Privacy Policy

Company name

HG-HOSTING

Legal form

SAS (simplified joint-stock company)

Date of incorporation

9 September 2025

Main activity (NAF/APE)

63.11Z - Data processing, hosting and related activities

Registered office

2 ALLEE DU VERGER 44170 NOZAY

SIREN

991 163 932

Head office SIRET

991 163 932 00015

Registration

RCS Nantes 991 163 932 (registered with the RNE/INPI on 11/09/2025)

VAT

Subject to VAT - EU VAT number FR70 991 163 932

Number of employees

Non-employer unit (no employee during the reference year and no headcount as of 31/12)

Share capital

€100

Collective agreement

Not specified

Email

contact@hg-hosting.fr

Updated on 16/08/2026 - Sources: INSEE, INPI

The controller of the personal data collected in connection with the « hg-hosting.fr » website, the client area and the hosting services is HG-HOSTING, 2 Allée du Verger, 44170 Nozay, France, registered under SIRET number 991 163 932 00015 (hereinafter « HG-Hosting » or « we »).

For any question relating to this policy or to the exercise of your rights, you may contact: contact@hg-hosting.fr. HG-Hosting has not appointed a data protection officer (DPO), as such an appointment is not mandatory under article 37 of the GDPR given the nature and scope of its processing. A dedicated contact point for data protection matters is nevertheless available to you: privacy@hg-hosting.fr.

This privacy policy describes how HG-Hosting processes personal data in the context of its web hosting activities, the provision of game servers, VPS/VDS, dedicated servers and related services, in accordance with Regulation (EU) 2016/679 (GDPR) and the amended French Data Protection Act.

HG-Hosting applies the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability (art. 5 of the GDPR).

As part of its accountability, HG-Hosting maintains a record of its processing activities in accordance with article 30 of the GDPR where this obligation applies to it, and makes it available to the CNIL on request.

3.1 - Identification and account data

Last name, first name or company name, postal address, e-mail address, telephone number where applicable, customer ID, hashed password, communication preferences, language, time zone.

3.2 - Billing and payment data

Billing address, order history, transaction references, the last four digits of the card where applicable. Full banking data is processed by our certified payment providers; HG-Hosting does not retain the card security code.

3.3 - Technical and connection data

IP addresses, server logs (HTTP/S, FTP, SSH, game console access), timestamps, browser types, pages viewed on the showcase site, session identifiers, security logs (authentication attempts, firewall, anti-DDoS), performance metrics.

3.4 - Data relating to hosted services

The files, databases, configurations and content that you place on the infrastructure are processed as data hosted on your behalf. Where applicable, you remain the controller of the personal data of your own end users (customers, players, site visitors). HG-Hosting then acts as a processor on documented instructions, where contractually agreed.

3.5 - Communications with support

Content of tickets, e-mails, calls recorded only if you have been informed and have consented where applicable, attachments provided to resolve an incident.

3.6 - Cookies and trackers (showcase site)

The site places cookies strictly necessary for its operation, which are exempt from consent, as well as cookies and trackers subject to consent: audience measurement and usage analytics (Contentsquare, PostHog, Umami) and a customer-review widget (Trustpilot). In accordance with article 82 of the French Data Protection Act and the CNIL guidelines, these non-essential trackers are only placed after your consent has been collected via the cookie management banner; you can change or withdraw your choices at any time, refusing being as simple as accepting and without consequence for access to the site. A separate option within the same banner controls Umami session replay: clicks and scrolling, with text and inputs masked, up to five minutes and thirty days of active retention on our infrastructure. You can disable it in the cookie preferences. The contact form sends your optional name, email address and message to our team by email to answer your request. It uses Cloudflare Turnstile for spam protection.

3.7 - Mandatory or optional nature of the data

Whether each item of data is mandatory or optional is indicated at the time of collection, in particular by an asterisk on the forms. The data necessary for the conclusion and performance of the contract, for billing and for compliance with our legal obligations is mandatory: if you do not provide it, HG-Hosting will be unable to create your account, provide the service ordered or issue your invoices. The other data is optional and its absence has no consequence for the provision of the service. This information is provided pursuant to article 13(2)(e) of the GDPR.

Processing is based on the following legal bases:

• Performance of the contract (art. 6(1)(b) GDPR): creation and management of the account, provision of the services, billing, technical support, securing access, service notifications.
• Legal obligation (art. 6(1)(c) GDPR): retention of invoices and accounting records, response to judicial requisitions, fight against tax fraud where applicable.
• Legitimate interest (art. 6(1)(f) GDPR): improvement of services, aggregated statistics, network security, abuse prevention, proportionate B2B prospecting respecting rights and freedoms, customer testimonials with a right to object.
• Consent (art. 6(1)(a) GDPR): newsletters, waiting lists, non-essential cookies, certain marketing options. In accordance with article 7(3) of the GDPR, you may withdraw your consent at any time, as easily as you gave it (for example via the unsubscribe link or the cookie banner); this withdrawal does not affect the lawfulness of consent-based processing carried out before it.

Electronic direct marketing. In accordance with article L34-5 of the French Post and Electronic Communications Code, direct marketing by email to a natural person is subject to their prior consent, except where it concerns products or services similar to those they have already purchased from HG-Hosting. Marketing to professionals is permitted for products or services related to their business activity. In all cases, every electronic message includes a simple, free means of objecting to any further solicitation, and you may withdraw your consent or exercise your right to object at any time.

