rechtliches
Data Privacy

Data Privacy

Privacy policy

1. General information

This privacy policy informs you about the processing of personal data in connection with our websites and online presences.


2. Who is officially responsible for processing the data?

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen
Germany

You can find more information about our company in our Legal Notice page.


3. Who can you contact if you have questions regarding data protection?

You can reach out directly to our data protection officer using one of these methods:

Email: data-protection@hetzner.com

Post:
Hetzner Online GmbH
Datenschutz
Industriestr. 25
91710 Gunzenhausen
Germany

Phone: +49 (0)9831 505216

Fax: +49 (0)3745 744472361


4. How do we process your personal data?

Note: Unless otherwise specified, your data will remain within the EU and will not be passed on to third parties.


What data will be processed and how does it reach Hetzner?

The type of data that we process may change a bit depending on the job you are applying for and its requirements. We process: basic personal information, career-conditions (e.g. notice period), education and work experience, professional knowledge, attached documents / attachments, if applicable, special categories of data (e.g. if you have a disability or special needs), information about your interview and notes on it, and additional information shared with us during the application process.
We will obtain this data directly from you or – if a recruitment agency is involved – directly from the agency.


Why does Hetzner process my data and what is the legal basis for it?
  • Conclusion of an employment contract:Reviewing and processing your application. The goal is to sign an employment contract. (Art. 6 para. 1 lit. b GDPR)
  • Ensuring your protection rights: Processing special categories of personal data to protect your legal rights. (Art. 9 para. 2 lit. b GDPR in connection with Art. 6 para. 1 lit. b GDPR)
  • Inclusion in our talent pool: Storage of your documents for future positions in the company on the basis of your voluntary consent (Art. 6 para. 1 lit. a GDPR). You can revoke your permission at any time by reaching out to our personnel team at: career@hetzner.com
  • Legal documentation: Storing the data to protect against potential legal claims or to assert them if necessary. (Art. 6 para. 1 lit. f GDPR)

How will my application data be managed?

All applications are entered into our applicant management system. If you applied by post, we will digitize your documents and return the originals to you.
To process your application, a candidate profile will be created in the system. You will not have access to this profile.


Who will have access to my data and will it be sent to any third parties?

We use external software from Rexx for the application management system. This company acts as a service provider for us. They may access your data as part of maintaining the systems. We have concluded a data processing agreement (DPA) with this provider, which ensures that the data is processed only according to our instructions and in compliance with applicable data protection regulations.
You can find more information in Rexx’s (Rexx Systems GmbH, Süderstrasse 75-79, 20097 Hamburg, Germany) privacy policy: https://www.rexx-systems.com/datenschutz/.
If your application does not match a position at Hetzner Online, we may check whether another company in our group (Hetzner Cloud GmbH, Hetzner Finland Oy) might be interested in your profile and whether sharing your application would benefit your career opportunities. Your documents will only be shared if the position is equivalent or similar to the one you applied for. (Art. 6 para. 1 lit. f GDPR)
If you do not agree to this, you can object at any time. Please contact our HR team: career@hetzner.com.


How long will my data be saved?

The length of time your data will be stored can vary depending on the results of your application process:


  • Rejection or withdrawal of the application: Six months after the rejection or withdrawal of your application.
  • Storage in our talent pool: 24 months. You can revoke your permission for this at any time. Please contact our HR team to do so: career@hetzner.com
  • You become an employee: Your personal data will become part of your employee file.

Once the deadlines are reached, we will delete your data.


Our website www.hetzner.com" includes the AI-chatbot “Ask AI”. It can help to answer your general questions about our products, based entirely on information that Hetzner has created itself, for example, information on Hetzner Docs.
For account-specific support, please submit a support request at https://accounts.hetzner.com.


What data will be processed and how does it reach Hetzner?
General

The chatbot collects and uses any and all information that you provide it with. You do not need to provide any personal data.

