Privacy policy

1. Privacy at a Glance

General Information

The following notes give a simple overview of what happens to your personal data when you use this website or order a domain, hosting, or another service from us. Personal data is any data that can be used to personally identify you. Detailed information can be found in the privacy policy set out below.

Who is responsible for data processing?

The controller is ANTBOR GmbH, whose contact details can be found in the "Controller" section of this privacy policy.

How do we collect your data?

We collect some of your data because you provide it to us — for example when creating a customer account, ordering a domain or hosting package, or contacting us by e-mail, phone, or our support ticket system.

Other data is collected automatically when you visit the website, such as technical data including your IP address, browser, or operating system information.

What do we use your data for?

Part of the data is collected to ensure error-free and secure provision of our website and services. We process other data to initiate, conclude, and carry out contracts for domains, hosting, and related services — including payment processing, invoicing, and the technical registration of domains with the relevant registries.

What rights do you have regarding your data?

You have the right, at any time and free of charge, to obtain information about the origin, recipients, and purpose of your stored personal data. You also have the right to request correction or deletion of this data. If you have given consent to data processing, you can revoke it at any time for the future. You also have the right, under certain circumstances, to request that the processing of your personal data be restricted. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.

You are welcome to contact us at any time regarding this or any other questions about data protection.

2. Hosting and Content Delivery

We host our website and the infrastructure used to provide our services with the following providers:

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany
• netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany
• OVH GmbH, Oskar-Jäger-Str. 173/K6, 50825 Cologne, Germany
• BunnyWay, informacijske storitve d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia

The servers of these providers store the personal data generated in connection with your use of our website and services — in particular IP addresses, contract, contact, and usage data, as well as backups of this data.

Hosting takes place for the purpose of performing our contracts with prospective and existing customers (Art. 6(1)(b) GDPR) and in the interest of a secure, fast, and reliable provision of our offering (Art. 6(1)(f) GDPR). We have entered into data processing agreements (DPAs) with all providers named above, ensuring that they only process our customers' and website visitors' personal data on our instructions and in compliance with the GDPR. Processing does not take place exclusively in Germany: in addition to data centers in Germany, we also use locations in Finland, France, the Netherlands, Sweden, and Austria. This distribution across multiple locations serves geo-redundancy and thereby a higher availability of our services, and is in our legitimate interest (Art. 6(1)(f) GDPR). Since all of these are member states of the European Union, no personal data is transferred to a third country.

CDN and DNS

For the delivery of content (Content Delivery Network) and for the management of DNS records, we use the following provider:

BunnyWay, informacijske storitve d.o.o.
Dunajska cesta 165
1000 Ljubljana, Slovenia

In doing so, your IP address as well as technical data of the page request, or the data required for the DNS resolution of your domain, may be processed. Processing takes place for the performance of a contract (Art. 6(1)(b) GDPR) as well as on the basis of our legitimate interest in a fast and reliable delivery of our website and our customers' DNS infrastructure (Art. 6(1)(f) GDPR). Since Slovenia is a member state of the European Union, no transfer to a third country takes place. A data processing agreement is in place with this provider.

3. General Information and Mandatory Disclosures

Data Protection

We take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy.

When you use this website or order a service from us, various pieces of personal data are collected. This privacy policy explains what data we collect, what we use it for, and how and for what purpose this happens.

Please note that data transmission over the Internet (e.g. when communicating by e-mail) may have security vulnerabilities. Complete protection of data against access by third parties is not possible.

Controller

The controller responsible for data processing on this website is:

ANTBOR GmbH
Parcusstraße 6
D-55116 Mainz, Germany

Represented by: Anton Borchardt
Phone: +49 6131 624828
E-mail: info@antbor.com

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data (e.g. names, e-mail addresses, etc.).

Data Protection Officer

As a company, we are not required to appoint a data protection officer under Art. 37 GDPR or Sec. 38 BDSG. For questions regarding data protection, please contact the controller named above directly.

