Privacy Policy (PP)

Translation Notice

This document has been automatically translated from Polish to English using artificial intelligence for informational purposes only.

In the event of any discrepancies, inconsistencies, or conflicts between the English and Polish language versions of this document, the Polish language version shall prevail and constitute the sole legally binding version.

For official and legally binding information, users are advised to consult the original Polish language document.

Users who do not understand Polish are advised to seek independent legal advice before accepting these terms.

For the platform/website/service/services located at the domain "voxihost.pl"

This document is part of a set of documents:

Terms of Service (TOS)
Privacy Policy (PP)
Service Level Agreement (SLA)
Fair Usage Policy (FUP)
Data Processing Agreement (DPA) - in B2B relations

Effective Date: 11.12.2026

Last Updated: 11.11.2026

§ 1. Preliminary Provisions and Definitions

1.1. Personal Data Controller:

VoxiHost DANIEL MARSZAŁKOWSKI
ul. 3 Maja 29, 62-500 Konin, Poland
NIP (Tax ID): 6653080651 | REGON (Statistical ID): 542936383
E-mail: support [at] voxihost.pl

(hereinafter referred to as "VoxiHost" or the "Operator").

1.2. Scope of Application: This Privacy Policy constitutes an integral part of the Terms of Service and applies exclusively within the website available under the VoxiHost.pl domain. This document does not apply to other websites, projects, or web pages operated by the Operator under other addresses. An Account may include multiple Workspaces (personal, corporate, or educational). The data described in this Policy may concern the Client, the entity to which the Workspace is assigned, and persons invited to the Workspace.

1.3. Purpose: The purpose of this Privacy Policy is to ensure transparency regarding the processing of personal data and to fulfill the information obligations arising from the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016).

1.4. Acceptance: Registration of an Account or ordering a Service implies familiarization with this Privacy Policy. In the event of changes to the Privacy Policy, the Client will be informed in accordance with §12.2. Changes significant to Consumer rights require express acceptance if required by law; silence does not constitute acceptance. The Client has the right to terminate the agreement in case of non-acceptance of the changes.

§ 2. What Data We Collect

This policy applies to data that you own (Account Data). In the case of data that you store within the Digital Services (files, databases, applications), the Operator acts only as a Data Processor providing the infrastructure. The Operator does not analyze content for marketing purposes nor does it disclose it; access to content may occur only in cases described in DPA §5 (e.g., support at the Client's request, prevention of abuse, security incident) or based on legal provisions.

2.1. Identity Data: First name, last name, age (date of birth), company name, NIP (Tax ID), residential/registered address.

2.2. Contact Data: E-mail address, phone number (for SMS/2FA notifications).

2.3. Technical Data (Device Fingerprint): IP address, browser type (User-Agent), screen resolution, time zone, operating system - used to create a device "fingerprint" for the purpose of detecting multi-accounts and fraud. Fingerprinting is strictly necessary for the provision of the Service within the meaning of Art. 399 of the PKE (Telecommunications Law): without it, we cannot ensure the security of the Account and infrastructure, nor effectively prevent fraud and multi-accounts. Legal basis: Art. 6(1)(f) of the GDPR (legitimate interest in infrastructure security and fraud prevention); a legitimate interest assessment (LIA) is documented. The Operator does not use it for marketing purposes or for tracking activity outside the Service. The Client may object under the terms of Art. 21 of the GDPR; the Operator may reject it if it demonstrates compelling, legitimate grounds overriding the interests of the Client, in particular infrastructure security. In the event of a successful objection, some security features, including access to the Service, may be unavailable.

2.4. Financial Data: Transaction history, payment method, Transaction ID, and in the case of cryptocurrency payments - cryptocurrency wallet address and blockchain network transaction data. We do not store full payment card numbers or private keys of cryptocurrency wallets (these are processed directly by an external Payment Operator).

2.5. Verification Data (KYC): Verification status, hash of the identity document, reliability assessment result (Scoring).

2.6. Server Logs and Security Telemetry: Login history, full activity logs in the Panel (Audit Log), as well as network traffic metadata (NetFlow/sFlow), which may contain IP addresses (personal data), analyzed in real-time to detect anomalies and cyberattacks. Metadata is not content of the Services; the Operator does not analyze content for marketing purposes.

