Privacy notice

01Data controller

The controller of your personal data is Daniel Antonio Castillo Nah, an individual registered for business activity in Mexico (persona física con actividad empresarial), tax ID (RFC) CAND910511NU6, located at Calle 31 No. 194, Col. San Rafael, C.P. 97680, Tekit, Yucatán, México, who operates the HostSpace brand. For any matter related to your personal data, including exercising your rights, contact us at:

Email: ••••••••••••••

Phone: +52 81 2858 2129

02Personal data we process

Depending on how you interact with us, we may process:

• Identification and contact: name, email address, phone number, company, language, and the additional contacts (emails and phones) and people you add or invite to your account.
• Account data: email and password (stored with an irreversible hashing algorithm), the identifier and basic profile of your Google account if you sign in with it, your two-step verification settings and the record of your sessions (date, IP address and browser).
• Tax data: RFC, name or company name, tax regime, postal code and tax address, CFDI use and billing email for each legal entity you register.
• Domain and certificate registrant data: name or company name, address, city, state, postal code, email and phone of each domain’s registrant and, for organization certificates, the organization’s details.
• Financial and payment data: for your cards we keep only the identifier assigned by Openpay, brand, last four digits, expiry date, type and issuing bank; never the full number or security code, which are entered directly into Openpay. We also process your history of invoices, payments and charge attempts and, in transfer notices, the bank, tracking key, amount, date and any receipt you attach; to refund a transfer, the CLABE you give us.
• Technical and security data: IP address, browser and device, the anti-fraud session identifier Openpay generates when you save a card or pay, and activity and audit logs of your account and services.
• Support and communications data: the messages you send us and our replies.
• Campaign data: the referral or promotion code and campaign parameters you arrived with.

We do not request sensitive personal data. Please do not include it in your messages. Our services are not directed at minors.

Content of your services: the files, databases and email you store in your hosting, mailboxes or VPS may contain third parties’ personal data. For that data you are the controller and HostSpace acts only as a processor: we host it on your behalf and do not access it except to provide support at your request, for infrastructure security or when required by a competent authority.

03Necessary purposes

We use your data for the following purposes, which are necessary for your legal relationship with us and for which, under article 9, section IV, of the law, your consent is not required:

• Creating, verifying and managing your account, and giving access to the people you invite.
• Purchasing, activating, operating, renewing and supporting your services, including domain registration and certificate issuance.
• Issuing invoices, processing payments and the recurring charges you authorize, validating transfers and processing refunds.
• Stamping your CFDI and meeting tax and accounting obligations.
• Sending service notices: invoices, payments, declined charges, due dates, suspensions, maintenance, changes to the terms and news about your services.
• Preventing fraud, abuse and unauthorized access, and protecting our infrastructure and other customers.
• Applying promotions, account credit and the referral program to your purchases.
• Responding to requests from authorities and exercising or defending our rights.

04Additional purposes

With your consent, which you may refuse or withdraw at any time without affecting your services, we also use your data to:

• Send you HostSpace promotions, offers and commercial news by email and in the portal.
• Measure site usage and the effectiveness of our campaigns and ads (Google Analytics, Google Ads, the Meta Pixel and campaign attribution).

To stop receiving promotions, use the “unsubscribe” link in each promotional email, change your email preferences in the portal or write to us. Service notices are still sent, because they are needed to manage your services. Analytics is only enabled if you accept it in the cookie notice.

05Who we share your data with

We do not sell your personal data. We share it only with the following recipients and for the stated purposes. The third-party transfers listed are necessary to perform the contract or a legal obligation and therefore do not require your consent (article 36 of the law):

• Openpay: card payment processing, recurring charges, refunds and fraud prevention.
• Facturama, an authorized certification provider, and the Mexican Tax Administration Service (SAT): stamping and validating CFDI.
• Openprovider (Hosting Concepts B.V., Netherlands), each extension’s registry (for example, NIC México or Verisign) and ICANN: domain registration, renewal and transfer. Under the registry’s policies, some registrant data may be published in WHOIS/RDAP services.
• Openprovider and the certificate authority that issues your certificate (Sectigo): SSL certificate issuance and validation. To order it we register the chosen legal entity as a contact at Openprovider, with its address, email and phone.
• Competent authorities, when required by law or a duly grounded order.