Retention Period

Unless a more specific retention period is stated within this privacy policy, your personal data will remain with us until the purpose for processing no longer applies. If you assert a legitimate request for deletion or revoke your consent to data processing, your data will be deleted unless we have other legally permissible grounds for storing it (e.g. tax or commercial law retention obligations); in the latter case, deletion takes place once those grounds no longer apply.

General Information on the Legal Basis for Data Processing

Where you have given consent to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR. Consent can be revoked at any time. Where your data is required for the performance of a contract or the implementation of pre-contractual measures (e.g. when ordering a domain or hosting package), we process your data on the basis of Art. 6(1)(b) GDPR. Where data is required to fulfil a legal obligation (e.g. commercial or tax law retention obligations), processing takes place on the basis of Art. 6(1)(c) GDPR. Data processing may also take place on the basis of our legitimate interest under Art. 6(1)(f) GDPR. The relevant legal basis in each individual case is disclosed in the respective sections of this privacy policy.

Recipients of Personal Data

In the course of our business activities, we work with various external parties, to whom personal data is partly transmitted — for example hosting and infrastructure providers, payment service providers, accounting software, and domain registries and registrars. Details can be found in the corresponding sections of this privacy policy. We only pass on personal data where this is necessary for the performance of a contract, where we are legally obliged to do so, where we have a legitimate interest in the disclosure, or where another legal basis permits it. When engaging processors, we only pass on personal data on the basis of a valid data processing agreement.

Withdrawal of Your Consent to Data Processing

Many data processing operations are only possible with your express consent. You may withdraw consent already given at any time. The lawfulness of data processing carried out prior to withdrawal remains unaffected by the withdrawal.

Right to Object to Data Collection in Special Cases (Art. 21 GDPR)

Where data processing is based on Art. 6(1)(e) or (f) GDPR, you have the right, at any time and for reasons arising from your particular situation, to object to the processing of your personal data. If you object, we will no longer process your affected personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.

Right to Lodge a Complaint with the Competent Supervisory Authority

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, place of work, or the place of the alleged infringement. This right of complaint exists without prejudice to any other administrative or judicial remedy.

Right to Data Portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format.

Access, Correction, and Deletion

Within the framework of applicable statutory provisions, you have the right, at any time, to obtain free information about your stored personal data, its origin and recipients, and the purpose of the data processing, and, where applicable, a right to correction or deletion of this data. You are welcome to contact us at any time in this regard.

Right to Restriction of Processing

You have the right to request the restriction of the processing of your personal data, for example if you dispute the accuracy of data stored with us or if the processing was unlawful. You are welcome to contact us at any time in this regard.

SSL/TLS Encryption

For security reasons and to protect the transmission of confidential content, such as orders or inquiries, this website uses SSL/TLS encryption. You can recognize an encrypted connection by the fact that the browser's address bar changes from "http://" to "https://" and by the lock icon in your browser's address bar.

4. Data Collection on This Website

Cookies

Our website uses only technically necessary cookies. These do not cause any damage to your device and are stored on the basis of Art. 6(1)(f) GDPR; we have a legitimate interest in the technically error-free provision of our services. We do not use any analytics, marketing, or tracking cookies, and no third-party cookies. Specifically, we use the following cookies:

• Session cookie – keeps you logged in during your visit and links your browser session to the server; becomes invalid when the session is closed or after 120 minutes of inactivity.
• XSRF-TOKEN – protects form submissions against cross-site request forgery attacks; session duration.
• locale – stores your selected language; retention period 5 years.
• appearance – stores your light/dark theme preference; retention period 1 year.
• sidebar_state – stores whether the sidebar navigation in the customer area is expanded or collapsed; retention period 7 days.

You can configure your browser to notify you when cookies are set and to allow cookies only on a case-by-case basis, or to reject them generally. Disabling cookies may limit the functionality of this website.

Customer Account and Registration

When you create a customer account with us, we collect the data required for this (including name, e-mail address, password in hashed form). You may optionally further secure your account with two-factor authentication or a passkey (WebAuthn); the cryptographic data required for this is stored solely for security purposes. For each active session, we also store the IP address from which the session was started, in order to detect misuse and to be able to show you your active sessions. Processing takes place for the performance of the usage contract (Art. 6(1)(b) GDPR) as well as to protect your account against unauthorized access (Art. 6(1)(f) GDPR).