2.7. Identity Verification (KYC) and didit.me:

Identity verification (KYC) is performed by an external entity didit.me.
Regarding verification commissioned by the Operator, didit.me acts as a processor; regarding its own security purposes, abuse prevention, and development of fraud models, it may act as a separate controller. The scope and principles of this processing are described in the didit.me Privacy Policy. To the extent that didit.me acts as a separate controller, the retention period is determined by its privacy policy; the Operator does not control this period.
Biometric data: if didit.me performs face matching or liveness checks, it processes biometric data (Art. 4(14) of the GDPR). Basis: Art. 9(2)(a) of the GDPR (explicit consent) in conjunction with Art. 6(1)(b) of the GDPR. The Operator will conduct a DPIA for KYC, profiling, and hash retention; before launching new biometric features, it will assess the risk and, if necessary, consult with the UODO (Personal Data Protection Office) (Art. 35-36 of the GDPR). Consent for biometrics is separate, voluntary, and can be withdrawn; refusal means no biometric verification and the possibility of alternative verification, if available. Consent is recorded (version, time, IP/UA).
The Operator is a separate controller regarding the processing of the verification result.
A detailed description of the KYC process, including the scope of data and storage periods, is in the Terms of Service (TOS §3.4).
Retention: verification data at didit.me is stored according to the configuration indicated by the Operator and for no longer than 1 month. The hash (HMAC-SHA-256) is stored only for persons blocked for serious violations, for a period of up to 6 years from the date of the block; for other persons, verification data is deleted after 1 month.
Legal basis: Art. 6(1)(b) of the GDPR (performance of a contract); storage of status and hash - Art. 6(1)(f) of the GDPR (legitimate interest in preventing recidivism).

§ 3. Purposes and Legal Bases for Processing

Whenever the GDPR is mentioned in the following section, it refers to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data.

3.1. Provision of Services:

Basis: Art. 6(1)(b) GDPR.
Explanation: Necessary for the performance of a contract (provision of Services, access to the Client Panel).

3.2. Payment Processing:

Basis: Art. 6(1)(b) GDPR.
Explanation: Processing of Credits top-ups and issuing invoices.

3.3. Own Marketing:

Basis for processing and communication: Art. 6(1)(a) GDPR (consent) in conjunction with Art. 398 of the Electronic Communications Law (PKE). Consent is required for e-mail/SMS marketing; for the processing of contact data for marketing purposes itself, the basis is consent.
Explanation: We may process your contact data for marketing purposes (informing about news, promotions, service development). Sending marketing e-mails or SMS messages requires your separate consent. You may withdraw your consent at any time by clicking the "unsubscribe" link in the message or by contacting support [at] voxihost.pl.
Consent mechanism: Consent for electronic marketing is expressed by checking an optional box during registration or at a later time in the Client Panel. Consent is separate for e-mail and SMS; we use double opt-in for e-mail and record the consent (version, time, IP/UA). The box is unchecked by default - consent is not required to create an account. Consent can be withdrawn at any time.

3.4. Tax Obligations:

Basis: Art. 6(1)(c) GDPR.
Explanation: Storage of invoices for 5 years (requirement of the Accounting Act).

3.5. Security and Logs:

Basis: Art. 6(1)(f) GDPR.
Explanation: Legitimate interest: defense against DDoS, hacking, and Abuse.

3.6. Risk Assessment (Anti-Fraud):

Basis: Art. 6(1)(f) GDPR.
Explanation: Legitimate interest: verification of threats, prevention of fraud.

3.7. Handling Abuse Reports:

Basis: Art. 6(1)(f) GDPR.
Explanation: Processing data of persons reporting violations (whistleblowers) for the purpose of analysis and response to incidents.

3.8. Pursuit of Claims:

Basis: Art. 6(1)(f) GDPR.
Explanation: Debt collection, defense against chargebacks.

3.9. Voluntariness of Providing Data: Providing personal data is voluntary, however, it is a necessary condition for concluding a contract (Art. 6(1)(b) GDPR). The consequence of not providing data will be the inability to create an account and use the Services. Biometric data are processed solely on the basis of separate consent (Art. 9(2)(a) GDPR); refusal of consent means no biometric verification and the possibility of using alternative verification, if available.

