Privacy & Cookie Policy

This Privacy Policy complies with Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR), the Croatian Act on the Implementation of the General Data Protection Regulation (Zakon o provedbi Opće uredbe o zaštiti podataka), and the Croatian Electronic Communications Act (Zakon o elektroničkim komunikacijama — ZEK). All data is processed and stored exclusively within the European Union.

1. Data Controller vs. Data Processor Roles

1.1. WPinEU as Data Controller: WP in EU (www.wpineu.com, wpin.eu, wpat.eu, wp.wpineu.com), operated by administraktor.com in Zagreb, Republic of Croatia, acts as the Data Controller exclusively for the personal data of registered account holders collected during account creation, European Union residency verification, support communications, and platform security administration.

1.2. WPinEU as Data Processor (Hosted Content): With respect to all third-party personal data uploaded, stored, or processed by an account holder within the hosted cPanel environment—including website files, WordPress databases (MySQL), visitor logs, e-commerce records, and electronic mail accounts—the account holder acts as the Data Controller and WPinEU acts strictly as a Data Processor pursuant to GDPR Article 28. Such processing is governed exclusively by the WPinEU Data Processing Agreement (DPA).

2. Categories of Data Collected by WPinEU as Data Controller

2.1. Account & Eligibility Data: Full name, electronic mail address, and European Union residency verification data.

2.2. Technical & Security Data: Account holder IP address, browser type, device metadata, and cPanel/Client Area authentication logs, which are retained for a maximum of twelve (12) months.

2.3. Support & Communication Data: Support tickets and electronic mail correspondence, which are retained for three (3) years for support continuity and legal defense.

2.4. Hosted Website & Database Content (Processor Scope): Website files, MySQL database contents, and email accounts uploaded to the hosting server are governed by our Data Processing Agreement (/dpa) and are retained until deleted by the user or upon account deletion, subject to automated encrypted daily JetBackup overwrite cycles.

3. Legal Basis for Processing (GDPR Article 6)

3.1. Performance of a Contract (Art. 6(1)(b) GDPR): Processing account registration data and provisioning free cPanel, NVMe storage, MySQL, and electronic mail resources pursuant to the WPinEU Terms of Service.

3.2. Legitimate Interests (Art. 6(1)(f) GDPR): Verifying European Union residency eligibility, maintaining server and network security (including DDoS mitigation and ImunifyAV malware scanning), preventing abuse of free infrastructure, and sustaining the educational hosting initiative.

3.3. Compliance with Legal Obligations (Art. 6(1)(c) GDPR): Fulfilling statutory obligations under European Union and Croatian law, including responding to valid orders under the EU Digital Services Act (Regulation (EU) 2022/2065).

3.4. Consent (Art. 6(1)(a) GDPR): Where explicitly requested for optional communications or non-essential features, which the Data Subject may withdraw at any time.

4. How We Use Your Data

Your personal data is used strictly to:

• Provide, provision, and maintain free European cPanel and WordPress hosting services.
• Verify European Union residency eligibility.
• Communicate important service updates, security notices, and responses to support tickets.
• Ensure infrastructure security, mitigate DDoS attacks, and prevent abuse or unlawful activity.
• Comply with applicable European Union and Croatian legal obligations.

5. Data Storage and Security Measures (GDPR Article 32)

We implement strict technical and organizational security measures:

• 100% EU Data Sovereignty: All servers, NVMe RAID 10 storage arrays, and backup repositories are housed exclusively in European Union data centers.
• Encryption in Transit: Encrypted data transmission via SSL/TLS across all platform portals, cPanel dashboards, and hosted domains.
• Tenant Isolation: CloudLinux OS kernel-level account isolation (CageFS / LVE) separating each hosting account.
• Proactive Defense: Automated ImunifyAV malware scanning, regular security updates, access controls, and encrypted daily JetBackup snapshots.

6. Data Sharing and Recipients

We never sell, rent, or monetize your personal data. We share data only:

• With EU Infrastructure Sub-Processors: Trusted European Union data center colocation and network DDoS mitigation providers bound by GDPR Article 28 Data Processing Agreements (as listed in Annex III of our DPA at /dpa).
• For Legal Compliance: When required by binding European Union or Croatian law, court order, or valid regulatory request from competent authorities (such as AZOP or HAKOM).
• For Abuse & Fraud Prevention: To protect the security and integrity of our network infrastructure against unlawful attacks.
• With Explicit Consent: Where you have explicitly instructed or consented to a disclosure.

7. Data Retention Schedule

We retain personal data only as long as necessary for the purposes defined in this Policy:

• Account Profile Data: Retained for as long as your hosting account remains active.
• Hosted Website Content & Databases: Retained until deleted by the user or upon account deletion (residual copies in encrypted daily JetBackup archives are automatically overwritten during the standard backup rotation cycle).
• Server & Access Log Files: Retained for a maximum of twelve (12) months.
• Support & Communication Records: Retained for three (3) years for support continuity and dispute resolution.

8. Your Rights Under GDPR

Under Articles 15 to 22 of the GDPR, you have the right to:

• Access (Art. 15): Request confirmation and a copy of the personal data we hold about you.
• Rectification (Art. 16): Correct inaccurate or incomplete personal data directly in your Client Area or by contacting us.
• Erasure / "Right to be Forgotten" (Art. 17): Request permanent deletion of your account and personal data.
• Data Portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format (and export your hosted files/databases directly via cPanel).
• Restriction of Processing (Art. 18): Request temporary restriction of processing under statutory conditions.
• Objection (Art. 21): Object to processing based on legitimate interests (Art. 6(1)(f)).
• Withdraw Consent (Art. 7(3)): Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing.

9. Cookies and Electronic Communications (ZEK Compliance)

WPinEU uses only strictly necessary cookies for essential functionality, security, and session authentication, alongside anonymized, privacy-preserving analytics. We do not use cross-site tracking cookies or third-party advertising cookies.

10. International Data Transfers

Your data remains strictly within the European Union / European Economic Area (EU/EEA). We do not transfer personal data to third countries outside the EU/EEA.

11. Children's Privacy

Our services are not directed to children under the age of 16. We do not knowingly collect personal data from children under 16 without verified parental consent.

12. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect technical or regulatory changes. We will notify registered account holders of material changes via email or prominent notice in the Client Area.

13. Privacy Point of Contact and Supervisory Authority

13.1. Privacy Contact: For all data protection inquiries or to exercise your GDPR rights, please contact the WPinEU Data Protection & Privacy Coordinator at:

• Email: support@wpineu.com (or administraktor@protonmail.com)
• Location: 10000 Zagreb, Republic of Croatia

13.2. Right to Lodge a Complaint with a Supervisory Authority: Every Data Subject has the right to lodge a complaint with their local European Union data protection authority or with WPinEU's lead supervisory authority in the Republic of Croatia: