Privacy Policy

Last updated: 24 July 2026

This Privacy Policy explains how Budgethost AB collects, uses, stores and protects personal data.

It applies to:

• Visitors to budgethost.io.
• Users of my.budgethost.io.
• Customers and their representatives.
• Members of customer and reseller teams.
• People invited to create a portal account.
• People who contact us, request support or request a Data Processing Agreement.
• This policy primarily describes processing for which Budgethost AB acts as the data controller.

When Budgethost AB processes personal data contained in a customer’s hosted services solely on that customer’s instructions, Budgethost AB normally acts as a data processor. That processing is governed by the applicable service agreement and Data Processing Agreement.

The data controller responsible for the processing described in this policy is:

Budgethost AB
Hulta 6525
SE-242 95 Hörby
Sweden

VAT number: SE559255575801
Email: info@budgethost.io
Website: https://budgethost.io

Personal data is any information relating to an identified or identifiable natural person.

This includes information such as names, addresses, email addresses, telephone numbers, account identifiers, IP addresses and other information that can directly or indirectly identify an individual.

Certain information is classified as special-category personal data and receives additional protection under the GDPR. This includes information concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric identification, health, sex life or sexual orientation.

Personal data concerning criminal convictions and offences is governed separately under Article 10 of the GDPR.

Budgethost AB does not intentionally request special-category or criminal-conviction data as part of ordinary account registration, billing or portal administration.

Customers may nevertheless process such information through their hosted services. In those circumstances, the customer is responsible for establishing an appropriate legal basis and safeguards.

Whether Budgethost AB acts as a data controller or data processor depends on the relevant processing activity.

Budgethost AB acts as a data controller when we determine why and how personal data is processed. This includes processing for account administration, customer relationships, billing, security, fraud prevention, support and website operation.

Budgethost AB normally acts as a data processor when we store, transmit, backup or otherwise process personal data contained in customer-hosted services solely to provide those services according to the customer’s documented instructions.

The exact roles of Budgethost AB, a customer and any reseller depend on their respective responsibilities and contractual arrangements.

The information we collect depends on how you interact with Budgethost AB and which services you use.

Identity and contact information

• Name.
• Email address.
• Telephone number, when provided.
• Postal address.
• Country.
• Company or organization name.
• Company registration and VAT information.
• Profile information provided through the portal.

Account and authentication information

• Sign-in email address.
• Password hash.
• Email-verification status.
• Account creation and modification timestamps.
• Authentication and password-reset records.
• Session identifiers and expiration information.
• IP address and browser user-agent information associated with a session.
• Two-factor authentication status.
• Encrypted authenticator secrets and recovery codes.
• Failed authentication attempts and temporary security locks.

Organization and access information

• Customer and reseller organization memberships.
• Team roles and permissions.
• Workspace assignments.
• Read or management access levels.
• Invitations, invitation status and expiration.
• The identity of the person who issued an invitation or granted access.
• Relationships between customers, resellers and workspaces.
• Platform-administration permissions where applicable.

Order, billing and transaction information

• Products and services ordered.
• Order and subscription status.
• Invoice and payment status.
• Billing address and tax information.
• Payment-provider transaction references.
• Card brand, masked payment details or recurring-payment token where supplied by the payment provider.

Budgethost AB does not receive or store complete payment-card numbers or card security codes.

Domain-registration information

When you order or manage a domain, we may collect information required by the relevant registrar or registry, including:

• Registrant name and contact information.
• Organization name.
• Address, telephone number and email address.
• Company registration or VAT information.
• Identification information where required by a registry or applicable law.
• Domain ownership, registration and renewal information.

Portal service and configuration information

The portal may process information relating to the services you manage, including:

• Service names and status.
• Domains and DNS records.
• Mailbox addresses, display names and aliases.
• Access-account and database usernames.
• Backup configuration and recovery-point metadata.
• Service operations such as start, stop, restart, restore and password rotation.
• Customer, workspace and reseller assignments.