To increase the protection and security of your data, we use a tool that automatically detects personal data. (Hereafter, we will refer to this tool as the “PII tool”; “PII” is short for personally identifiable information.) If you (accidentally) enter personal data in the chatbot, the tool will automatically recognize it and respond by asking you to enter your request/question again, but this time without personal data.

Cookies

To use the chatbot, you must accept all cookies. The following cookies are used:

Log files

When the chatbot is used, log files are automatically created on the provider’s servers. These include: date and time of access, status message, and the accessed URL.


Why does Hetzner process my data and what is the legal basis for it?

We process your data to provide and secure the chatbot service. (Art. 6 para. 1 lit. f GDPR).


Who has access to the data and is it shared with third parties?

Due to the use of the PII tool, your data may be transferred to a server of our AI chatbot provider Kapa.ai Inc. (1625 North Market Boulevard, Suite N 112, Sacramento, CA 95834, USA) and processed there. For more information: https://policies.google.com/privacy.
The transfer is based on legal safeguards for international data transfers.

Kapa.ai uses the enterprise version of ChatGPT (OpenAI OpCo LLC, 1960 Bryant Street, San Francisco, CA 94110, USA), which does not store personal data. More information: https://openai.com/enterprise-privacy

Google cookies result in a transfer to Google Inc. (1600 Amphitheatre Parkway, Mountain View, California 94043, USA). See: https://policies.google.com/privacy

Log files are stored on Kapa.ai servers.


How long will my data be saved?

PII content is deleted immediately.

The session cookie is deleted when the browser is closed. Other cookies are subject to Google’s policies.

Log files are stored for a maximum of 30 days.


What data is processed and how does it reach Hetzner?

If you voluntarily provide feedback after a support interaction, we process your ticket number and the content you enter in the free text field. The disclosure of your personal data as part of the feedback is voluntary


Why is the data processed and on what legal basis?

We use the feedback to continuously improve and optimize our (customer) services. (Art. 6 para. 1 lit. f GDPR)


How long will my data be saved?

The data are stored for 2 years. After this period, they will be anonymized.


In our forum Forum users can discuss about technical topics and our services.


What data will be processed and how does it reach Hetzner?

If you register for our online forum, we store the username you choose and your email address.


Why does Hetzner process my data and what is the legal basis for it?

The forum serves as a communication platform for our community members. (Art. 6 para. 1 lit. f GDPR)


How long will my data be saved?

After you delete your forum account, your data will also be deleted immediately.


What data will be processed and how does it reach Hetzner?

If you participate in one of our prize draws, we process – depending on the type of prize draw – the following data: your first and last name, email address, postal address, and, if applicable, your social media username. This data is provided directly by you, e.g. via a form on our website or by interacting with our social media posts.


Why does Hetzner process my data and what is the legal basis for it?

We need this data to carry out the prize draw, and to notify the winners. (Art. 6 para. 1 lit. b GDPR)


How long will my data be saved?

After the prize draw has ended and the prizes have been sent, we delete the related personal data.


What data is processed and how does it reach Hetzner?

When creating a customer account, we process the name, contact details, and payment information that you provide to us. Your IP address is also automatically transmitted via your browser.

If you are invited to a cloud project, we store only your email address.


Why does Hetzner process my data and what is the legal basis for it?

We process your data to create and manage your customer account This is necessary to give you access to our products and services. (Art. 6. para. 1 lit. b GDPR)


Who has access to the data and is it shared with third parties?

We do not collect or store any credit card information. You enter this information directly to our external payment provider Computop. For more information, please refer to the privacy notice of Computop Paygate GmbH (Schwarzenbergstr. 4, 96050 Bamberg, Germany): https://computop.com/us/data-protection.

To make future payments easier, a pseudocard number is saved in your customer account.

If we register a domain for you, we pass on the necessary data to the respective registry (depending on the domain).

