Privacy Policy

1. At a glance

• We do not sell your personal data; we only share it with providers necessary for the operation of the service (payment, infrastructure) or where the law requires it.
• We use no advertising trackers, no marketing cookies and no audience measurement on useed.fr.
• Your data is hosted within the European Union (data centres in France and the Netherlands).
• Your content is not our data: we do not read, index or analyse the files you store on your hosting space.
• We only keep the strictly necessary data: invoices 10 years (accounting obligation), account holder identity 5 years after the end of the contract, connection data 1 year (legal obligations of hosts); everything else is deleted as soon as possible.
• You have rights (access, rectification, erasure, portability, objection) and the right to lodge a complaint with the CNIL.
• Your email address only receives service-related messages; no newsletter is sent.

2. Data we process: purposes, legal bases, retention periods, recipients

We make no automated decision concerning you and carry out no profiling (Art. 22 GDPR).

3. Data on your hosting space – our role as processor

The files and applications you store on your hosting space remain your property and your responsibility.

Strictly personal use (your own files, your family) falls within the household exemption (Art. 2(2)(c) GDPR): no particular GDPR obligation then applies to you.

If you process personal data (public website, customer-facing service, third-party data), you act as data controller and Rock-Hosting acts as processor (Art. 28 GDPR): we process such content only on your documented instructions, for the sole purpose of technical hosting. The conditions are set out in the “Personal data processing” appendix to our general terms, applicable to all customers.

We do not read, index or analyse your content; we only access it (a) at your express request in the course of support, (b) for an overriding technical necessity of security or maintenance, or (c) to comply with a legal obligation or a request. The confidentiality of private correspondence is respected; no general monitoring is implemented.

At the end of the contract, your content is deleted as soon as the service effectively ends, then purged from backups within a maximum of 30 days, unless a contrary legal retention obligation applies. Back up your data before the end of your paid period.

In the event of a data breach affecting hosted content, we inform you without undue delay as processor and assist you with your obligations.

4. Logging and statutory retention periods

For operational, security and legal reasons, we record: account and service connection logs (source IP address, port, session identifier, date and time), technical infrastructure logs required for supervision, and the subscription and payment data linked to your account.

Civil identity of the account holder (surname, first name, date of birth, addresses, emails, phone numbers)

5 years after the end of the contract (L34-1 CPCE + Decree No. 2021-1362)

Subscription and payment information

1 year after the end of the contract or account closure (Decree No. 2021-1362)

Technical connection data (IP, port, identifier, timestamp)

1 year from the connection (L34-1 CPCE + Decree No. 2021-1362)

Invoices and accounting documents

10 years (L123-22 of the French Commercial Code)

Support tickets

1 year after closure (internal policy)

Other account data

2 years after closure (internal policy)

These statutory periods prevail over your right to erasure (Art. 17(3)(b) GDPR): if you ask for deletion of your data, we immediately erase everything that can be erased; the data above is retained until the statutory deadline and then destroyed, never reused.

Access to these logs is restricted to authorised Rock-Hosting personnel; no use for profiling, marketing or monitoring of your usage. Failure to retain is a criminal offence (Art. 6-V LCEN): the law requires us to keep this data and forbids us from doing anything else with it.

5. Recipients and sub-processors

Your data is never sold or rented. It is only shared with the following recipients:

Stripe

Bank card payments

PayPal

PayPal payments

Competent authorities

Only upon lawful request

The useed.fr website is hosted by the publisher itself (Rock-Hosting). Each sub-processor processes data only on our documented instructions; any use of a new sub-processor will be notified to you (Art. 28(2) GDPR).

6. Transfers outside the European Union

Your data and content are hosted exclusively within the European Union (France, Netherlands). No transfer of hosted content outside the EU is made without your prior information. If an internal tool involved a transfer outside the EU, it would only be made on the basis of a GDPR-compliant mechanism (adequacy decision or standard contractual clauses of Decision (EU) 2021/914).