In addition, the following providers process data on our behalf, as processors, under our instructions and without being able to use it for their own purposes: DigitalOcean (platform and hosting servers, United States), Vultr (VPS infrastructure, in the region you choose) and Google (Sign in with Google, form protection with reCAPTCHA and, with your consent, Google Analytics). Transactional email is sent from our own servers. Some of these providers are outside Mexico; in those cases we require protection measures equivalent to those in this notice.

Only if you accept it in the cookie notice, we transfer to Google (Google Ads) and Meta Platforms (Facebook and Instagram, United States and Ireland) the technical data of your visit (pages viewed, cookie identifiers, IP address and browser) and, if you buy, the amount and services of your purchase, to measure how many visits and purchases our ads bring. These third parties also process that information under their own privacy policies. We do not send them your name, email or payment details.

06ARCO rights and withdrawal of consent

You have the right to access your personal data, rectify it if inaccurate, cancel it and object to its processing (ARCO rights), and to withdraw any consent you gave us. You can see and correct much of your data directly in the portal. To exercise your rights, send a request to the email in the “Data controller” section including:

• Your name and an address or channel to receive our answer.
• A document proving your identity or, if acting through a representative, their identity and authority.
• A clear description of the data concerned (except for access requests) and of the right you exercise or what you request.
• For rectification, the changes requested and supporting documents.
• Any other document that helps locate your data.

We will communicate our answer within 20 business days of receiving your request at most and, if it applies, carry it out within the following 15 business days; these periods may be extended once for an equal period when circumstances justify it (article 31 of the law). Exercising your rights is free; only shipping or copying costs could be charged.

Cancellation or objection may not apply when the data is needed to meet legal obligations (for example, keeping tax records for the period required by the Federal Tax Code) or the current contract. Withdrawing consent for necessary purposes may mean we can no longer provide the service.

07Options to limit use or disclosure

Besides your ARCO rights, you can limit the use of your data by unsubscribing from promotions, declining analytics and ad measurement cookies, deleting your saved cards, removing contacts or members from your account, or asking us by email to stop using your data for an additional purpose. We will record your request to honor it.

08Cookies and similar technologies

If you accept it in the cookie notice, the site uses Google Analytics to collect aggregated statistics (pages visited, visit duration, device type, browser and approximate location) and ad measurement cookies from Google and the Meta Pixel, to learn which Google, Facebook and Instagram ads bring visits and purchases. We do not use them to show you personalized Google ads. These cookies are only set with your consent; if you decline, the site works the same.

Google reCAPTCHA protects our forms by analyzing technical information about your device and interaction with the page; Sign in with Google uses Google’s own cookies.

If you arrive through a referral or promotion link (with ?ref, ?promo or utm parameters), we keep the functional hs_attr cookie for 30 days with the code and campaign, so we can apply your discount and credit the referral when you create your account. It is not shared with third parties.

The portal uses strictly necessary session cookies to keep you signed in securely, and stores your language and display preferences in your browser. When you save a card or pay, Openpay’s script generates a device identifier to prevent fraud.

You can change your site cookie choice at any time; withdrawing consent deletes the analytics and ad measurement cookies.

09Security and retention

We apply administrative, technical and physical security measures: encrypted connections (HTTPS), passwords stored with irreversible algorithms, optional two-step verification, encryption of initial service passwords, staff access limited by role and audit logs. Card data is safeguarded by Openpay under the PCI DSS standard.

We keep your data while you have an account or services with us and, afterwards, for as long as needed to meet legal obligations (tax and accounting records, at least 5 years under the Federal Tax Code) or to handle possible claims. After those periods, we delete or anonymize it.

If a security breach significantly affects your rights, we will inform you without delay so you can take action.

10Changes to this notice

We may change this notice due to legal requirements or changes in our services or practices. We will publish the version in force on this page with its last-updated date and, if the change is significant (for example, new purposes or recipients), notify you by email or in the portal.

11Authority

If you believe your right to personal data protection has been violated, you may go to the Secretaría Anticorrupción y Buen Gobierno, the authority responsible for enforcing the law, under the terms and deadlines it sets.