HOSTKEY

GDPR overview

HOSTKEY B.V. is registered in the Netherlands (Chamber of Commerce 52751554), so the GDPR applies to it, yet the site never uses the words GDPR, AVG or data protection regulation anywhere in its text or its markup. The privacy statement, last updated on 30 June 2021, grants three rights only: to check whether HOSTKEY holds your data, to access it and to correct anything inaccurate or out of date, exercised through the contact page. Erasure, portability and objection are not mentioned. No data protection officer is named, no privacy mailbox is published, no data processing agreement is offered and no subprocessor list exists; SumSub and Google Analytics are the only third parties identified. An Article 27 representative is not required, since the company is established inside the European Union.

Who owns the data?

HOSTKEY sells unmanaged infrastructure, so the customer keeps whatever is stored on the rented server. The general terms state that every action taken through the administrative account happens under the customer's supervision and at the customer's risk, and that securing access, including passwords and the choice of SSH over telnet, is also the customer's job. The privacy statement covers only account data (identity, billing, support exchanges and KYC documents), never hosted content. For AI workloads the vendor claims the model runs on the customer's own server and that the data never leaves that environment. Identity documents collected for KYC are processed by SumSub, which returns only a validity confirmation.

Reuse rights

Nothing in the published documents restricts what a customer may do with the data on a rented server: HOSTKEY grants root access, imposes no licence on hosted content and asks no permission for reuse. The only limits are legal ones set by the acceptable use policy and the notice-and-takedown procedure. On its own side, HOSTKEY states it uses account data to process orders, run marketing and satisfaction surveys, communicate with customers, invoice and collect payment, assess creditworthiness, investigate breaches of the terms, prevent fraud, conduct legal proceedings and meet statutory obligations. It may share that data with delivery partners, credit and fraud agencies, domain registries, debt collectors, authorities and, in a dispute, the complaining party. Nothing suggests customer data is used to train models.

Data retention & training

Hosting summary

HOSTKEY B.V. is established in Amsterdam and therefore operates under Dutch and European Union law, although its terms of service exist in Dutch, United States and Russian versions depending on where the service is delivered. Thirteen data centres are published with their street addresses: Amsterdam, London, Madrid, Velizy-Villacoublay, Westbury in New York, Helsinki, two sites in Frankfurt, Keflavik, Istanbul, Milan, Warsaw and Zurich, rated from TIER II+ in Warsaw to TIER IV in Zurich. The order configurator groups them into European Union, United States, Turkey and Russia regions, and one product page states that a dedicated server can be placed in the Netherlands, the United States or Russia. All sites are described as carbon neutral and running on fully renewable power, with liquid cooling free of chemical additives. Two caveats apply. The customer chooses where the rented server sits, but the privacy statement never says where HOSTKEY keeps account data. And the website itself sits behind Cloudflare, so the address it resolves to says nothing about where customer workloads actually run.