Privacy statement

Who is responsible

Hostingway B.V., trading as Stavane, Vlierweg 12, 1032 LG Amsterdam, the Netherlands. Chamber of Commerce (KvK) 98861468, VAT NL868675179B01. We are the controller for the personal data described here. Questions and requests go to support@stavane.com.

This statement is about your data as our customer or visitor. For personal data that you store on your servers you are the controller and we are your processor; that is covered by the Data processing agreement.

What we process and why

Data	Why	Legal ground
Name, e-mail address, billing country, password (stored as a hash only), second factor	To open and secure your account and to reach you about it	Contract
Company name, address and VAT number, when you give them	Invoices and VAT	Legal obligation
Sign-in records: moment, IP address, country derived from it, browser	To show you your own sessions and to detect a takeover of your account	Legitimate interest: security
Payments: amount, moment, method, brand and last four digits of a card, a technical fingerprint of the card, the 3-D Secure result and the risk score of the payment. Never the card number	To book your credit, to refund, to answer disputes and to keep fraud out	Contract, legal obligation, legitimate interest: fraud prevention
Fraud signals: a keyed hash of your normalised e-mail address, of the card fingerprint, of a device identifier and of your IP address	To give a welcome offer once per person and to recognise accounts that belong together in abuse. The hashes cannot be turned back into the original value	Legitimate interest: fraud prevention
Your servers: names, plans, locations, addresses, usage per hour	To deliver and bill the service	Contract
Messages you send to support and messages we send to you	To help you and to be able to show what was said	Contract
A record of important actions in your account, by you and by our staff	Security and accountability	Legitimate interest
Measurement, only after you agreed to it: the pages you visit, an identifier that the measurement cookie gives your browser, and the steps you take as a customer (account created, e-mail address confirmed, card verified, credit granted, top-up with its amount and currency, first server). Never your name, e-mail address or payment details	To see which pages and campaigns lead to customers	Consent, which you can withdraw at any moment through "Cookie settings" at the bottom of the website
The country your connection comes from and the country of your card, compared with the list of countries under sanctions	To meet sanctions law. A match puts the account under review and a person decides; you are told in the console	Legal obligation
Consent to the immediate delivery of credit and to automatic top-ups, with moment and IP address	To be able to prove what you agreed to	Legal obligation, contract

We do not sell personal data and we make no decisions with legal effect for you by automated means alone. A payment or welcome offer that our fraud rules refuse can always be looked at by a person: ask support.

Cookies

The console uses only cookies that are needed: your session, protection against forged requests, a device identifier used for fraud prevention, and the order you are configuring. The website stores your choice of currency. We set no measurement or advertising cookies without your consent, and nothing is sent to a measurement service before you said yes. After a yes, the steps in the table above are also sent from our server, tied to the identifier of the measurement cookie and never to your name or e-mail address. After a no, or when you withdraw your yes, we forget that identifier and send nothing.

How long we keep it

Data	Period
Invoices and payment records	Seven years after the end of the year they belong to, as Dutch tax law requires
Account details	Until you close your account, and ninety days after that. Then your name and e-mail address are removed; invoices keep their own copy for the period above
Sign-in records	Twelve months
Fraud signals and records of disputes	Five years after the last activity of the account
Record of actions in the account	As long as the account exists, and after that as long as a legal period above requires. IP addresses in it are removed after twelve months
Support messages	Two years after the matter is closed
Data on your servers	Until you remove the server, or until we remove it as described in the Terms of service, chapter 7. Backups end with the server
Logs of an application that you ask to see in the console	One day. We remove passwords and keys from them before we store them
The sign-in we made for the application on your server	Until you have seen it once, and at most twenty-four hours

Who receives your data

We use the parties listed below. They process data for us under a contract and only for the purpose named. Apart from them we give data to others only when the law requires it.

Where your data is

Our platform runs on our own equipment in the Netherlands. Servers you start in another location run there. Where a party below processes data outside the European Economic Area, that happens under the safeguards named with that party.

Your rights

You can ask us for access to your data, for a copy, for correction or removal, and for restriction of processing, and you can object to processing that rests on our legitimate interest. Write to support@stavane.com from the e-mail address of your account. We answer within one month. If you are not satisfied with our answer, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Changes

When this statement changes in a way that matters to you, we tell you by e-mail before it takes effect.

Parties that receive personal data