Who is responsible for what
- Console account data (a customer’s name, email, connected servers, settings and activity): Rubuz LLC is the controller. The customer agrees to the Rubuz One terms with us directly.
- Data on a customer’s servers (their apps, databases, files and their own users’ data): the customer is the controller. Rubuz One acts only on the customer’s instructions, as a processor, for the tasks the customer sets up.
- Sales and billing data (what a provider charges its customer, invoices and payments): the hosting provider is the controller, under its own privacy policy.
- Hosting provider business data (the provider’s contacts, agreement and what it buys from us): Rubuz LLC is the controller.
What we share with the hosting provider
So that a provider can sell and bill Rubuz One, we share with it a customer’s name and email address, plan, and which of its VPSs are connected. We share nothing from the customer’s servers, and no apps, settings, metrics or credentials.
Why we process data
- To provide the service to customers and providers (performance of a contract).
- To keep accounts secure: sign-in records and abuse limits (legitimate interest).
- To meet tax and accounting law for what providers buy from us (legal obligation).
We do not sell personal data, and we do not use it for advertising.
Where data is processed
Rubuz One runs in Frankfurt, Germany, inside the EU. That is where console account data is processed.
A few providers help us run the service, each only for its one job: hosting and a managed database, network and security services, and email delivery. Each is bound by a data processing agreement, and transfers outside the EU are covered by Standard Contractual Clauses. Hosting providers get the full list of sub-processors with our DPA, and we tell them before adding a new one.
Data Processing Agreement
We sign a Data Processing Agreement with every hosting provider that sells Rubuz One, including the Standard Contractual Clauses, and with any business customer that asks for one.
Rights of customers
A customer can access, correct, export and delete their console account data, restrict or object to how we process it, and complain to their data protection authority. Email us and we answer within 30 days. For sales and billing data, the customer asks their hosting provider.
Retention
We keep console account data while the account exists, and delete it when the account is deleted. Removing a server deletes its access key and records. We keep a hosting provider’s records for as long as its agreement with us lasts, and billing records only as long as tax law requires.
Contact us
Questions, requests and DPAs: hello@rubuz.com.