Choose a plan
Legal

Privacy Policy

What personal data we process when you use the NBT Host website or services (hosting, domains, email, WordPress maintenance and the websites we build for you), why, for how long and what rights you have.

Last updated: 12 October 2026 (version 7)

1. Data controller

NBT X SOLUTIONS SRL, Tax ID (CUI) 50912500, Trade Register No. J2024042916004, registered office at Șos. Ștefan cel Mare și Sfânt nr. 71A, Camera 1, Iași, Romania. NBT Host is a brand of NBT X SOLUTIONS SRL; we are also the ones who build the websites ordered through “We build your website”. For any question about your data: suport@nbt-host.com or +40 775 396 021.

2. What data we process and why

Forms on the website

When you write to us through the contact form or send an order from the website: your name, email, phone number, type of request and your message, and for an order also your company details, billing address, and the service, period and domain you chose. We use them to reply to you, recommend a plan and prepare your invoice. Legal basis: steps you take before entering into a contract and our legitimate interest in responding to requests (Art. 6(1)(b) and (f) GDPR).

Orders and contract

For hosting (web, WordPress, cloud and Bulk), email, domains, WordPress maintenance and the websites we build for you: your name, company details (if applicable), billing address, email, phone number, the service and period chosen, the domain, your Enhance username, payment history and support conversations. We use them to provide the service, send you your access details, invoices and account notices, and to support you. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

For card payments, we keep, together with the order, the checkboxes ticked on the order page, as evidence: acceptance of the terms, with their version, and, if you are a consumer, your request to start before the 14-day withdrawal period has passed, with its text — each with the date and time you sent the order and the IP address you sent it from. We keep the written request for a website we build for you, or for a domain transfer, in the same way, with the date and time of the message. Legal basis: for the request to start earlier, our legal obligation (Art. 6(1)(c) GDPR and Government Emergency Ordinance No. 34/2014 (OUG 34/2014)); for acceptance of the terms, our legitimate interest in being able to prove that the contract was concluded (Art. 6(1)(f) GDPR).

If you pay by card, the payment is processed by Stripe (section 4): you enter your card details directly on their page, and we receive the payment confirmation.

NBT Account

When you request the sign-in link for the NBT Account, we use your email address to check whether you have NBT Host services or an NBT Account and to send you the link, which is valid for 15 minutes and works for a single sign-in. On the server, the address is not stored in plain text: only masked (for example i***@gmail.com), encrypted and as a fingerprint (HMAC), for as long as the link or session is valid. After you sign in, a session cookie keeps you signed in for at most 12 hours or, if you tick “Remember me”, for at most 30 days on that device (see the Cookie Policy). The page shows your services and payments, read in real time from Stripe and, for your Enhance username, from our records of hosting accounts; we do not keep copies of this data. If you pay by card on the website, after payment you go straight into your NBT Account, without an email link: a technical cookie links the payment to the browser in which you started it, and on the server we keep, for at most 24 hours, only the fingerprint (hash) of the payment used, so that direct sign-in works only once. This way you see only the order paid at that time; you see your other services after signing in with the email link. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

You can also order without an account. If you create an account (“Create an account”), we email you a confirmation link, valid for one hour; the account is created only when you confirm it on the page. In the account we keep: your confirmed email address; the creation date; your consent to this policy, with its version and the date and time you gave it; the date of your last sign-in and the date we last saw active services in the account; and, if you save them, your billing details — the type (individual or company), name, phone number, address (street, city, county, postal code) and, for companies, the company name, Tax ID (CUI) and Trade Register number. We do not keep your CNP (Romanian personal numeric code) in the account: it is requested only when ordering a .ro domain as an individual, for the .ro registry. Your email address and billing details are stored on our server only in encrypted form. With your details saved, the order page fills in automatically while you are signed in, and orders paid with the account's address appear in the account. We do not send them anywhere just because you have an account: they reach Stripe and the invoice only when you place an order, as with any order. Legal basis: your request to create an account — the account is a free service you ask us for, so performance of the contract (Art. 6(1)(b) GDPR); the same applies to orders placed. The checkbox at registration shows that you have read this policy; you can delete the account at any time while it has no services (section 6, section 7).

To stop abusive attempts (repeated requests for links, accounts or confirmations), we count requests per IP address and per email address, stored only as fingerprints (HMAC) from which the addresses cannot be reconstructed; the counters are deleted after 24 hours. Legal basis: our legitimate interest in protecting accounts and the service (Art. 6(1)(f) GDPR).

