Last updated 10 November 2026

Privacy Policy

1. Data Controller and Scope

Bardsen Hosting (Norway) acts as the Data Controller under the General Data Protection Regulation (GDPR) for your account information, billing records, and server security logs. For any privacy inquiries, data subject access requests, or deletion notices, contact us at privacy@bardsen.gg (or support@bardsen.gg).

2. Hosted Data: Controller vs. Processor

It is important to distinguish between account data you provide to us, and data hosted within your server, bot, or website:

• Account and Billing Data: Bardsen Hosting is the Data Controller. We determine how and why this data is processed to manage your customer relationship and keep our systems secure.
• Customer Hosted Services (game servers, bots, websites, cloud storage and VPS): You are the independent Data Controller for all files, databases, player records, visitor analytics, chat logs, and bot tokens stored or processed on your instance. Bardsen Hosting acts strictly as a technical Data Processor and infrastructure provider. You are solely responsible for providing appropriate privacy disclosures and obtaining necessary lawful consent from your players, visitors, and users. Our obligations as your processor are set out in the Data Processing Terms (section 10) of our Terms of Service.

3. What Personal Data We Collect and Why

We process personal data under the lawful bases set out in Article 6 of the General Data Protection Regulation (GDPR):

• Account Information (Contractual necessity): Your name, email address, and encrypted password. If you sign in via Google or Discord single sign-on, we receive only your verified email address and public display name. We use this information to create your account and provision your access to the game control panel.
• Billing and Invoicing Information (Legal obligation and Contract): When commercial paid services are active, your billing address, country, and company name (if provided) are collected to generate legally compliant tax invoices. Payment card processing is handled entirely by Stripe; full payment card numbers never touch or reside on our servers.
• Security and Access Logs (Legitimate interest): IP addresses, browser user-agent headers, and authentication timestamps. We process this data to protect user accounts, defend against Distributed Denial of Service (DDoS) attacks, detect brute-force intrusion attempts, and prevent automated spam registrations.
• Support Communications (Contractual necessity and Legitimate interest): Inquiries, trouble tickets, and emails sent to our support channels. We retain these communications to resolve technical issues and maintain records of customer service interactions.
• Email Transmission Logs (Legitimate interest): Technical delivery records and message timestamps for system notifications and transactional emails sent to your registered address.

4. Third-Party Service Providers and Data Transfers

We share data only with trusted service providers who assist us in operating our infrastructure and fulfilling our obligations to you:

• Apple (iCloud Mail): Provides our email hosting and transactional email transport.
• Google and Discord: Provide optional third-party single sign-on authentication if you choose to link your accounts.
• Discord Webhooks: Used for real-time internal administrative notifications (order alerts and support ticket notifications, including customer username and ticket subject; passwords and sensitive credentials are never transmitted).
• Gravatar and UI Avatars: Used to display user profile avatars based on an encrypted hash of your email address (shop) or username (panel).
• Mojang and Modrinth: Used for Minecraft version lookups, player avatar verification, and modpack repository searches when initiated by you in the control panel.
• Let's Encrypt: Automates SSL/TLS cryptographic certificates for encrypted HTTPS connections (processes domain names; no customer personal data is transmitted).
• Healthchecks.io: Receives automated system heartbeats to monitor server uptime (no customer personal data is transmitted).
• Stripe: Processes payment transactions and recurring subscriptions when paid services are active.

Certain third-party providers are located outside the European Economic Area (EEA), primarily in the United States. International data transfers are safeguarded under the EU-US Data Privacy Framework (DPF) adequacy decision and European Commission Standard Contractual Clauses (SCCs).

5. Data Retention Periods

We retain personal information only for as long as necessary to fulfill the purposes described in this policy, comply with legal requirements, and protect our systems:

• Account Profile and Active Services: Retained for the active lifetime of your account. You may request account deletion at any time.
• Security and IP Access Logs: Retained for 90 days for network security, abuse investigation, and intrusion prevention, after which they are automatically purged.
• Email Logs and Panel Activity Audit Logs: Retained for 90 days.
• Server Data, Databases, and Backups: Deleted immediately upon scheduled termination of your hosting plan.
• Disaster Recovery System Backups: Server-wide encrypted disk backups are rotated on a rolling schedule and purged within 12 months.
• Invoices and Accounting Records: Retained for 5 years following the end of the relevant fiscal year in accordance with mandatory statutory requirements of the Norwegian Bookkeeping Act (bokføringsloven § 13).

6. Cookies and Local Storage

We use strictly essential technical cookies necessary for website functionality, security, and authentication:

• Session and Security Cookies: Maintain your active login session and provide Cross-Site Request Forgery (CSRF) protection (expires after 2 hours of inactivity).
• Cart Cookie: Remembers your chosen configuration and selected items in the cart (expires after 30 days).
• Persistent Authentication ("Remember Me"): If selected at login, keeps your session active for up to 30 days in the shop and extended sessions on the control panel.

We do not use advertising, marketing, or behavioral tracking cookies.

7. Your GDPR Rights

Under the General Data Protection Regulation (GDPR) and Norwegian data protection law, you have the following rights regarding your personal data:

• Right of access (Art. 15): You have the right to obtain confirmation and a copy of the personal data we hold about you.
• Right to rectification (Art. 16): You have the right to request correction of inaccurate or incomplete personal information.
• Right to erasure ("Right to be forgotten", Art. 17): You have the right to request deletion of your personal data when it is no longer required for its original purpose or legal obligations.
• Right to restriction of processing (Art. 18): You have the right to request that we restrict processing of your data under specific statutory circumstances.
• Right to data portability (Art. 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to object (Art. 21): You have the right to object to processing based on our legitimate interests.

To exercise any of these rights, email us at privacy@bardsen.gg or support@bardsen.gg. We will respond to your verified request within thirty (30) days without charge.

If you believe that our processing of your personal data violates data protection legislation, you have the statutory right to lodge a complaint with the supervisory authority: Datatilsynet (the Norwegian Data Protection Authority).

See also: Terms of Service · Refunds & Cancellation