures if a Subscription has not been paid or a notice of illegal Content has been assessed and found justified. Content is not removed automatically merely because a notice is received; see the DSA Policy. If these Terms are breached, the User is not entitled to a refund or compensation for any unused part of the Subscription, unless mandatory law provides otherwise.

7.4. Export and deletion periods. When a paid plan ends, Content remains available for download for 14 days, unless the Account was terminated for a serious breach of applicable law or security. After that period, the Content may be permanently deleted. Technical backups may be deleted progressively and within no more than 30 days, unless retention is required by law or necessary to protect legal claims.

7.5. Inactive Accounts. Accounts with no login or valid Subscription for more than 6 months may be terminated and their Content deleted after prior notice.

7.6. The Operator is not liable for loss of data resulting from termination of an Account. The User must back up Content in due time.

8. Consumer rights, withdrawal and lack of conformity of the digital Service

8.1. Withdrawal. A Consumer may withdraw from a distance contract within 14 days after it is concluded. If the Consumer asks for provision of the Service to begin before that period expires, the Consumer acknowledges that, upon withdrawal, they must pay a proportionate amount for the performance supplied up to the time of withdrawal. For digital content not supplied on a tangible medium, the right of withdrawal is lost only under the conditions laid down by law, particularly after prior express consent, appropriate information and confirmation in a durable medium.

8.2. Lack of conformity. The Consumer has statutory rights concerning lack of conformity of digital content and digital services under Sections 2389a et seq. of the Czech Civil Code. These Terms do not affect those rights.

8.3. Nothing in this Section affects any mandatory Consumer rights.

9. Liability and limitations

9.1. Service “as is”. The Operator gives no guarantee of uninterrupted availability, speed, error-free operation or fitness for a particular purpose beyond mandatory law.

9.2. Backups and loss of data. The Operator does not provide a separate backup service for User Content. The User must maintain independent backups. Technical backups are used to restore operation of the Service and do not constitute a separate backup service; the Operator does not guarantee recovery of individual User files from backups. This does not affect Consumer rights concerning lack of conformity or any liability that cannot be excluded or limited by law.

9.3. Damages. To the extent permitted by law, the Operator is not liable for indirect or consequential loss, loss of profit, loss of business opportunity or loss of data. For a User who is not a Consumer, the Operator’s total aggregate liability is limited to an amount equal to the Subscription fees paid for the three months immediately preceding the event giving rise to the loss.

9.4. Downtime and maintenance. The Operator may suspend the Service for maintenance, updates or technical or security reasons. Where possible, planned maintenance will be announced in advance.

9.5. Force majeure. The Operator is not liable for failure to perform caused by circumstances beyond its reasonable control, including failures of suppliers, power or connectivity; cyberattacks; natural events; and acts or decisions of public authorities.

9.6. User Content. The Operator is not responsible for User Content. As a hosting-service provider, its liability is excluded subject to the conditions in Article 6 of Regulation (EU) 2022/2065 (DSA). The Operator acts on assessed notices in accordance with the DSA Policy.

9.7. The limitations in this Section do not apply where prohibited by mandatory law, including harm caused intentionally or through gross negligence and harm to health, and do not affect statutory Consumer rights.

10. Indemnification

10.1. To the extent permitted by law, the User will compensate the Operator for reasonable, proven loss resulting from the User’s culpable breach of these Terms or applicable law. For a Consumer, this provision applies only to the extent that it does not restrict statutory rights.

11. Changes to the Service and these Terms

11.1. Changes to the Service. The Operator may change the Service for technical, security, legal or operational reasons. A change must not impose additional cost on the User. If a change materially impairs use of a paid Service, the User may terminate the agreement without penalty, without affecting any statutory Consumer rights. If the Operator terminates a paid Service without breach by the User, the Operator will refund the proportionate part of the Subscription fee for the period not provided where required by law or by the nature of the termination.

11.2. Changes to these Terms. The Operator will notify Users of material changes to these Terms at least 15 days in advance by email or notice within the Service. Continued use of the Service constitutes acceptance of the changes. A User who does not agree may terminate the agreement.

12. Governing law, dispute resolution and final provisions

12.1. Governing law and jurisdiction. Legal relations are governed by the laws of the Czech Republic. If a Consumer is habitually resident in another EU Member State, this choice does not deprive the Consumer of the protection afforded by mandatory provisions of the law of that habitual residence or affect rules of international jurisdiction.

12.2. Alternative dispute resolution. A Consumer may submit a dispute arising from the agreement to the Czech Trade Inspection Authority (Česká obchodní inspekce) as the competent alternative consumer-dispute-resolution body at https://adr.coi.cz. This does not affect the right to bring proceedings before a court. Consumer-protection supervision is carried out by the Czech Trade Inspection Authority at www.coi.cz.

12.3. Severability. If any provision is invalid or ineffective, the validity of the remaining provisions is not affected. The invalid provision will be replaced by a provision that most closely reflects its intended purpose.

12.4. Communications take place electronically through the Operator’s contact email and the User’s email registered with the Account.

12.5. Language versions. These Terms have been prepared in Czech and English. The Czech version is the original and legally binding version of the Terms. The English version is provided for information purposes only. In the event of any conflict, ambiguity or discrepancy between the Czech and English versions, including any inaccuracy arising from translation, the Czech version shall prevail and be controlling. This does not affect mandatory Consumer rights or statutory requirements concerning the intelligibility and transparency of contract terms.

