Who is responsible
GeekyDigital LTD., company registration 207936510, at 2–4 Kozloduy St., Haskovo, Bulgaria, is the controller for the account, billing and operational records described here. Contact abuse@geekydigital.cloud for privacy questions, requests and security concerns.
This notice covers our platform records. You determine the content and purposes of data you place inside your VPS. Where we process hosted personal data on your behalf, appropriate processing instructions and a data processing agreement must be arranged; this notice does not replace that agreement.
Information and purposes
| Records | Purpose and basis |
|---|---|
| Name, email, account identifiers, password hash, billing details and service selections | Creating and performing the account/service contract, answering your requests and issuing the selected service. |
| Orders, invoices, tax details, wallet transactions, provider references, adjustments and disputes | Performing payments and the contract, meeting accounting and tax obligations, and pursuing or defending legitimate payment claims. |
| Support messages and attachments | Responding to support and contract requests; investigating issues and maintaining a record of their resolution. |
| IP addresses, login history, user-agent details, security events, operation metadata and resource measurements | Our legitimate interests in securing accounts, preventing misuse, investigating incidents and operating reliable services. Access is limited to authorised people who need it. |
| Document versions, accepted text, order references, acceptance timestamps, withdrawal statements, privacy requests and their responses, and cookie-choice evidence | Recording and performing the contract, complying with statutory withdrawal and data-rights obligations, and demonstrating the information provided and choices made under applicable accountability duties. |
Account credentials, contact details and the information needed for the selected service are required to create and operate that account or service. Optional fields are identified in the forms. Do not include passwords, private keys or unnecessary sensitive information in support messages. Stored SSH keys are public keys; temporary provisioning credentials have a separate protected lifecycle.
Accepting service terms or acknowledging this notice does not authorise unrelated marketing. If we ask for consent for an optional purpose, that request will identify the purpose and how to withdraw consent.
Cookies, preferences and optional analytics
The Cookie Policy lists the browser storage used by this platform. Open Cookie settings in the footer at any time to reject optional storage, allow selected purposes or withdraw a previous choice. Necessary session, authentication, security and cookie-choice storage remain active. Appearance and navigation persistence are optional.
Where configured, Google Analytics 4 provides statistics about visits to public pages only after you explicitly allow analytics. It is not loaded before that choice, after rejection or in the account/administration areas. Our integration sends a fixed public page address and title without URL query strings, fragments, form values or account identifiers. Advertising consent remains denied; Google Signals and advertising personalisation are disabled in this integration. We do not send marketing events or use analytics to make decisions about your account.
Google receives technical/device information and the network address needed to receive the analytics request. Analytics identifiers are personal data even when they do not contain your name. Google may process data outside the EEA; the applicable Google data-processing terms and transfer safeguards must be maintained by the controller. See Google's explanation of Analytics data and Google's privacy policy. Consent is the basis for this optional processing. Refusing analytics does not affect ordering, account access or support.
Cookie choices expire after 180 days and are requested again when the purposes or configured analytics property change. The platform records the choice, the notice/version, purposes and time, with an opaque browser token. It does not record an IP address or user agent in the consent record. A choice made while signed in is associated with your account; anonymous choices are not retroactively assigned to an account. These records demonstrate and apply your choice and are retained for up to five years, subject to applicable rights and documented legal obligations.
Recipients and international processing
Authorised platform staff and service providers may handle the information necessary for infrastructure hosting, storage and recovery, transactional communications, support, security, accounting and payment processing. An enabled payment method identifies its provider at checkout; that provider may also act as a separate controller under its own notice. We may provide records to competent authorities where legally required, or to advisers when necessary for a legal claim.
The selected service location is shown in your order. A service location alone does not describe every recipient of account or payment data. Where personal information is transferred outside the EEA, the applicable transfer basis and safeguards must be in place. Contact the privacy address for information about the recipients involved in your service and any relevant transfer safeguards.
Retention
Our standard retention period for necessary account, contract and support records is five years after the account or contractual relationship ends. We review whether records remain necessary, honour applicable deletion rights and remove or anonymise records when their justified retention ends.
Some categories have shorter operational periods: ordinary login history is pruned after 180 days; eligible read-only API history and resolved monitoring incidents after 90 days; expired console grants after one day. Write/security evidence relevant to an unresolved incident or claim can require separate retention. Browser preferences are controlled through your browser.
Accounting and tax records follow mandatory statutory periods where these differ from the five-year standard. For example, Bulgarian accounting law provides a ten-year period for relevant accounting registers, financial reports and documents for tax control; the applicable category and starting date determine the actual period. A documented legal hold may require retaining relevant evidence until the issue is resolved.
The five-year period is for necessary personal and contractual records, not a promise to retain a deleted VPS, its disks or its backups for five years. VM data can be removed by rebuild, restore or termination. Copies in protected backup archives follow the applicable backup retention and deletion process and must not be restored for an unrelated purpose. Contact us about a specific deletion request, including any copy that cannot be removed immediately from an archive.
Your rights and requests
Use Privacy and data in your account to submit and follow requests for access, portability, correction, erasure, restriction, objection or human review of an automated decision. You can download the self-service account-data export after entering your current password. It contains supported account records and your public support messages; it excludes credentials, confidential internal material and other people's data. The scope is listed in the export. For additional personal data or a review of any excluded material, submit an access request. Self-service does not limit your statutory rights or replace a full response where additional data are required.
We respond without undue delay and normally within one calendar month of receipt. Where complexity or the number of requests justifies an extension, we explain the reason within the initial month; the additional period is no more than two further months. Asking for information does not silently reset the recorded deadline. You can see public responses and the request's status in your account. You may also write to the privacy contact without having an account.
Erasure is reviewed against active contracts, legal obligations and claims. Closing or anonymising an account profile does not itself erase records that must lawfully be retained, such as relevant invoices. We explain any retained categories and reasons. A request does not automatically terminate or delete a VPS. Any external processors and backup copies must be considered when completing the request.
Depending on the applicable basis and circumstances, you may request access, correction, erasure, restriction or portability, or object to processing based on legitimate interests. Where processing relies on consent, you can withdraw that consent without affecting earlier lawful processing. Send a request to abuse@geekydigital.cloud; we may request proportionate information to verify identity. You can also complain to the Bulgarian Commission for Personal Data Protection or another competent supervisory authority.
Billing automation can restrict purchases or suspend services when configured payment or debt conditions are met. Provider outcomes can also trigger a financial review. Contact support or the privacy address to contest an outcome and request human review. We do not treat an automated status as a reason to deny applicable rights.
We publish dated versions of this notice and communicate material changes affecting your use of the service. Historical contract acceptance records preserve the text accepted at the time.