If you fail to pay despite repeated reminders, we may instruct the debt collection company Intrum to collect the outstanding debt. Intrum acts as an independent controller. For more information, please refer to the privacy notice of Intrum Deutschland GmbH (Donnersbergstraße 1, 64646 Heppenheim, Germany): https://www.intrum.de/zahlungserinnerung-erhalten/uber-intrum/datenschutz/.


How long will my data be saved?

After a customer account is deactivated, the following retention periods apply:

  • Without product usage: 3 years
  • With product usage (invoicing): 14 years (in accordance with tax and commercial law retention obligations)
  • Unverified customer accounts: 14 days after the end of the failed verification period
Once these periods have expired, your data will be deleted.

In our newsletter Newsletter], we inform you about new products and current topics.
If you want to be added to the mailing list as a recipient, you must confirm this via a confirmation email.
Your address will only be added to the list if the confirmation is completed (double opt-in).


What data is processed and how does it reach Hetzner?

Sign up
If you sign up for our newsletter, we process your email address. Your browser also automatically transmits your IP address at the time of registration, and the date of your registration is recorded in the background.

Newsletter delivery
We store technical delivery data, including information about bounces or other delivery issues.

Tracking
To improve our newsletter and better tailor it to our readers' interests, we use tracking technologies. We use tracking pixels for this purpose. These are loaded from the server of our newsletter provider when you open the newsletter. We collect: Whether and when you opened the newsletter (open rate and time of opening), how often you open the newsletter, which links in the newsletter you click and how often (click behaviour and click rate).


Why is the data processed and on what legal basis?

The data is processed so that we can send you the newsletter and optimize its content. This is given as part of the registration for the newsletter. (Art. 6 para. 1 lit. a GDPR)
You can withdraw your consent at any time to receive future newsletters by unsubscribing from the newsletter: https://www.hetzner.com/newsroom/newsletter/.


Who has access to the data and is it shared with third parties?

We use the external service provider Sendinblue to manage and send the newsletter. We have signed a DPA with this provider. For more information, see the privacy notice of Brevo GmbH (Köpenicker Straße 126, 10179 Berlin, Germany): https://www.brevo.com/legal/privacypolicy/.


How long will my data be saved?

  • Tracking data is stored for 2 years from the time it is collected.
  • If you unsubscribe or if there are technical delivery issues, your data will be kept for up to three years.
After the respective period, the data is anonymized.

You can find general status reports on our products and services via our status.


What personal data is processed and how does it reach Hetzner?

When you sign up for notifications, you provide us with your email address.


Why and on what legal basis is the data processed?

We process your data in order to notify you about service disruptions and maintenance activities. (Art. 6 para. 1 lit. b GDPR)


How long is the data stored?

The data is deleted as soon as you unsubscribe from the notification service.


We are active on various social media platforms to communicate with you as a customer or interested party and to inform you about our services.


Mastodon

We run our own Mastodon instance (https://mastodon.hetzner.social). It is used exclusively by employees of Hetzner Online GmbH. Registration by external users is not possible.
The following information applies to non-registered users – meaning you as a visitor to our Mastodon page.


What data will be processed and how does it reach Hetzner?
General access data

When you visit our instance (e.g. our profile or posts), your browser automatically sends the following data: IP address of your device, date and time of access, URL of the page you visited, name of the file you accessed, your operating system, your browser type and version.

Cookies

Our instance uses ession cookies that are necessary from a technical standpoint. These contain: a session ID, the creation date of the cookie, the path that defines where the cookie is active on our page.

Interaction with us

If you interact with us (e.g. by replying to our posts or mentioning us), we also process the following data: your username, information from your publicly visible profile, the content of your message or interaction (such as replies, mentions, or direct messages).


Why does Hetzner process my data and what is the legal basis for it?

