Privacy Policy

Privacy Policy

This policy explains what personal data SiteBunker processes, why, on what legal basis, how long we keep it and what rights you have. It follows Regulation (EU) 2016/679 (“GDPR”) and Romanian Law no. 190/2018.

Our principles

SiteBunker is a web services provider that receives and stores customers’ personal data in accordance with European Union law. We process data under the principles of Article 5 GDPR:

• lawfully, fairly and transparently;
• only for specified, legitimate purposes, with no further processing incompatible with them;
• adequately, relevantly and limited to what the purpose requires;
• accurately and kept up to date, with inaccurate data corrected or erased promptly;
• kept only as long as the purpose requires (exact periods are in section 3);
• confidentially and securely;
• without disclosure to third parties, except those needed to provide the services or required by law (section 6).

1. Who we are

The data controller is EXIM HOST S.R.L., operating the SiteBunker brand (sitebunker.net, sitebunker.ro, client.sitebunker.net).

• Registered office: Str. Frunzei nr. 109, bl. 9G, sc. 4, et. 1, ap. 64, camera 1, Galați, Romania
• VAT/Tax ID: RO40672655
• Trade Register no.: J17/481/2019 (EUID: ROONRC.J17/481/2019)
• Privacy contact: contact@sitebunker.ro
• Phone: +40 377 101 459 (Mon–Fri, 09:00–17:00 EET)

2. Scope

This policy covers visitors to our websites, customers and prospective customers, contact persons of business customers, and affiliate partners.It does not cover data that customers store on our hosting services (websites, databases, mailboxes). For that data the customer is the controller and we act as processor, under our Data Processing Agreement (DPA).

3. What we process, why and for how long

Access logs that a customer chooses to archive in their own hosting account (via cPanel › Raw Access) are managed by that customer, as controller.When these periods end, data is deleted or anonymised. Backup copies are overwritten automatically within 7 days at most.

4. Where we get data from

Most data comes directly from you, through forms, your client account or support. Technical logs are generated automatically by our servers. Some data may come from domain registries, payment processors or affiliate partners.

5. Is providing data mandatory?

Data needed for the contract, invoicing and domain registration is mandatory; without it we cannot provide the service. Newsletter and analytics data is optional.

6. Who we share data with

Providers processing data on our behalf are bound by contracts compliant with Article 28 GDPR. We do not sell personal data.

7. Transfers outside the European Economic Area

Some recipients (Google, Stripe, PayPal, eNom, cPanel, CloudLinux) may process data in the United States. These transfers rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework, for certified companies, or on Standard Contractual Clauses. You may request a copy of the applicable safeguards at contact@sitebunker.ro.

8. Automated decisions

We do not make decisions based solely on automated processing that produce legal effects for you. Automated anti-abuse and anti-malware systems may temporarily block suspicious access; you can always ask for a human review.

9. How we protect data

We use encrypted connections (HTTPS/TLS), firewalls, DDoS protection, security monitoring, malware scanning, strict staff access control and backups. Our servers are hosted in a Tier III data centre in Romania. Staff with access to data are bound by confidentiality obligations.

10. Your rights

You have the right to:

• access your data and obtain a copy;
• rectify inaccurate data;
• erasure, where data is no longer needed or processed unlawfully;
• restrict processing;
• data portability for data you provided, in a structured format;
• object to processing based on legitimate interest and, at any time, to direct marketing;
• withdraw consent, without affecting earlier lawful processing.

Send your request to contact@sitebunker.ro. You can also ask us there whether we have processed your data at a third party’s request. We reply within one month, extendable by two months for complex requests. We may ask you to confirm your identity, usually via the e-mail linked to your account.You may lodge a complaint with the Romanian supervisory authority, ANSPDCP, B-dul G-ral Gheorghe Magheru 28–30, Sector 1, Bucharest, www.dataprotection.ro, anspdcp@dataprotection.ro, or with the supervisory authority in your EU country of residence.