12.6. These Terms take effect on 17 June 2026.

PRIVACY POLICY (GDPR)

Data controller: CODECYBER s.r.o.

Registered office: Korunní 2569/108, 101 00 Prague 10

Company ID No.: 29690242

Data-protection contact: [email protected]

Effective from: 17 June 2026

1. Introduction and the Operator’s two roles

This Privacy Policy describes how the operator of the GigantHost online storage service processes personal data in accordance with Regulation (EU) 2016/679 (the “GDPR”) and Czech Act No. 110/2019 Coll.

The Operator acts in two roles:

• a) as a controller for account, payment and billing data, communications, operational and security logs, and marketing, as described in this Policy;
• b) as a processor for personal data of third parties that a User uploads to storage as part of the User’s Content. In this role the Operator acts on the User’s instructions, where the User is the controller. Further details are set out in the Data Processing Agreement (DPA) referred to in Section 8.

2. Personal data we process as a controller

a) Registration and account data: name or username, email address, password in hashed form and, where provided, telephone number.

b) Billing and payment data: billing name and address, Company ID and VAT ID for business customers, and payment and subscription history. Payment-card details are processed exclusively by the payment-service provider and are not stored by us.

c) Stored Content: files and data that you upload. We do not access Content except where necessary to operate the Service, comply with legal obligations or respond to a notice of illegal Content under the DSA Policy.

d) Technical and operational data: IP address, device and browser type, access date and time, log files, session identifiers and storage-usage data. We record the IP address at registration, successful login and visits by a signed-in user in order to secure the account, prevent misuse and investigate incidents.

e) Cookies and similar technologies: as described in Section 9.

f) Communications: the content of your communications with support.

3. Purposes and legal bases for processing

4. Retention periods

We retain personal data only for as long as necessary:

• Account data: for the life of the account and for 3 years afterwards to protect legal claims.
• Stored Content: for the life of the account; after a paid plan ends, Content remains available for export for no longer than 14 days and is then deleted. Technical backups are deleted within no more than 30 days.
• Billing and accounting records: for 10 years under Czech VAT and accounting laws.
• Security and operational logs: generally for 6 months and, in the event of an incident, for longer while the incident is investigated and resolved.
• IP address records (registration, login and signed-in page visits): 365 days, after which they are permanently deleted.
• Data processed on the basis of consent for marketing: until consent is withdrawn.

5. Recipients and transfers

5.1. We may disclose data to processors that support the operation of the Service, including server, cloud-hosting and data-centre providers; payment-service providers; email and communication services; analytics tools; accountants, tax advisers and legal advisers; and public authorities where required by law.

5.2. We enter into data-processing agreements with processors as required by Article 28 GDPR.

5.3. Transfers outside the EU/EEA. Where data is transferred outside the EU/EEA, we ensure appropriate safeguards under Articles 44 et seq. GDPR, such as Standard Contractual Clauses approved by the European Commission or an adequacy decision.

6. Your rights

As a data subject, you have the right of access under Article 15 GDPR, rectification under Article 16, erasure under Article 17, restriction of processing under Article 18, data portability under Article 20, objection under Article 21, withdrawal of consent under Article 7(3) without affecting the lawfulness of earlier processing, and the right not to be subject to automated decision-making under Article 22.

You may exercise your rights by emailing [email protected]. We will respond without undue delay and no later than one month after receiving your request.

You may lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz.

7. Data security

7.1. We implement appropriate technical and organisational measures, including TLS encryption in transit, access controls, server security and technical operational backups.

7.2. Technical backups are used to restore operation of the Service and do not constitute a separate backup service for User Content. The Operator does not guarantee recovery of individual User files from backups. Users should keep independent backups and encrypt sensitive data on their own side before uploading it.

7.3. Absolute security cannot be guaranteed. If a personal data breach presents a risk to your rights, we will notify you and the supervisory authority as required by Articles 33 and 34 GDPR.

8. User Content and the Data Processing Agreement (DPA)

8.1. For personal data that you upload as part of Content, such as a file containing data about third parties, you are the controller and the Operator is the processor acting on your instructions. You are responsible for ensuring that such processing is lawful.

8.2. A separate Data Processing Agreement (DPA) is available for business customers and other situations requiring an agreement under Article 28 GDPR. It forms an annex to this Policy and the contractual documentation.

9. Cookies

9.1. We use essential cookies for login and session functions without consent because they are necessary for the Service to operate.

9.2. We use analytics and marketing cookies only on the basis of your active consent given through the cookie banner. Withholding consent must be as easy as granting it, and consent may be withdrawn at any time in the settings.

10. Commercial communications (marketing)

We send commercial communications only with consent or to existing customers in relation to similar products under the conditions of Czech Act No. 480/2004 Coll. Every communication provides a simple way to unsubscribe.

11. Children

The Service is not intended for persons under 18 years of age. In the Czech Republic, the age threshold for a child’s consent in connection with information-society services is 15. We do not knowingly process children’s personal data without the consent of a legal representative.

12. Changes to this Policy

We may update this Policy. We will notify you of material changes by email or by a notice within the Service. The current wording is always available at https://giganthost.com.