§ 4. Profiling and Automated Decision-Making

In the interest of infrastructure security, we use automated systems (profiling) that assess the Client's credibility.

4.1. What it involves: The system analyzes the IP address, device fingerprint, country of origin, payment history, and verifies the presence of data in external threat databases and abuse registries (Threat Intelligence/RBL).

4.2. Effect: If the system detects high risk (e.g., IP associated with a botnet, stolen card), registration may be automatically rejected or the service blocked.

4.3. Your Rights: You have the right to obtain human intervention, express your position, and contest the decision. If you believe the system has made a mistake, write to us at support [at] voxihost.pl - an employee will verify the decision manually. We make decisions under §4.2 based on Art. 22(2)(b) GDPR (necessity for the conclusion of a contract) or on the basis of separate explicit consent (Art. 22(2)(a)); in the case of biometric data - Art. 9(2)(a) in conjunction with Art. 22(4) GDPR. We inform about the logic, significance, and expected consequences of the decision (Art. 13(2)(f) / 15(1)(h) GDPR).

§ 5. Recipients of Data

We transfer your data to processors and separate controllers. Instead of listing every company by name, we indicate categories of recipients (in accordance with the GDPR):

5.1. Infrastructure and Security:

Data Center and colocation service providers (located in the EEA).
Network service providers, CDN (Content Delivery Network), and protection against DDoS attacks and WAF (Web Application Firewall).

5.2. Payments (separate controllers): Electronic payment operators and banks (e.g., Stripe, PayPal, NOWPayments) - to the extent necessary to execute transactions.

5.3. Support and Verification: didit.me (identity verification), Cloudflare (Turnstile, bot protection) - for the purpose of preventing fraud and protecting infrastructure. didit.me is a verification processor commissioned by the Operator and a separate controller for its own purposes; Cloudflare is a Turnstile processor and a separate controller for its own purposes; details in their privacy policies. These entities are listed in DPA Annex III (in B2B relations); for Consumers, their roles and bases are described by this Policy.

5.3a. Other recipients: threat intelligence/RBL providers, SMS/e-mail providers, sanction screening entities, and public authorities - to the extent required by law or necessary for security. Payments, accounting, legal services, and debt collection process the Operator's data as separate controllers, not sub-processors.

5.4. Administrative Support:

Accounting office / Accounting system providers (separate controllers).
Law firms and debt collection agencies (separate controllers; solely in the case of pursuing claims).

§ 6. Transfers Outside the EEA

We cooperate with service providers (e.g., in the scope of network security or payments, including cryptocurrency payments) who may process data outside the EEA (including in the USA). This transfer is secure and lawful based on:

6.1. Data Privacy Framework (DPF): European Commission decision establishing an adequate level of data protection in the USA.

6.2. Standard Contractual Clauses (SCC): Additional legal safeguards in contracts with providers. For transfers covered by SCC, we conduct a Transfer Impact Assessment (TIA).

6.2a. NOWPayments: The cryptocurrency payment operator is FD Transfers LLC based in Saint Vincent and the Grenadines; the transfer takes place based on SCC (appropriate module) and a documented TIA. We provide details upon request.

6.2b. Cloudflare/Stripe/PayPal: transfers to the USA take place based on the DPF, provided the provider is certified for the appropriate scope of data; otherwise, we apply SCC and TIA.

6.3. Transfer of Data to Authorities Outside the EEA: In exceptional cases, when we receive a legally binding request to disclose personal data from a public authority of a country outside the EEA (e.g., a request for legal assistance from law enforcement), the transfer will take place only if the request:

is compliant with an international agreement (e.g., mutual legal assistance treaty),
concerns a specific case and is not of a mass nature,
has been verified for compliance with EU law by a lawyer.

The Operator informs the UODO (Personal Data Protection Office) of every such request, unless it is prohibited (e.g., investigation secrecy).

§ 7. Data Security

We apply technical and organizational measures in accordance with industry standards:

7.1. Encryption: Connections (HTTP/API) are encrypted using the TLS 1.2 or 1.3 protocol. Encryption at rest (AES-256) covers systems managed by the Operator (account databases, client panel, infrastructure backups). Data within the Client's VPS instance is encrypted only if the Client enables encryption on their own.