11. Children

Our services are intended for persons aged 18 or over. We do not knowingly collect data from minors.

12. Cookies

Details on cookies and how to manage your choices are in our Cookie Policy.

13. Changes

We may update this policy. The current version is published on this page with its last-updated date. Material changes are notified to customers by e-mail.

Cookie Policy

We use strictly necessary cookies without consent and analytics cookies only after you accept them. The legal basis is Article 4(5) of Romanian Law 506/2004 (implementing the ePrivacy Directive) and the GDPR. The controller is EXIM HOST S.R.L., VAT ID RO40672655.

What cookies are

Cookies are small text files saved by your browser on your device. They let the website work properly, remember your preferences and show us, in aggregate, how it is used.

Cookies we use

If we enable other tools (for example marketing pixels), we add them to this table before they go live.

Consent

On your first visit we show a banner where you can accept, reject or choose cookie categories. Rejecting is as easy as accepting. Analytics cookies are not loaded until you accept them. You can change your choice at any time via the “Cookie settings” link in the page footer.

Google Analytics

We use Google Analytics 4 (a service provided by Google) with Google Consent Mode. Without consent, no analytics cookies are set. Analytics data is kept for 14 months. It may be transferred to the US as described in section 7 of our Privacy Policy. Details: Google’s privacy policy.

Managing cookies in your browser

You can delete or block cookies in your browser settings. Blocking strictly necessary cookies may prevent logging in to your client account or placing orders.

Contact

For questions about cookies, write to contact@sitebunker.ro.

Data Processing Agreement (DPA)

This agreement sets out the terms required by Article 28 GDPR under which EXIM HOST S.R.L. (Str. Frunzei nr. 109, bl. 9G, sc. 4, et. 1, ap. 64, camera 1, Galați, Romania; VAT ID RO40672655; Trade Register no. J17/481/2019), “SiteBunker”, as processor, processes personal data on behalf of the customer (“Customer”), as controller. It forms an integral part of the Service Agreement (Terms and Conditions) and applies automatically to every customer who stores personal data on SiteBunker services.

1. Subject matter and duration

1.1. SiteBunker processes the personal data that the Customer uploads or generates through web hosting, reseller, VPS, dedicated server and e-mail services (“Customer Data”).1.2. This agreement applies for the term of the contract and until Customer Data is deleted under section 9.1.3. Data that SiteBunker processes for its own purposes (client account, invoicing, infrastructure security logs) is outside this agreement. For that data SiteBunker is controller, as described in the Privacy Policy.

2. Nature and purpose of processing

For unmanaged VPS and dedicated servers, SiteBunker does not access server contents and provides only the physical and network infrastructure.

3. Customer instructions

3.1. SiteBunker processes Customer Data only on the Customer’s documented instructions. The contract, this agreement and the settings the Customer makes in the control panels (cPanel, client area) are the complete instructions.3.2. If SiteBunker believes an instruction infringes data protection law, it informs the Customer immediately.3.3. SiteBunker may process data without instructions only where the law requires it. In that case it informs the Customer beforehand, unless the law prohibits doing so.

4. Confidentiality

SiteBunker staff access Customer Data only when necessary for service delivery, support or security. All authorised persons are bound by contractual or statutory confidentiality obligations.

5. Security

SiteBunker applies the technical and organisational measures in Annex B, appropriate to the risk, under Article 32 GDPR. Measures may be updated provided the overall level of protection is not reduced.The Customer is responsible for the security of its own content: application updates, passwords, configuration and its own backups, as set out in the Terms and Conditions.

6. Sub-processors

6.1. The Customer gives general authorisation for the sub-processors listed in Annex A.6.2. SiteBunker notifies the Customer by e-mail of any new or replacement sub-processor at least 30 days in advance. The Customer may object on reasonable grounds within that period. If no solution is found, the Customer may terminate the affected services without penalty and receive a refund of prepaid fees for the unused period.6.3. SiteBunker imposes data protection obligations on sub-processors equivalent to those in this agreement and remains liable to the Customer for their acts.