Data is accessible to authorised HG-Hosting staff (support, billing, technical) on a need-to-know basis. It may be disclosed to processors and providers acting on behalf of HG-Hosting, in particular: physical hosting (datacenter located in France, in Nozay); the DDoS mitigation provider (Netrix, France); the payment provider handling transactions; the transactional e-mail sending service; Discord where support or the community is provided through that platform (your exchanges then transit through it); the network protection, CDN and CAPTCHA provider (Cloudflare, including Turnstile and the web application firewall); the audience-measurement and usage-analytics tools subject to your consent (Contentsquare, PostHog, Umami); the customer-review widget (Trustpilot); as well as domain name registries when you order a domain. Each of these processors acts only on documented instructions from HG-Hosting, under a processing agreement compliant with article 28 of the GDPR.

An up-to-date list of the main processors, specifying the destination countries and the applicable safeguards, may be provided to you on request at the contact address given in article 1. Some providers (in particular Cloudflare) may process data outside the European Union, in particular in the United States. Where they occur, such transfers are governed by the safeguards provided for in articles 44 to 49 of the GDPR: European Commission adequacy decision (for example the EU - US Data Privacy Framework for certified organisations), European Commission standard contractual clauses, binding corporate rules (BCR) or, failing that, one of the derogations provided for in article 49 of the GDPR.

Public authorities may access certain data under the conditions provided for by law (judicial requisition, reasoned administrative requisition).

• Active account data: for the entire duration of the contractual relationship.
• Billing data: ten (10) years from the close of the relevant financial year, in accordance with French accounting obligations, unless a longer limitation period or specific obligation applies.
• Technical and security logs: the period necessary for incident detection and legal obligations, generally between three (3) and twelve (12) months depending on the nature of the logs, except for secure retention as evidence in the event of a dispute.
• Non-customer prospects: three (3) years from the last contact from the person.
• Cookies and trackers: according to their respective lifetime (detailed in article 3.6 and managed via the consent banner). In accordance with the CNIL guidelines, the lifetime of audience-measurement trackers does not exceed thirteen (13) months and the information collected through them is not kept beyond twenty-five (25) months.

At the end of the periods, data is deleted or irreversibly anonymised when its retention is no longer necessary.

In accordance with the GDPR and the French Data Protection Act, you have the following rights, subject to legal conditions and exceptions:

• Right of access: obtain confirmation that processing exists and receive a copy of it.
• Right to rectification: have inaccurate or incomplete data corrected.
• Right to erasure (« right to be forgotten »): in the cases provided for in article 17 of the GDPR.
• Right to restriction of processing: in the cases provided for in article 18 of the GDPR.
• Right to object: in particular to prospecting and, on grounds relating to your particular situation, where processing is based on legitimate interest.
• Right to data portability: for data provided by you and processed by automated means on the basis of the contract or consent, where technically possible.
• Post-mortem directives (French law): the option to indicate what happens to your data after death.

You can exercise your rights at: contact@hg-hosting.fr, enclosing a copy of proof of identity where necessary to prevent fraud. A reply will be sent within one (1) month, extendable by two (2) months given the complexity or number of requests.

You have the right to lodge a complaint with the CNIL (www.cnil.fr).

In accordance with article 32 of the GDPR, HG-Hosting implements technical and organisational measures appropriate to the risk: environment segregation, access control, encryption of communications (TLS), backups depending on the plan, logging, security monitoring, password policy, staff awareness, incident management. As no measure is infallible, the Customer is also required to secure its applications and administrator accounts.

In the event of a personal data breach, HG-Hosting documents the incident. Where the breach is likely to result in a risk to the rights and freedoms of natural persons, HG-Hosting notifies the CNIL without undue delay and, where feasible, no later than seventy-two (72) hours after becoming aware of it, in accordance with article 33 of the GDPR. Where the breach is likely to result in a high risk to the rights and freedoms of the persons concerned, they are informed without undue delay and receive the relevant recommendations, in accordance with article 34 of the GDPR.

HG-Hosting services are not aimed at minors under the age of fifteen (15) for the direct collection of personal data without the consent of the holder of parental authority where the law requires it. The business Customer who processes data of minor end users remains responsible for compliance with the applicable legal framework.

HG-Hosting does not make decisions producing legal effects concerning you or significantly affecting you based solely on automated processing, including profiling, unless explicitly and separately stated otherwise with the possibility of human intervention.

Where, through our services, you host personal data concerning your own end users (customers, players, visitors), you are the controller of that data and HG-Hosting acts as a processor within the meaning of article 28 of the GDPR. As such, HG-Hosting: processes that data only on documented instructions from the Customer; ensures that persons authorised to process it are bound by confidentiality; implements the security measures provided for in article 32 of the GDPR; does not engage any sub-processor without prior information to the Customer and without imposing the same obligations on it; assists the Customer, as far as possible, in responding to requests to exercise data subjects' rights and in fulfilling its own security, breach-notification and impact-assessment obligations; and, at the Customer's choice, deletes or returns the data at the end of the service. A data processing agreement (DPA) is made available or concluded at the request of the business Customer.

In its capacity as a host within the meaning of article 6 of French Law No. 2004-575 of 21 June 2004 on confidence in the digital economy (LCEN) and of Regulation (EU) 2022/2065 on digital services (DSA), HG-Hosting operates a mechanism for reporting unlawful content (see the Report an abuse page) and cooperates with legally authorised authorities. The processing carried out for these purposes - receipt and handling of reports, retention and disclosure of connection data, response to judicial or administrative requisitions - is based on compliance with legal obligations (art. 6(1)(c) of the GDPR) and on the legitimate interest in ensuring network security (art. 6(1)(f) of the GDPR). Log retention periods are set out in article 6 of this policy and in the Terms of Use.

This policy may be updated to reflect legal, technical or organisational developments. The update date appears at the top of the page. For substantial changes, a notification may be sent by e-mail or banner in the client area.