Operational and usage information

• Service-health status.
• CPU and memory usage.
• Request counts, traffic volume and response times.
• Mailbox storage usage.
• Operational errors and timestamps.
• Audit events and administrative actions.
• Actor identifiers, action results and correlation identifiers.
• Security and access logs.

Communications

• Customer-support requests and replies.
• Data Processing Agreement requests.
• Email-verification and password-reset communications.
• Team and reseller invitations.
• Feedback and other correspondence.

Website and analytics information

• Cookie-consent choices.
• Pages visited and interactions with the website.
• Browser and device type.
• Approximate location derived from an IP address.
• Pseudonymous analytics identifiers.
• Information stored locally in your browser to remember portal preferences.

When another organization provides your information to us, that organization is responsible for ensuring that it has an appropriate legal basis for doing so.

We normally receive personal data directly from you. We may also receive it from:

• An administrator who invites you to a customer or reseller organization.
• A customer or reseller that grants you access to a workspace.
• A reseller that manages services on behalf of a customer.
• Payment and fraud-prevention providers.
• Domain registrars and registries.
• Service infrastructure and security systems.
• Public authorities where disclosure is legally authorized.

When another organization provides your information to us, that organization is responsible for ensuring that it has an appropriate legal basis for doing so.

We process personal data for the following purposes:

• Creating and administering accounts.
• Verifying email addresses and account ownership.
• Authenticating users and providing two-factor authentication.
• Managing customers, resellers, teams, roles and workspace permissions.
• Provisioning, operating and maintaining services.
• Processing orders, payments, renewals and invoices.
• Registering and managing domains.
• Providing customer support.
• Sending essential account, security and service communications.
• Monitoring service health and performance.
• Detecting and preventing fraud, abuse and unauthorized access.
• Maintaining audit and security records.
• Improving the reliability and usability of our services.
• Responding to legal requests and meeting regulatory obligations.
• Establishing, exercising or defending legal claims.
• Sending newsletters or optional marketing communications where consent has been given.
• Measuring website usage where analytics consent has been given.

We do not sell personal data.

We rely on one or more of the following legal grounds:

Contract

We process information when necessary to enter into or perform an agreement. This includes creating accounts, delivering services, processing payments, providing support and managing domains.

Legal obligation

We process information when required to comply with accounting, tax, regulatory, law-enforcement or other legal obligations.

Legitimate interests

We process information where necessary for legitimate interests pursued by Budgethost AB or another party, provided that those interests are not overridden by your rights and freedoms.

These interests include:

• Protecting accounts, customers and infrastructure.
• Preventing fraud and misuse.
• Maintaining reliable services.
• Administering customer and reseller relationships.
• Keeping audit and security records.
• Improving our services.
• Establishing or defending legal claims.

Consent

We rely on consent for optional activities such as newsletters, marketing communications and non-essential analytics cookies.

You may withdraw consent at any time. Withdrawal does not affect processing that took place before consent was withdrawn.

A my.budgethost.io account may belong to one or more customer or reseller organizations and may have access to one or more workspaces.

Organization administrators can invite users, assign roles and grant or remove workspace access. Authorized resellers may receive access to customer organizations and workspaces they manage.

Depending on the assigned permissions, authorized organization members and reseller personnel may be able to view or manage:

• Organization and workspace names.
• Team memberships and permissions.
• Services and operational status.
• Mailboxes and aliases.
• Domains and DNS records.
• Access accounts.
• Databases and database users.
• Backups and recovery points.
• Service statistics and administrative activity.

Budgethost AB applies role-based access controls, but customers and resellers are responsible for deciding who should receive access and for reviewing that access when responsibilities change.

Authorized Budgethost AB platform administrators may access organization or service information when necessary for support, maintenance, security, administration or legal compliance.

Customers may use Budgethost AB services to host websites, applications, databases, email, files, backups and other information.

The customer normally determines why and how personal data in those services is processed and therefore normally acts as the data controller. Budgethost AB normally acts as the data processor for that information.

Customer-hosted information may include personal data that Budgethost AB cannot identify or categorize in advance.