7. Assistance to the Customer

7.1. Data subject rights. Most requests can be handled by the Customer directly in cPanel. If SiteBunker receives a request addressed to the Customer, it forwards it without delay and does not respond on the Customer’s behalf, unless required by law.7.2. Impact assessments and consultations. SiteBunker provides reasonable information needed for data protection impact assessments (Art. 35) and prior consultations with the supervisory authority (Art. 36).7.3. Assistance beyond standard information may be charged at the current technical support rates.

8. Personal data breaches

8.1. SiteBunker notifies the Customer without undue delay and within 48 hours at most of becoming aware of a breach affecting Customer Data.8.2. The notification includes, as far as available: the nature of the breach, the categories and approximate number of data subjects and records affected, likely consequences, measures taken or proposed, and a contact point. Missing information is provided as it becomes available.8.3. Notification is not an admission of fault. Notifying the supervisory authority and data subjects remains the Customer’s obligation as controller.

9. Deletion and return of data

9.1. The Customer can download its data at any time, including a full account archive generated in cPanel.9.2. After the service ends, or 30 days after an unpaid due date, Customer Data is deleted from production servers, as set out in the Terms and Conditions.9.3. Maximum retention after deletion or during normal operation: Log archives that the Customer chooses to keep in its own cPanel account remain under the Customer’s control.9.4. SiteBunker may retain data longer only where the law requires it, isolating it from any further processing.

10. Audits

10.1. On the Customer’s written request, no more than once a year, SiteBunker provides the information needed to demonstrate compliance with this agreement, including answers to reasonable security questionnaires.10.2. If that information is insufficient or the supervisory authority requires it, the Customer may carry out an audit, directly or through an independent auditor bound by confidentiality. Audits require at least 30 days’ notice, take place during business hours, must not affect other customers and are at the Customer’s expense.

11. International transfers

Customer Data is stored in Romania. A transfer outside the EEA may occur only occasionally, when a support sub-processor listed in Annex A accesses a server to resolve a ticket, and only with appropriate safeguards under Chapter V GDPR: an adequacy decision (including the EU–US Data Privacy Framework) or Standard Contractual Clauses.

12. Final provisions

12.1. In case of conflict, this agreement prevails over the Terms and Conditions on data protection matters.12.2. Liability is as set out in the Terms and Conditions, without limiting data subjects’ rights under the GDPR.12.3. This agreement is governed by Romanian law. Disputes are resolved as set out in the Terms and Conditions.

Annex A – Sub-processors

Domain registries and payment processors are not sub-processors for Customer Data; they receive data from SiteBunker acting as controller.

Annex B – Technical and organisational measures

• Access control: administrative access for authorised staff only, two-factor authentication for admin panels, least privilege, periodic access reviews.
• Network security: perimeter firewall, DDoS protection through continuous traffic analysis (Voxility, Arbor), brute-force protection for logins (cPHulk).
• Customer isolation: hosting accounts isolated with CloudLinux (CageFS, LVE); dangerous PHP functions disabled.
• Encryption: TLS for control panels, e-mail and websites; SSL certificates available for all hosted domains.
• Malware protection: continuous account scanning and automatic quarantine, with deletion after 30 days.
• Backups: server RAID, daily off-site backups with up to 7 days’ retention, disaster recovery copies kept for 7 days.
• Updates: operating system, cPanel and services regularly updated to stable releases.
• Monitoring and logs: continuous server monitoring; access and security logs kept for 30 days and deleted automatically.
• Physical security: Tier III data centre with controlled access, dual power feeds (UPS and generator) per rack, N+1 redundant cooling, three internet uplinks from different carriers.
• Organisational: staff confidentiality obligations, incident management procedure, secure wiping of decommissioned storage media.