Domains

Domains are registered in your name. When you register, transfer or renew a domain through us, we pass to the registrar Openprovider (Hosting Concepts B.V., the Netherlands) and to the registry of the extension the registrant data needed for registration — usually the name, address, email and phone number, and for a company, the company name and Tax ID (CUI). Legal basis: performance of the contract (Art. 6(1)(b) GDPR). From there, the registrar and the registry use the data to register and manage the domain, under the registry's rules (for .ro, those of ROTLD) and, for generic extensions such as .com, under ICANN rules.

For a .ro domain that you register as an individual, we also ask for your CNP (Romanian personal numeric code), which we use only to register the domain with ROTLD through Openprovider and keep on our server only until registration, then delete it (at most 30 days, if the registration does not go ahead). Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and the rules of the .ro registry (ROTLD).

WordPress Maintenance

In addition to the contract data, we process the website address, the results of checks (updates, backups, availability) and what you tell us about the website, in order to carry out the maintenance and send you the monthly report. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). We access data in your website — for example your customers' orders or accounts — only on your behalf, as a processor (section 3).

“We build your website”

Your contact and company details, plus the materials you send us: texts, photos, logo and the information that will appear on the website. We use them to prepare your quote, build the website and show it to you before handover, at a preview address marked so that it is not indexed by search engines. Legal basis: steps taken before the contract and its performance (Art. 6(1)(b) GDPR). If the materials contain data about other people (for example photos or names of your employees), we process it on your behalf, as a processor (section 3).

Invoicing

We process the invoice data to issue invoices, submit them to RO e-Factura (the Romanian national e-invoicing system) and keep them for as long as the law requires. Legal basis: legal obligation — the Romanian Fiscal Code (Codul fiscal), Accounting Law No. 82/1991 and the RO e-Factura rules (Art. 6(1)(c) GDPR).

WhatsApp, phone, email

If you write to us — including at suport@nbt-host.com — or call us, we process your number or address, display name and the content of the conversation, in order to reply to you. Legal basis: steps you take before entering into a contract or performance of the contract, as applicable, and our legitimate interest in responding to those who contact us (Art. 6(1)(b) and (f) GDPR). WhatsApp is a Meta service; when you write to us there, their privacy policy also applies.

Reports of illegal content

If you report illegal content hosted with us: your name, email, the reported addresses and your explanations. We use them to review the report, confirm receipt and inform you of our decision. Legal basis: legal obligation under Art. 16 of Regulation (EU) 2022/2065 on digital services (the “DSA”) (Art. 6(1)(c) GDPR). We do not give your name and email to the customer concerned unless strictly necessary — for example, when a copyright holder needs to be identified.

Technical data

Like any web server, our servers log the IP address, date and time, the page requested and the browser; when signing in to Enhance or webmail, also the username and the result of the attempt; for emails, the delivery logs. We use them for security, troubleshooting and abuse prevention. Legal basis: our legitimate interest in keeping servers and websites secure (Art. 6(1)(f) GDPR). Logs are deleted automatically, usually after a few weeks.

Visitor statistics

Only if you accept analytics in the cookie banner, we use Google Analytics 4 to learn, in aggregate statistics, which pages are read, where visitors come from and what kind of devices they use, and to improve the website based on them. Google Analytics then receives a random identifier, stored in the _ga cookie, the page address (without anything you typed into it, for example the domain chosen on the order page), the website you came from, data about your browser, device, language and screen, and your approximate location (country and city), derived from your IP address. According to Google, the IP address of visitors from the EU is not stored: it is used only for location and is discarded immediately. We do not send Google your name, email or any other form data, we do not use a user identifier (User-ID), and Google signals and ad personalization are turned off. We do not use Google Analytics in the NBT Account. If you refuse analytics, nothing is sent. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time from , without affecting the processing carried out before.

3. Data you host

For the data you keep on NBT Host servers — the websites, databases and emails in your account, including on the separate server of a Bulk 500 or Bulk 1000 plan — you are the controller and we act as a processor, under Art. 28 GDPR. The same applies to the data in your WordPress website accessed during maintenance and to data about other people in the materials sent for the website we build for you.

We process it only to provide you with the service and do not use it for any other purpose. The terms — including sub-processors and backup rules — are set out in the Data Processing Agreement.