Customers are responsible for:

• Establishing a lawful basis for their processing.
• Providing required privacy information.
• Responding to data-subject requests.
• Configuring and using services appropriately.
• Giving lawful and documented instructions to Budgethost AB.
• Determining whether special-category information may be processed.

Processing performed by Budgethost AB on behalf of a customer is governed by the applicable Data Processing Agreement.

Further information is available at: https://budgethost.io/compliance/

Payments are processed by external payment providers. These providers may act as independent data controllers for payment information they receive.

Budgethost AB receives only the information needed to confirm and administer a payment, such as transaction identifiers, payment status, card type, masked details or a recurring-payment token.

Current payment providers include:

• Nets A/S.
• PensoPay.

Payment and fraud-prevention providers may analyze transaction and technical information to identify suspected fraud or misuse.

A transaction identified as potentially fraudulent may be delayed, rejected or referred for additional review. If a decision affects you, you may contact Budgethost AB to request information or human review.

Only retain the provider names and fraud wording if they remain current.

When you register, transfer or renew a domain, information required to complete the registration is shared with the relevant registrar, registry and technical service providers.

This may include Realtime Register B.V. and the registry responsible for the relevant top-level domain.

Registrars and registries may process some information as independent data controllers under their own legal obligations and policies.

Domain-registration information may be published through domain-registration lookup services where required by registry rules or applicable law. Where available, privacy or redaction services are applied according to the rules of the relevant registry.

budgethost.io and my.budgethost.io use cookies and similar browser technologies.

Necessary cookies are used for functions such as:

• Maintaining an authenticated portal session.
• Completing two-factor authentication.
• Remembering a trusted device when requested.
• Recording cookie-consent choices.

my.budgethost.io also uses local browser storage to remember selected customers and workspaces, recently opened workspaces and interface preferences.

budgethost.io uses Google Analytics after consent has been given for statistics cookies. Analytics information may include browser type, device type, pages visited, approximate location and a pseudonymous identifier.

Further details, including cookie names and retention periods, are available in our Cookie Policy: https://budgethost.io/cookie-policy/

We use your email address to send communications necessary to administer your account and services, including:

• Email-verification messages.
• Password-reset messages.
• Security notifications.
• Team and reseller invitations.
• Service-status and account communications.
• Billing, renewal and domain-expiration notices.
• Replies to support and Data Processing Agreement requests.

These communications are necessary for account security or service delivery and cannot always be disabled while the relevant account or service remains active.

We send newsletters and optional marketing communications only where we have an appropriate legal basis, including consent where required.

You may unsubscribe from marketing communications at any time using the link included in the message or by contacting us.

We share personal data only where necessary for the purposes described in this policy.

Recipients may include:

• Authorized Budgethost AB personnel and platform administrators.
• Authorized members of your customer organization.
• Authorized reseller personnel where a reseller manages your services.
• Payment and fraud-prevention providers.
• Domain registrars and registries.
• Analytics and cookie-consent providers.
• Communication and technical service providers.
• Professional advisers where necessary.
• Public authorities, courts or law-enforcement bodies where disclosure is legally required.
• A purchaser or successor if Budgethost AB undergoes a merger, acquisition or transfer of business, subject to appropriate safeguards.

Service providers acting on our behalf are permitted to process information only for the agreed purpose and must apply appropriate security and confidentiality measures.

We do not sell or rent personal data.

Budgethost AB’s primary hosting infrastructure is located in Sweden.

Some providers used for website analytics, payment processing, domain registration or other supporting functions may process information in another country.

When personal data is transferred outside the European Economic Area, we ensure that an appropriate transfer mechanism is available. This may include:

• An adequacy decision adopted by the European Commission.
• Approved Standard Contractual Clauses.
• Another transfer mechanism permitted by applicable data-protection law.
• Additional technical or organizational safeguards where required.

Information about providers involved in processing customer-hosted data is available on our compliance page: https://budgethost.io/compliance/

Budgethost AB applies technical and organizational measures appropriate to the nature of the processing and the risks involved.

These measures include, where applicable:

• Role-based access controls.
• Restricted administrative permissions.
• Secure password hashing.
• Two-factor authentication.
• Encryption of network communications using TLS.
• Logging of security-relevant and administrative activity.
• Service-health and security monitoring.
• Backup and recovery procedures.
• Controlled maintenance and software updates.
• Incident-identification and response procedures.

