Privacy Policy
Last updated: 17 October 2026
This Privacy Policy explains how BullHost (“we”, “us”) collects and uses personal data when you visit www.bullhost.org, buy a hosting plan, or contact us. We process personal data in line with the EU General Data Protection Regulation (GDPR) and the Maltese Data Protection Act (Cap. 586).
1. Who we are
The data controller is:
Darko Proshev, trading as BullHost
Msida, Malta
Email for privacy requests: privacy@bullhost.org
2. What data we collect and why
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Creating your customer account and providing your hosting service | Name, email, billing address, phone (if given), login details, domain names, service settings | Performance of a contract – Art. 6(1)(b) |
| Orders, invoices and payments | Name, billing address, order details, payment reference and amount (we do not store card numbers) | Contract – Art. 6(1)(b); legal obligation (tax and accounting) – Art. 6(1)(c) |
| Support (tickets, live chat, email) | Name, email, the content of your messages, technical details you share | Contract – Art. 6(1)(b); legitimate interest in answering enquiries – Art. 6(1)(f) |
| Comments on our website | Name, email, comment text, IP address, browser information | Legitimate interest in running the site and preventing spam – Art. 6(1)(f) |
| Security of the website and servers | IP address, server and access logs, login attempts | Legitimate interest in security and fraud prevention – Art. 6(1)(f) |
| Website statistics (Google Analytics) | Pages visited, device and browser type, approximate location, an online identifier stored in a cookie | Your consent – Art. 6(1)(a). Analytics only runs if you accept statistics cookies in our cookie banner. |
We do not sell your personal data and we do not use it for automated decision-making or profiling that has legal effects on you.
3. Cookies
We use cookies that are necessary for the website and shop to work (for example, your cart and login). Statistics cookies are only set after you give consent, and you can change your choice at any time via the “Manage consent” link on our website. Full details are in our Cookie Policy.
4. Who we share data with
We only share personal data with service providers that help us run BullHost, under contracts that require them to protect it:
- Server and data centre provider – our website and customer hosting run on servers located in Germany (EU).
- Banks and payment providers – to receive and verify your payments.
- Google Ireland Ltd – Google Analytics, only if you consent to statistics cookies.
- Domain registries and registrars – if you register a domain through us, the registry requires your contact details.
- Accountants and public authorities – where needed for tax and accounting, or when the law requires it.
5. Transfers outside the EU
Our servers are in the EU. Some providers, such as Google, may process data in the United States. Where this happens, the transfer is protected by the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.
6. How long we keep data
- Account and service data – while you are a customer, then deleted or anonymised within 12 months after your service ends, unless we need it for a dispute.
- Invoices and accounting records – for the period required by Maltese tax and accounting law.
- Support messages – up to 2 years after the ticket is closed.
- Comments – until you or we remove them.
- Google Analytics data – 2 months.
- Server logs – up to 30 days, unless needed to investigate a security incident.
- Backups – removed automatically as backups rotate.
7. Websites and data our customers host with us
When you host a website or email with BullHost, you decide what personal data is stored there. For that data you are the controller and BullHost acts as your processor: we only store and process it to provide the hosting service, and never use it for our own purposes. A data processing agreement is available on request.
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted, where we no longer need it or legally must;
- restrict or object to processing based on our legitimate interests;
- receive your data in a portable format;
- withdraw your consent at any time (this does not affect processing before the withdrawal).
To use any of these rights, email us at privacy@bullhost.org. We will reply within one month. If you are not happy with how we handle your data, you can complain to the Maltese supervisory authority, the Information and Data Protection Commissioner (IDPC) – idpc.org.mt – or to the data protection authority in your own EU country.
9. Security
We protect personal data with encrypted connections (SSL/TLS), access controls, regular updates, firewalls and backups. No system is completely secure, but we work to keep risks low and will inform you and the IDPC of a personal data breach where the law requires it.
10. Children
Our services are intended for adults and businesses. We do not knowingly collect data from children under 16.
11. Changes to this policy
We may update this policy when our services or the law change. The date at the top shows the latest version. If we make important changes, we will notify customers by email.