We process your data:

  • as part of our public communications (Art. 6 para. 1 lit. f GDPR)
  • to securely and reliably provide and maintain our Mastodon instance (Art. 6 para. 1 lit. f GDPR)
  • to use cookies that are necessary for the basic functionality of our Mastodon page (§ 25 para 2 No. 2 TTDSG).

Who has access to your data and is it shared with others?

Due to Mastodon’s federated structure – meaning global networking with other servers – it is possible that some content or metadata is transferred to servers outside the EU, for example, when you interact with users from other instances.


How long will my data be saved?

  • General access data: 7 days
  • Your interactions (e.g. replies or public comments): stored until you delete your account/li>
  • Direct messages: stored until your account is deleted - Please note: Your username may still be visible in our message overview even if the message content is no longer available
  • Session cookies: deleted automatically when you close your browser. We do not store these cookies separately or permanently on our servers.

Other social media channels

We also maintain profiles on other social media platforms. The privacy policies of the respective providers apply to these platforms, as we have no influence on how they process data.


Facebook

Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour Dublin 2, Irland.
Privacy Policy: https://www.facebook.com/about/privacy/
Opt-Out: https://www.facebook.com/settings?tab=ads.


Instagram

Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour Dublin 2, Irland.
Privacy Policy: https://instagram.com/about/legal/privacy/
Opt-Out: https://instagram.com/about/legal/privacy/


X

Provider: Twitter International Unlimited Company, One Cumberland Place, Fenian Street Dublin 2, D02 AX07 Irland.
Privacy Policy: https://twitter.com/de/privacy
Opt-Out: https://help.twitter.com/de/safety-and-security/privacy-controls-for-tailored-ads


YouTube

In addition to our presence on YouTube, we also embed YouTube videos.
Provider: Google Ireland Limited (Gordon House, Barrow Street Dublin 4. Irland)
Privacy Policy: https://www.google.com/policies/privacy/
Opt-Out: https://youtube.com/opt-out.


What data is processed and how does it reach Hetzner?

The data we process depends on the type of event and may include: name, contact details, and additional information such as food allergies, T-shirt size, or date of birth. We receive this data directly from you during the registration process.


Why does Hetzner process my data and what is the legal basis for it?

We process your data to organize and carry out your participation in the event. (Art. 6. para. 1 lit. b GDPR)


Who has access to the data and is it shared with third parties

As part of our events, we take photos and record videos. In this context, personal data may be shared with third parties.

We use these recordings for publication on our social media channels, in our internal communication media (Intranet, employee newsletter), and in our press releases.

If you do not agree to the publication of your image, you can let us know free of charge and without giving a reason by email to event@hetzner.com, or on the day of the event, directly at the registration desk. In this case, we will refrain from further publication, remove images from our social media accounts, or make you unrecognizable in the images.
Please note that photos and videos published on the internet may be stored and accessible worldwide. Even if removed later, they may already have been saved or shared by others, or indexed by search engines.


How long will my data be saved?

We at Hetzner will delete the data relevant to the event after the event is completely over.


4.11.1 Verification of customer details

To minimize our business risk and to prevent the misuse of our services, we carry out a check based on general risk factors when new customer accounts are registered.

Our system makes a prediction about how likely it is that you will meet your contractual payment obligations and use our services responsibly. The result of this preliminary check may influence whether we enter into a contractual relationship with you. During the assessment, the data you provide as well as technical characteristics are processed. This data is compared with our previous experience and evaluated with the help of an external service provider for risk analysis.

You have the right to request a review of the decision. Please contact cda-review@hetzner.com for this.


4.11.2 Identity Verification Using ID Documents

In some cases, especially if there are doubts about the accuracy of the data you provided or if the risk check shows unusual results, we may ask you to submit a valid ID document (e.g. national ID card or passport).


What data will be processed and how does it reach Hetzner?

To verify your identity, we may ask you to provide a alid ID document (e.g. passport or national ID card). The following data may be processed: name, address, date of birth, expiry date of the document.
You may black out or hide other information on the document that is not needed.