7. Cookies and trackers

No advertising tracker, marketing cookie, audience measurement or social button is used: no consent banner is required. Only the following strictly necessary cookies are set (Art. 82 of the French Data Protection Act), together with local storage of your display preferences:

Session (PHPSESSID)

Maintains your session (website/console) – session duration

Referral

Stores the referral identifier for 24 hours

Interface preferences (local storage)

Dark/light theme and console display preferences – stored locally in your browser, without transmission to our servers

You can delete or block these cookies via your browser (blocking session cookies may prevent login to your account).

Should this choice change (addition of an audience measurement or advertising tool), a compliant consent banner would be installed and this section updated with the list of trackers, their purposes and durations.

8. Content reports and requests from authorities

You may report illegal or abusive content hosted by the service to abuse@useed.fr or via the reporting form. The data provided when reporting (name, email, IP, description) is processed to handle the report, in application of our legal obligations as host (LCEN; DSA, Art. 14 and 16). It is retained for 1 year after processing and only shared with the competent persons and authorities in that context.

As a host established in France, Rock-Hosting may be required to disclose certain data to judicial authorities (Art. 60-1, 60-2 of the French Code of Criminal Procedure) or administrative authorities (Art. L851-1, L871-6 of the French Internal Security Code), and to respond to orders under the DSA (Art. 10). We only disclose data under the conditions and within the limits provided by law, after verifying the regularity of the request, and in strict compliance with the confidentiality of correspondence. Insofar as the law permits, we inform you of any request concerning you. Point of contact for authorities (Art. 11 DSA): dsa@rock-hosting.com.

9. Security and data breaches

Security measures (Art. 32 GDPR): TLS encryption of exchanges, passwords stored hashed, SSH key authentication (dedicated port) for administration, server access limited to authorised persons, logging of administrative access, continuous updates and supervision.

In the event of a data breach (loss, theft, unauthorised access), we: (1) document it in an internal register (Art. 33(5) GDPR); (2) notify the CNIL no later than within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to your rights and freedoms (Art. 33); (3) inform you in clear language if the breach is likely to result in a high risk (Art. 34); (4) where it concerns content hosted on behalf of a customer acting as controller, inform that customer immediately as processor (Art. 28(3)(f) GDPR). Report any suspected incident to contact@rock-hosting.com.

10. Your rights

Access

A copy of your data and information about its processing (Art. 15)

Rectification

Correction of inaccurate or incomplete data (Art. 16)

Erasure

Deletion of your data, subject to statutory retentions (invoices 10 years, identity 5 years, connections 1 year – section 4) (Art. 17)

Restriction

Temporary freezing of processing in certain cases (Art. 18)

Portability

Receipt of your account data in a structured format (Art. 20)

Objection

Objection to processing based on legitimate interest (Art. 21)

Post-mortem instructions

Instructions concerning your data after your death (Art. 84-85 French Data Protection Act)

How to exercise your rights: by email to contact@rock-hosting.com, via the console, or by post to the registered office. Response within 1 month (extendable by 2 months for complex requests, with information). No identity document is required as a matter of principle: verification only takes place in the event of reasonable doubt as to your identity (Art. 12(6) GDPR).

11. Complaints to the CNIL

If, after contacting us, you consider that your rights are not respected, you may lodge a complaint with the CNIL (online at cnil.fr, or by post to CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 – Art. 77 GDPR), bring legal proceedings (Art. 78-79 GDPR) or seek compensation for the damage suffered (Art. 82 GDPR).

12. Records of processing activities (Art. 30 GDPR)

Rock-Hosting keeps records of processing activities in two parts: (1) processing carried out as data controller (account, billing, connection logs, support, emails, reports, security); (2) processing carried out as processor on behalf of its customers (hosting of content). These records are kept available to the CNIL upon simple request (Art. 30(4) GDPR); the table in section 2 is a public extract.

13. Changes to this policy and contacts

This policy may be updated to reflect changes in the service or regulations. The date of update appears at the top of the page; substantial changes are notified to you by email or in the console.

Contacts: privacy and rights – contact@rock-hosting.com; reports – abuse@useed.fr; authorities (DSA) – dsa@rock-hosting.com; support – customer console.