Who are we?
xYnta Hosting B.V. is a Dutch hosting provider, registered at Kapitein Luidingaflat 26, 3333 CM Zwijndrecht, the Netherlands. We are registered with the Dutch Chamber of Commerce under number 64691675.
xYnta Hosting B.V. is the data controller as defined under the General Data Protection Regulation (GDPR) for the processing of personal data described in this privacy policy. We have not appointed a Data Protection Officer (DPO). For questions about privacy and data protection, please contact us at info@xynta.nl.
We take your privacy seriously. We only process personal data that is necessary for providing our services, and we handle it with care. This privacy policy explains which data we process, why we process it, the legal basis for doing so, how long we retain it and what rights you have.
Legal bases for processing
We only process your personal data on the basis of one or more of the following legal grounds under the GDPR:
- Performance of a contract — processing is necessary to deliver the service or product you have ordered.
- Legal obligation — we are required by law to retain certain data, for example under statutory accounting and tax retention requirements.
- Legitimate interest — processing is necessary for a legitimate interest of ours or a third party, provided your interests do not override ours. This applies for example to preventing fraud and misuse.
- Consent — you have explicitly given consent for a specific processing activity, such as receiving our newsletter. You may withdraw this consent at any time.
For each processing purpose below, we indicate the applicable legal basis.
What data do we process and why?
Order processing and service delivery
When you place an order with us, we process your personal data to correctly fulfil the order and deliver the service. This includes the following data:
- First and last name
- Address details
- Email address
- Phone number
- Billing address (if different from address on file)
- IP address (at the time of ordering)
- Payment details — depending on the payment method you choose (see also the Payment Processing section)
Legal basis: performance of a contract and legal obligation (statutory tax retention requirement).
Retention period: we retain order and invoice data for seven years following the end of the financial year in which the transaction took place, as required by Dutch tax law.
Client account and client portal
To use our client portal (My xYnta), you need a client account. When you register, we process the following data:
- First and last name
- Email address
- Phone number
- Address details
- IP address (at registration and on each login)
Through the client portal you can manage your details, view and modify services, cancel subscriptions, submit support requests and place orders. We log the actions you perform in the portal so that we can demonstrate what occurred in the event of a dispute.
Our client portal uses functional cookies and session data that are strictly necessary for the correct operation of the portal, the shopping basket and the login process. This data is not shared with third parties and is used solely for this purpose. Please also refer to our cookie policy.
Legal basis: performance of a contract and legitimate interest.
Retention period: we retain your account data until six months after all your active subscriptions have ended. If you have created an account but have not ordered any service, we will automatically delete your account and associated data six months after the account creation date. You may also request deletion at any earlier point.
Contact forms and other forms
Our website contains several forms, including a contact form and request forms for specific services. Data you submit via a form is used solely for handling your enquiry or request. This typically includes your name, email address and the content of your message.
We also store your IP address when a form is submitted, in order to prevent misuse and spam.
Legal basis: legitimate interest (fraud and misuse prevention, and handling your request effectively).
Retention period: we retain this data for six months after your enquiry or request has been handled.
Newsletter
With your explicit consent, you may subscribe to our newsletter via the client portal. In it we share news, tips and updates about our services. The newsletter is sent exclusively through our own systems — we do not use any external email marketing services.
Every newsletter contains an unsubscribe link. You can also unsubscribe directly through the client portal. Upon unsubscribing, we remove your email address from the mailing list immediately.
Legal basis: consent. You may withdraw your consent at any time without giving a reason.
Retention period: your email address remains on the mailing list until you unsubscribe or withdraw your consent.
Payment processing
We use Mollie B.V. as our exclusive payment service provider. Through Mollie we offer a range of payment methods, including iDEAL, credit card, PayPal, SEPA bank transfer and SEPA direct debit.
Payment details you enter are processed directly by Mollie and are therefore subject to Mollie's own privacy policy. We only receive a payment confirmation and a transaction reference from Mollie. We do not store full payment card details in our own systems.
When you pay via PayPal, the email address associated with your PayPal account is visible to us as confirmation of the payer. For more information about how Mollie and PayPal process your data, please refer to their respective privacy policies.
When you pay via direct debit, we process your IBAN and account holder name. This information is used solely for the direct debit mandate and is retained for as long as the mandate remains active.
Cookies and web analytics
Functional cookies
Our website and client portal use functional cookies. These are strictly necessary for the correct operation of the website, including session management, your shopping basket and staying logged in to the portal. Functional cookies are not used for tracking or marketing purposes and do not require consent. They are typically tied to your browser session and are not shared with third parties.
Web analytics — Matomo
We use Matomo, an open-source web analytics platform that we self-host on our own servers in the Netherlands. Matomo records anonymised visitor data such as pages visited, browser and device type and the origin of your visit. Your IP address is anonymised before being stored — we never retain a full IP address.
Because Matomo runs entirely on our own infrastructure, no data is sent to third parties, and all IP addresses are fully anonymised before storage, the privacy impact is minimal. We have a legitimate interest in understanding how our website is used so we can improve our services. In our assessment, this interest does not override your privacy interests, in part due to the extent of anonymisation applied. You can nevertheless disable analytical cookies at any time via our cookie consent banner.
Chat — Crisp
Our website includes a live chat widget through which you can contact us directly. This widget is provided by Crisp IM SAS, based in Rouen, France. Crisp guarantees that all data is stored and processed within the European Union. Crisp is a processor engaged by us, and we have entered into a data processing agreement with them.
When you use the chat widget, your messages and the IP address associated with your session are processed by Crisp. If you provide your name or email address in the chat, that information is stored as well. The chat widget can be disabled at any time via our cookie consent banner. If you disable the chat cookies, you will see a message indicating that the chat is unavailable due to your cookie preferences.
Legal basis: consent (via the cookie consent banner).
No tracking cookies or social media tracking buttons
We do not use tracking cookies or advertising cookies. Our website includes links to our social media channels, but these are standard HTML links without embedded tracking code or social media widgets. No data is collected by social media platforms through these links.
Form security — hCaptcha
To protect our forms against spam and automated misuse, we use hCaptcha, a service provided by Intuition Machines, Inc., based in the United States. When you use a form on our website, hCaptcha may process additional data — including your IP address and interaction data such as mouse movements — to determine whether the user is a real person. This data is processed by hCaptcha in accordance with their own privacy policy and terms of service, and may be transferred to the United States.
By using a form on our website, you consent to this processing by hCaptcha. Each form on our website includes the following notice:
This form is protected by hCaptcha. By using this form you agree to the privacy policy and terms of service of hCaptcha.
Legal basis: consent (via the notice displayed on each form). For more information, please refer to hCaptcha's privacy policy.
Security of personal data
We take the security of your data seriously and implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or misuse. Our measures include, among others:
- Access to personal data is protected by unique usernames, strong passwords and additional verification.
- Staff can only access systems containing personal data from pre-approved IP addresses.
- All communication between your browser and our website and client portal is encrypted via SSL/TLS.
- Access to personal data is logged in detailed audit logs that are regularly reviewed.
- We implement additional technical and organisational measures that we do not disclose for security reasons.
In the event of a data breach that poses a risk to your rights and freedoms, we are legally required to notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and, where applicable, to notify you personally. We actively monitor our systems to detect such incidents in a timely manner.
Disclosure to third parties
We only share your personal data with third parties where necessary for the delivery of our services or where we are legally required to do so. We never sell your data to third parties.
We enter into data processing agreements with all parties that process personal data on our behalf, in order to ensure an appropriate level of protection. Relevant processors include:
- Mollie B.V. — payment processing
- Crisp IM SAS — chat service (data remains within the EU)
- Intuition Machines, Inc. (hCaptcha) — form security
In incidental cases it may be necessary to share your data with direct suppliers or other parties involved in delivering a specific service. We do so only to the extent necessary and under equivalent confidentiality obligations.
All processors we engage process personal data within the European Economic Area (EEA), or provide safeguards that guarantee an equivalent level of protection.
Minors
Our services are not directed at persons under the age of 18. We do not ask for a date of birth at registration and are not able to actively verify the age of users. By creating an account, we assume the user is of legal age or is acting with the permission of a parent or legal guardian.
If you believe a minor has created an account without permission, please contact us at info@xynta.nl. We will delete the account and associated data as soon as possible.
Your rights under the GDPR
Under the GDPR, you have the following rights with regard to the processing of your personal data:
- Right of access — you may request to know which personal data we hold about you.
- Right to rectification — you may request correction of inaccurate or incomplete data.
- Right to erasure — you may request deletion of your data, unless we are required to retain it under a legal obligation.
- Right to restriction of processing — in certain circumstances you may request that we temporarily restrict the processing of your data.
- Right to data portability — you may request your data in a structured, commonly used and machine-readable format.
- Right to object — you may object to processing activities based on legitimate interest.
- Right to withdraw consent — where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
To submit a request, please contact us at info@xynta.nl. To ensure we do not modify or delete data belonging to the wrong person, we will ask you to verify your identity. You can do so by emailing us from the address we have on file, by including your support code, or by submitting a request via a ticket in our client portal.
We aim to respond to your request within four weeks. For complex or multiple requests, this period may be extended by up to two months — we will inform you in a timely manner if this is the case.
Filing a complaint
If you believe we are not handling your personal data correctly, we ask that you first contact us so that we can work towards a solution together. If we are unable to resolve the matter, you have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), the supervisory authority in the Netherlands. More information about filing a complaint is available at autoriteitpersoonsgegevens.nl.
Changes to this privacy policy
We may update this privacy policy from time to time, for example due to changes in our services, applicable legislation or the technical means we use. The most current version is always available on our website. We include the date of the most recent update with each new version.
For material changes that significantly affect the way in which we process your data, we will notify you by email or via a notification in the client portal.
Contact details
For questions about this privacy policy or the processing of your personal data, please contact us:
- xYnta Hosting B.V.
- Kapitein Luidingaflat 26
- 3333 CM Zwijndrecht
- The Netherlands
- Email: info@xynta.nl
- Phone: +31 85 400 6666
- Chamber of Commerce: 64691675