Why does Hetzner process my data and what is the legal basis for it?

We process this data to prevent fraud, protect our services, and ensure they are not misused. (Art. 6 para. 1 lit. f GDPR)
If the verification is required to provide or continue a service, the legal basis is also (Art. 6 para. 1 lit. b GDPR)


Who has access to the data and is it shared with third parties?

In some cases, the identity verification is not carried out by Hetzner directly, but by the certified external service provider iDenfy. If verification via such a provider is required, we will forward your name and the country you live in. This transfer only takes place after you click the verification link.

All further data collected by the provider is their own responsibility. Please refer to the data protection notice of the company iDenfy UAB (K. Baršausko g. 59, LT-51423 Kaunas, Lithuania): https://www.idenfy.com/privacy-policy/


How long is the data stored?

If verification is carried out by iDenfy, your data will be stored for two months.
In all other cases, the data will be deleted immediately after the verification is completed.

What data is processed and how does it reach Hetzner?

When you access our website, your browser automatically sends the following data: IP address, browser type and version, date and time of access, the website you came from, and the specific page accessed.


Why does Hetzner process my data and what is the legal basis for it?

We process this data to ensure the secure and stable operation of our website. (Art. 6 para. 1 lit. f GDPR)


How long is the data stored?

Since the IP address is stored in anonymized form, no retention period is required.


Website analysis (cookies)

What data is processed and how does it reach Hetzner?

If you consent to the use of all cookies when visiting our website, we use Matomo to analyze user behavior. Cookies are stored and the following data is processed: IP address, pages visited, time spent on each page, browser used, and the site you visited before ours. This data is automatically transmitted by your browser.

You can prevent the storage of cookies (both necessary and non-essential) by adjusting your browser settings. However, please note that doing so may limit functionality on our website.

You can later deactivate non-essential cookies via: .


Why does Hetzner process my data and what is the legal basis for it?

The data is collected to optimize our website. Processing is based on your consent (Art. 6 para. 1 lit. a GDPR).


How long is the data stored?

The IP address is stored in anonymized form. A personal reference is no longer possible.



5. What rights do I have when it comes to my data?

The GDPR grants you the following rights regarding your data:
  • Right of access:
    You can request information at any time about whether and which personal data we process about you.
  • Right to rectification:
    If the data we have stored about you is incorrect or incomplete, you can request its correction or completion.
  • Right to erasure ("right to be forgotten"):
    You can request the deletion of your data if it is no longer required for its original purpose. However, please note that immediate deletion may not be possible in some cases due to legal or contractual retention obligations.
  • Right to restriction of processing:
    If, for example, you dispute the accuracy of your data or believe that the processing is unlawful, you can request that we restrict the processing of your data.
  • Right to data portability:
    You have the right to receive your data in a structured, commonly used, and machine-readable format. You can also request that we transfer the data directly to a third party, if technically feasible.
  • Right to object:
    You can object to the processing of your personal data unless there are compelling legitimate reasons for the processing.
  • Right not to be subject to automated decision-making:
    We do not make any automated decisions regarding your person. If we did, you would have the right not to be evaluated solely by algorithms.

If you would like to make use of any of these rights, please contact our data protection officer directly.


6. Making complaints to the relevant data protection authority

If you believe that we are violating any data protection laws by processing personal data, you also have the right to make a complaint to the data supervisory authority who is responsible for our company.
However, we encourage you to first contact our data protection officer. We always strive to resolve any possible disagreements as quickly and smoothly as possible so that we can avoid conflicts.


7. Voluntary nature of data provision

There is no statutory obligation for you to provide your data to Hetzner Online GmbH. However, you cannot use some of our services if you do not provide your data to us. Your decision to provide us with your personal data is completely voluntary.


8. General note

We reserve the right to update this privacy policy from time to time. If you visit this page again, the updated privacy policy will apply.


Status: April 16, 2025