Inquiries by E-mail, Phone, or Support Ticket

If you contact us by e-mail, phone, or through our support ticket system, your inquiry — including all personal data resulting from it (name, inquiry, any attachments) — is stored and processed by us for the purpose of handling your request. We do not pass on this data without your consent.

Processing takes place on the basis of Art. 6(1)(b) GDPR where your inquiry relates to the performance of a contract, or on the basis of our legitimate interest in the effective handling of inquiries (Art. 6(1)(f) GDPR). The data remains with us until the purpose for storing it no longer applies (e.g. once your request has been fully handled); statutory retention periods remain unaffected.

Location Suggestion During Ordering (GeoIP)

When you start an order, we suggest a country as a starting value for the country selector based on your IP address. This mapping takes place exclusively locally on our own servers using a locally stored database; your IP address is not transmitted to an external service for this purpose. The suggestion is purely for convenience and can be changed by you at any time. Processing takes place on the basis of our legitimate interest in a simplified order process (Art. 6(1)(f) GDPR).

Sending E-mails

For sending e-mails (including order confirmations, invoices, system notifications, and replies via our support ticket system), we use the e-mail service provider Sendinblue SAS, 9-17, rue Salneuve, 75017 Paris, France. The data required for the respective e-mail (including name, e-mail address, and message content) is transmitted to Brevo. Processing takes place for the performance of the respective contract or the handling of your request (Art. 6(1)(b) GDPR) as well as on the basis of our legitimate interest in the reliable delivery of our e-mails (Art. 6(1)(f) GDPR). A data processing agreement is in place with Brevo. For details, see Brevo's privacy policy: www.brevo.com/legal/privacypolicy.

5. Ordering, Contract Processing, and Domain Management

Processing Customer and Contract Data

We collect, process, and use personal customer and contract data for the establishment, content, and modification of our contractual relationships (Art. 6(1)(b) GDPR). Collected customer data is deleted after completion of the order or termination of the business relationship and expiry of statutory retention periods.

Domain Registration and DNS Management

For the registration, renewal, and management of domains, we transmit the data required for this (including name, address, e-mail address) via our reseller access to netcup GmbH, which in turn forwards this data to the relevant domain registry. Which data is publicly viewable (WHOIS) depends on the registration conditions of the respective TLD. We also use the DNS platform provided by BunnyWay, mentioned in section 2, to manage the nameserver and DNS records of your domains. Processing takes place for the performance of the domain registration contract (Art. 6(1)(b) GDPR).

Verification of the VAT Identification Number

If you provide a VAT identification number as part of your customer or order profile, we verify it in real time against the European Commission's VIES service to check the validity of the number and the registered company name. For this purpose, your VAT ID and country code are transmitted to the European Commission. Processing takes place to fulfil our tax-law obligations in connection with invoicing (Art. 6(1)(c) GDPR).

6. Payment Processing and Accounting

To process payments and to fulfil our commercial and tax-law retention obligations, we use the following service providers:

Stripe

For processing card payments and other electronic payment methods, we use the payment service provider Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland ("Stripe").

If you select a payment method processed via Stripe, the data required for payment processing (including name, billing address, payment data, order details) is automatically transmitted to Stripe. Processing takes place for the performance of the purchase contract (Art. 6(1)(b) GDPR). If you choose advance payment by bank transfer instead, no data is transmitted to Stripe. For details, see Stripe's privacy policy: https://stripe.com/privacy. A data processing agreement is in place with Stripe.

Lexware

For creating and managing invoices, we use the accounting software Lexware Office by Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg im Breisgau, Germany. For this purpose, we transmit the data required for invoicing (including name, address, VAT ID, order and invoice line items). Processing takes place to fulfil our commercial and tax-law retention obligations (Art. 6(1)(c) GDPR). A data processing agreement is in place with Haufe-Lexware.