4. Who we share data with

  • The data center provider (Germany), with servers in the European Union — hosts our Enhance server, which holds the hosting accounts, our website, the suport@nbt-host.com mailbox and the preview of the website we build for you, as well as the separate storage space, with the same provider, where we keep encrypted backups. We receive and send emails from our own server, including automated ones — order confirmation, invoice and the NBT Account sign-in link — without an external sending service. We will tell you the provider's name on request, by email.
  • Cloudflare, Inc. (US) — the registrar of the nbt-host.com domain and the DNS provider for nbt-host.com and for the domain on which we show you, before handover, the website we build for you. Our program that checks every minute, from outside the server, that our websites respond also runs on Cloudflare; it does not receive any data about you. Visits to the website do not pass through Cloudflare.
  • Formspree, Inc. (US) — the service through which we receive messages and orders sent from the forms on the website.
  • ntfy.sh (the notification service of Philipp C. Heckel) — delivers notifications about orders, payments, invoices and domains to our phones. For an order, the notification includes your name or company name and Tax ID (CUI), your masked email address (for example i***@gmail.com), the domain, the service and the amount. According to ntfy.sh, messages are kept on their servers for 12 hours.
  • ntfy.sh, for your phone alerts — only if you have uptime monitoring and turn on “Phone alerts” in the NBT Account: when a website we monitor stops responding or comes back, we send you through ntfy.sh an alert with the website address, its status and the time (and, when it comes back, how long the outage lasted), on a secret channel that we generate at random just for you. The alert does not include your name, email or any other data about you. You can turn off alerts at any time from the NBT Account; “Change link” creates a new channel, and the old one no longer receives anything. According to ntfy.sh, messages are kept on their servers for 12 hours.
  • Stripe Payments Europe, Limited (Ireland) — card payment, automatically renewing subscriptions and the portal where you manage your card and payments. It receives the data needed for payment — your name or company, email, billing address, plan and amount — and, together with the order, the evidence of the checkboxes ticked in the order (section 2). You enter your card details directly on the Stripe payment page; we do not see your card number.
  • Google Ireland Limited (Ireland) — Google Analytics, only if you accept analytics: it receives the visit data described in section 2 and returns aggregate statistics to us. The data may also reach Google LLC (US), the parent company (section 5).
  • Meta (WhatsApp) — when you write to us on WhatsApp.
  • Openprovider (Hosting Concepts B.V., the Netherlands) and domain registries — Openprovider is the registrar through which we register domains: when a domain is registered, transferred or renewed, it receives the necessary registrant data — name, address, email and phone number, and for a company, the company name and Tax ID (CUI). The registries are ROTLD for .ro domains and, for other extensions, the registry of the extension concerned.
  • The bank — through which we receive, by bank transfer, payment for the websites we build for you; it sees the details in your payment order.
  • The invoicing software — the application in which we issue invoices and submit them to RO e-Factura. We issue invoices through SmartBill (S.C. Intelligent IT S.R.L., Bucharest), where the billing data is also processed.
  • Accounting — billing data reaches those who keep the company's accounting records.
  • Authorities — only when the law requires us to: the Romanian tax authority (ANAF), through RO e-Factura; courts and authorities that send us a legal order; criminal investigation bodies, when we become aware of a possible criminal offense that threatens someone's life or safety (Art. 18 DSA).

We do not sell your data and we do not use it for advertising.

5. Transfers outside the European Economic Area

Most of the providers above process data in the European Union. The exceptions:

  • Formspree — US; Formspree states that it uses the standard contractual clauses (Art. 46 GDPR).
  • Cloudflare — US; standard contractual clauses and the EU–US Data Privacy Framework.
  • Stripe — processes data in the EU, but may transfer it to Stripe, Inc., in the US; on the basis of the standard contractual clauses and the EU–US Data Privacy Framework.
  • Google Analytics — data of visitors from the EU is collected through servers in the EU, but Google Ireland Limited may transfer it to Google LLC, in the US; on the basis of the EU–US Data Privacy Framework, under which Google LLC is certified, and the standard contractual clauses.
  • ntfy.sh — does not state in which country its servers are located, and we do not have a data processing agreement with it; the data in notifications may therefore also end up outside the European Economic Area (the same applies to phone alerts, if you turn them on).
  • International domains (for example .com or .org) — Openprovider is in the Netherlands, but the registries of some international extensions are outside the European Economic Area, for example in the US; registrant data may reach them when the registry requires it for registration.
  • WhatsApp — under Meta's privacy policy.