Two-factor authentication secrets and recovery codes stored by my.budgethost.io are encrypted.

No system can guarantee absolute security. We continuously review and adjust our safeguards as our services, systems and identified risks change.

Further information is available at: https://budgethost.io/compliance/

We retain personal data only for as long as necessary for the purposes described in this policy or as required by law.

The applicable retention period depends on the category and purpose of the information.

Account and organization information

Account profiles, organization memberships and workspace permissions are retained while the account or relevant relationship remains active. Some records may be retained afterwards for security, administration or legal
claims.

Sessions and authentication records

Sessions, verification records, password-reset records and invitations expire according to their security settings. Security records may be retained for a limited additional period where necessary to investigate misuse or
protect accounts.

Billing and transaction information

Invoices, transaction records and accounting information are retained for the period required by applicable accounting, tax and financial legislation.

Domain-registration information

Domain-registration records are retained while required to provide the domain service and thereafter where required by the registrar, registry, applicable law or legal-claims requirements.

Support and contractual records

Support communications, Data Processing Agreements and other contractual records are retained for the duration of the customer relationship and afterwards where necessary to document the relationship, comply with legal
obligations or defend legal claims.

Audit, security and operational information

Audit events, security logs, service-health information and operational statistics are retained for as long as necessary for security, troubleshooting, service administration and legal compliance.

Website analytics

Analytics identifiers and cookies are retained for the periods stated in our Cookie Policy.

Customer-hosted data

Customer-hosted data is retained according to the customer’s service configuration and Data Processing Agreement. Data may remain in backups until the applicable backup-retention schedule completes.

When information is no longer required, it is deleted, anonymized or otherwise removed from active use.

Depending on the circumstances and applicable law, you may have the right to:

• Receive information about how your personal data is processed.
• Request access to your personal data.
• Request correction of inaccurate or incomplete information.
• Request deletion of personal data.
• Request restriction of processing.
• Receive certain information in a portable format.
• Object to processing based on legitimate interests.
• Withdraw consent at any time.
• Object to direct marketing.
• Request human review of certain automated decisions.
• Lodge a complaint with a supervisory authority.

These rights are not absolute. In some cases, we may be required or permitted to retain information despite a request for deletion.

To exercise your rights, contact: info@budgethost.io

We may need to verify your identity before completing a request.

If Budgethost AB processes the relevant information solely on behalf of a hosting customer, you should normally submit your request to that customer as the data controller. Budgethost AB will assist the customer as required by the applicable Data Processing Agreement.

You have the right to lodge a complaint with the data-protection authority responsible for your location or with the Swedish Authority for Privacy Protection:

Integritetsskyddsmyndigheten (IMY)

Website: https://www.imy.se/

Budgethost AB may use automated security and fraud indicators to identify potentially unauthorized, abusive or fraudulent activity.

These indicators may cause an order, payment or account action to be delayed, blocked or referred for additional review.

If an automated assessment significantly affects you, you may contact us to request information, express your position and ask for human review.

Budgethost AB does not otherwise use solely automated decision-making that produces legal or similarly significant effects without providing the information and safeguards required by law.

Budgethost AB’s customer accounts and commercial services are not intended to be purchased directly by individuals under 18 years of age.

Customer-hosted services may contain information relating to children. In those circumstances, the hosting customer is responsible for establishing an appropriate legal basis and safeguards, while Budgethost AB normally acts as the data processor.

Budgethost AB’s customer accounts and commercial services are not intended to be purchased directly by individuals under 18 years of age.

Customer-hosted services may contain information relating to children. In those circumstances, the hosting customer is responsible for establishing an appropriate legal basis and safeguards, while Budgethost AB normally acts as the data processor.

Questions about this Privacy Policy, our use of personal data or your data-protection rights can be sent to:

Budgethost AB
Hulta 6525
SE-242 95 Hörby
Sweden

Email: info@budgethost.io

Website: https://budgethost.io