7.2. Password Hashing: User passwords are hashed using a strong algorithm (Argon2/Bcrypt) and are never stored in plain text.

7.3. Access Minimization: Only authorized employees have access to data (need-to-know principle), secured by two-factor authentication (2FA).

7.4. Backups: Backups of the Operator's administrative systems (account databases, client panel) are encrypted and stored in a separate geographical location within the EEA. Note: The above does not apply to backups of data within the Client's VPS server, for which the Client is solely responsible (in accordance with the Terms of Service).

7.5. Breach Procedure: In the event of detecting a personal data breach that may result in a risk of violating user rights, we will report the incident to the President of the Personal Data Protection Office (UODO) within 72 hours of its detection (in accordance with Art. 33 of the GDPR). In the event of a high risk, we will also inform the data subjects without undue delay (in accordance with Art. 34 of the GDPR). If the Operator acts as a processor, it shall inform the Consumer without undue delay (Art. 33(2) of the GDPR).

7.6. Security Testing: The Operator conducts regular infrastructure security audits, including penetration tests (pentests) and code reviews, to identify and remediate security vulnerabilities.

§ 8. Retention Period (How Long We Keep Data)

8.1. Account Data: For the duration of the agreement + 30 days after its termination (buffer for errors). Data necessary for settling the Paid Credits balance is stored for 12 months from the closure of the Account (TOS §9.2), and subsequently, minimal billing data (identifier, balance) is stored for the limitation period to enable a later request.

8.2. Invoices, payment confirmations, and accounting documents: 5 years from the beginning of the year following the tax year (legal requirement - Accounting Act, Art. 74(3)).

8.3. Technical Logs: For a period of 12 months for security purposes, based on Art. 6(1)(f) of the GDPR (legitimate interest: infrastructure security). The period may be extended only in the event of an incident or proceedings. We do not use Art. 47 of the PKE (Electronic Communications Law) as a basis for retention unless the Operator provides electronic communication services within the meaning of the PKE.

8.4. Data Retention for Security Purposes (Protection against Recidivism):

In the case of Clients blocked for a serious violation of the Terms of Service (Abuse, Fraud, Attacks on infrastructure), the Operator stores a pseudonymized hash (HMAC) and evidence of the violation for a period of 6 years from the date of account blocking, based on Art. 6(1)(f) of the GDPR and a legitimate interest assessment.
The Operator stores the hash (HMAC) solely for persons blocked for serious violations, in order to prevent re-registration.
The purpose is to defend against claims, secure the infrastructure, and secure evidence for law enforcement authorities.
The 6-year period applies to serious violations and is based on a legitimate interest assessment; for other claims related to business activity, 3 years applies (Art. 118 of the Civil Code). Raw IP addresses, fingerprints, and correspondence are stored only for the duration of the incident or proceedings; after their conclusion, only pseudonymized data and evidence of the violation remain.
To the extent that processing is necessary for the establishment, exercise, or defense of legal claims (Art. 17(3)(e) of the GDPR), the right to erasure is limited. After the retention period (6 years) expires, the data is automatically deleted, unless the retention of data is necessary for defense against ongoing judicial or criminal proceedings.
Exception for Amnesty: In the event that a Client has successfully passed the Amnesty procedure (in accordance with the Service Terms) and has not committed a repeat violation for a minimum period of 2 years from the unblocking of the service, the data from the original violation may be deleted at the Client's request. The decision is made by the Operator after verifying the absence of new incidents.

8.5. Automatic Deletion: After the expiration of the retention periods specified in §8.1-8.4, the data is automatically deleted from production systems and backups in accordance with security procedures (overwrite/shredding), making it impossible to recover.

§ 9. Your Rights and Their Limitations

You have the right to:

9.1. Access Your Data: You may request a copy of the personal data we hold.

9.2. Rectification of Data: You may request the correction of incorrect or incomplete data.

9.3. Erasure of Data ("Right to be Forgotten"): Subject to the condition that this right does not apply if processing is necessary for the establishment, exercise, or defense of legal claims (e.g., if we are pursuing claims for unpaid invoices or the retention of data is necessary for defense against a claim) - Art. 17(3)(e) of the GDPR.