6. How long we keep data

  • Messages from the form and from WhatsApp: as long as needed to reply to you; if you do not become a customer, we delete them within 12 months of the last message.
  • Contract data: for the duration of the contract and then for as long as the statutory limitation period requires.
  • Accounting documents (invoices): for as long as Accounting Law No. 82/1991 requires.
  • Hosting account data: for the duration of the contract. In case of non-payment, the service is suspended 7 days after the due date, and the data is permanently deleted 30 days after suspension (terms).
  • Backups of hosting accounts: on the server they are made daily and kept for at most 30 days; on the separate, encrypted storage space we keep 7 daily and 4 weekly copies, so a copy stays there for at most 5 weeks. Each copy is deleted automatically when its retention period expires, including after the account is deleted.
  • NBT Account: the sign-in link expires after 15 minutes, and the confirmation link for a new account after one hour, or on first use; the session ends when you sign out, after 2 hours of inactivity or after at most 12 hours (with “Remember me”, after 30 days); the counters that limit requests are deleted after 24 hours; for direct sign-in after payment, the technical cookie expires after at most 2 hours, and the fingerprint of the payment used is deleted after 24 hours. The account and saved billing details remain for as long as you use them: you can delete an account without services at any time from the NBT Account (“Delete account”), and we delete it automatically after 24 months in which it has had no active services and you have not signed in. We delete an account with services on request (write to us at suport@nbt-host.com), except for the data the law requires us to keep, for example invoices.
  • Materials and the preview of a website we build for you: for as long as the work lasts, until the website is handed over.
  • Reports of illegal content: as long as needed to resolve them and to be able to prove how we handled them, within the statutory limitation period.
  • Visitor statistics (Google Analytics): data linked to the identifier in the _ga cookie is kept in Google Analytics for at most 14 months, then deleted automatically; aggregate reports, without identifiers, may remain. The _ga cookies expire in your browser 2 years after your last visit, and if you withdraw your consent, the website deletes them.

7. Your rights

Under Regulation (EU) 2016/679 (GDPR), you have the right to find out what data we hold about you, to rectify it, to erase it, to restrict processing, to receive it in a portable format and to object to processing based on legitimate interest. We do not make decisions about you based solely on automated processing. Write to us at suport@nbt-host.com; we will reply within one month.

You can delete an NBT Account without services yourself, at any time, from the NBT Account (“Delete account”): the account, the billing details and the consent record are deleted immediately, and you are signed out on all devices. You can also correct your saved billing details there.

You can withdraw your consent to visitor statistics (Google Analytics) at any time, just as easily as you gave it, from in the footer of any page; withdrawal does not affect the processing carried out before.

You can also lodge a complaint with the Romanian data protection authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP) (dataprotection.ro).

8. Security

The website, hosting accounts, email and control panel use encrypted connections (HTTPS, IMAPS and SMTPS), and encrypted FTP (FTPS) is available for FTP. Administrative access to the servers is restricted to the team that manages them, using cryptographic keys and strong passwords. Hosting accounts are isolated from one another, and backups are made every day, with an encrypted copy on a separate storage space. Details in the Data Processing Agreement.

9. Single point of contact and reports (DSA)

Under Articles 11 and 12 DSA, the single point of contact of NBT Host — for the authorities of the Member States, the European Commission and the European Board for Digital Services, as well as for customers and any other person — is suport@nbt-host.com. You can also call us or write to us on WhatsApp at +40 775 396 021, Monday–Friday, 9:00–18:00 Romanian time (EET/EEST). You can write to us in Romanian or English; messages are read by a person.

How to report illegal content

Write to us at suport@nbt-host.com, with the subject “Illegal content report”, and include (Art. 16(2) DSA):

  1. why you consider the content to be illegal;
  2. the exact location — the URL or URLs — and, where applicable, other details that help us find it (for example the header of a spam email);
  3. your name and email address — these are not required if you are reporting child sexual abuse material; in that case do not attach the material, just give us its location;
  4. a statement that, in good faith, the information and allegations in the report are accurate and complete.

We confirm receipt by email and inform you of our decision, together with the available means of redress. If we restrict a customer's content or account, we send that customer the reasons for the decision. The full rules are in the Terms and Conditions. If someone is in immediate danger, call 112.

11. Changes

If we change this policy, we will publish the new version here, with the date of the update. The current version is the one on this page.

NBT X SOLUTIONS SRL · Tax ID (CUI) 50912500 · Trade Register No. J2024042916004
Șos. Ștefan cel Mare și Sfânt nr. 71A, Camera 1, Iași, Romania · suport@nbt-host.com · +40 775 396 021
Next documentCookie Policy Back to site