9.4. Restriction of Processing: You may request a temporary suspension of data processing in specific cases.

9.5. Data Portability: You may request to receive your data in a structured, commonly used format (e.g., JSON).

9.6. Objection: You have the right to object to the processing of data based on a legitimate interest. The Operator may reject it if it demonstrates the existence of valid, legitimate grounds for processing that override your interests (e.g., the security of the Operator's entire network).

You have the right to object at any time to the processing of your data for direct marketing purposes, including profiling; in such a case, the Operator will cease such processing.
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you. In the cases described in §4, you may request human intervention, express your position, and contest the decision.
Data sources: data comes from you, from Payment Operators, didit.me, public registers, and threat intelligence/RBL providers. The scope and categories of data are described in §2. Data may come from publicly available sources; we provide information about the source within one month of obtaining it (Art. 14(3) of the GDPR).
You have the right to object at any time to direct marketing, including profiling; the objection does not require justification and is binding on the Operator (Art. 21(2) and (4) of the GDPR).

9.7. Filing a Complaint: You have the right to file a complaint with the President of the Personal Data Protection Office (UODO), ul. Stanisława Moniuszki 1A, 00-014 Warsaw.

9.8. Submitting Requests: Requests regarding the exercise of the above rights should be sent to the address: support [at] voxihost.pl. We will respond within 1 month of receiving the request (in accordance with Art. 12.3 of the GDPR). In justified cases (e.g., complexity of the request, large number of requests), we may extend this period by another 2 months, informing you of the reasons for the delay.

§ 10. Protection of Children

Our services are aimed at persons who are at least 16 years old. Art. 8 of the GDPR applies only to processing based on consent; for the conclusion of an Agreement by a person under 18 years of age, the consent of a legal representative is required (Art. 17 of the Civil Code), with the exception of minor current matters of daily life. We do not knowingly collect personal data from children under 16 years of age. If we discover that an account has been created by a person under this age without the required consent, we will take steps to delete such data and block the account.

§ 11. Cookies and Local Storage

The website uses cookies and browser local storage (Local Storage) to a minimal extent:

11.1. Necessary (Technical): Maintaining login sessions, remembering preferences (e.g., light/dark theme), preventing CSRF attacks.

11.2. Security (Cloudflare/Turnstile): Bot detection (distinguishing humans from automated scripts). Cloudflare may process IP addresses, User-Agent, and device data; in some configurations, it sets __cf_bm and cf_clearance cookies. Basis: Art. 399 of the Telecommunications Law (PKE); Cloudflare cookies are necessary for security. If Cloudflare processes data for its own purposes of improving algorithms, this requires a separate basis and consent, if required by law. A detailed table of cookies (name, provider, purpose, duration) is publicly available before consent is given (link in the Privacy Policy), and if Cloudflare sets cookies that are not strictly necessary, the Operator displays a consent banner with a "reject all" option before they are set. For Cloudflare's own purposes, the basis is Art. 6(1)(f) of the GDPR.

11.3. No Persistent Tracking Cookies: We do not use persistent marketing or tracking cookies (e.g., Google Analytics, Facebook Pixel). The session cookie of the affiliate program (voxihost_ref) saves only the referrer code for the duration of the browser session, expires upon its termination, and is not used to track activity outside the Service. Cloudflare cookies (§11.2) are necessary for security. We respect your privacy.

§ 12. Changes to the Privacy Policy

12.1. Right to Amend: The Operator reserves the right to make changes to this Privacy Policy in the event of changes in legal regulations, technology, or data processing methods.

12.2. Notification of Changes: We will inform the Client of any material change via email or through a notification in the Client Panel at least 30 days in advance. Changes enter into force after the expiry of this period. If the Client does not accept the changes, they may terminate the agreement before they enter into force. Changes material to Consumer rights require explicit acceptance if required by law; lack of response does not constitute acceptance.

12.3. Availability: The current version of the Privacy Policy is always available on the VoxiHost.pl website in the footer and in the Client Panel after logging in, in a form that allows for downloading, saving, and printing. The date of the last update is located in the document header.

On this page