1. Data Controller

The controller of personal data is:

Róbert Mihálik, Studenohorská 2077/36, 841 03 Bratislava – Lamač district, Slovakia, Company ID (IČO): 52155218, e-mail: info@noronetwork.cloud (hereinafter “we” or the “Controller”). We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Act No. 18/2018 Coll. on the Protection of Personal Data.

2. Controller and Processor

When providing hosting services, we act in two different roles:

• Controller — for data of our customers and website visitors (billing details, contacts, operational logs). This Policy relates to this role.
• Processor — for data that our customers store and process within their own websites, e-mail accounts, and VPS instances.

Our customer is responsible, as controller, for such data; we process it solely on their instructions based on a data processing agreement (Article 28 GDPR), which forms part of our contractual documentation. If you are a data subject whose data is stored on the website or in the service of our customer, please direct your rights requests to that customer (the controller of the given website/service).

3. What Data We Process, For What Purpose, and On What Legal Basis

Establishing and providing services (performance of a contract — Art. 6(1)(b) GDPR)

• Identification and contact details: first and last name / business name, address, Company ID/Tax ID, e-mail, phone.
• Data on ordered services, customer account access credentials, communication with customer support.
• For domain registration: Customer data to the extent required by the registrar and the relevant registry (if the Customer is listed as the domain holder or contact person). Retention period: for the duration of the contract and 10 years after its termination (limitation periods for asserting legal claims).
  Invoicing and accounting (legal obligation — Art. 6(1)(c) GDPR)

• Billing information and tax documents pursuant to accounting law and tax regulations. Retention period: 10 years following the year to which the documents relate.
  Security and infrastructure operation (legitimate interest — Art. 6(1)(f) GDPR)

• Operational and security logs: IP addresses, access times, server requests, login records, e-mail operational logs (metadata, not message content).
• Purpose: ensuring the security of the network and services, detecting and blocking attacks and misuse, diagnosing faults. Our legitimate interest is the protection of the infrastructure and services. Retention period: 6 months; security incidents until resolved.
  Marketing communication (legitimate interest / consent)

• We may send existing customers e-mails with information about our own similar services (legitimate interest, § 116 of Act No. 452/2021 Coll. on Electronic Communications); this can be declined at any time via each message or by e-mail.
• We send marketing messages to other persons only with their consent (Art. 6(1)(a) GDPR), which can be withdrawn at any time. Retention period: until refusal/withdrawal of consent.
  Contact form and pre-contractual communication (Art. 6(1)(b) GDPR)

• Data from inquiries and the contact form (name, e-mail, message content). Retention period: 1 year from resolution, if no contractual relationship arises.
  Website analytics (consent — Art. 6(1)(a) GDPR)

We use the Matomo analytics tool, which we operate on our own infrastructure within the European Union, to measure traffic and improve our websites. Matomo runs in cookieless mode — it does not store cookies or any other identifiers on your device. Data processed: anonymized (truncated) IP address, pages visited, time of visit, browser and device type, and approximate location derived from the anonymized IP address. Individual visitors cannot be identified from this data. Analytics data is not shared with any third party and does not leave our infrastructure.

Legal basis: our legitimate interest in measuring and improving our websites (Art. 6(1)(f) GDPR). As no information is stored on or read from your device, consent under § 109(8) of Act No. 452/2021 Coll. on Electronic Communications is not required. You may object to this processing at any time using the opt-out form below. Raw visit data is deleted after 180 days.

4. Who We Share Data With (Recipients)

We do not share data with third parties for their own purposes.

Recipients may include:

• Domain registrar Gransy s.r.o. (subreg.cz, Czech Republic) and the relevant domain registries (e.g., SK-NIC, a.s. for .sk) — to the extent necessary for domain registration and management, if the Customer’s data is listed for the domain; the registrar and registry act as independent controllers.
• Payment service provider / bank — for payment processing.
• Infrastructure: services, including e-mail servers, are operated on our own infrastructure located in a certified Tier III data center in Bratislava. The data center operator provides only server colocation, power, cooling, and physical security — it has no access to data content or our systems and does not process personal data on our behalf. Backups and operational/security logs (point 3.3) are processed at our other own secured locations in the Slovak Republic; transfers between locations are encrypted. Internet connectivity is provided by an electronic communications company that solely transmits data and has no access to its content.
• OVHcloud (OVH sp. z o.o., Warsaw, Poland) — hosting of the virtual server running the status page status.noronetwork.sk; only technical access logs for the status page (IP addresses) are processed on it, no customer or billing data. The server is located in the EU.
• Public authorities, if required by law or an enforceable decision.

Analytics data (Matomo) is processed exclusively by us on our own infrastructure and is not shared with anyone.

5. Transfer to Third Countries

We process personal data on our own infrastructure within the European Union and do not transfer it to third countries. An exception may be domain registration in a TLD whose registry is based outside the EU — in such a case, the transfer takes place pursuant to Art. 49(1)(b) GDPR (necessity for performance of a contract).

6. Data Security

We have adopted appropriate technical and organizational measures in accordance with Art. 32 GDPR, in particular: encryption of transmissions (TLS), access and authorization management, separation of customer environments, firewall and traffic monitoring, regular security updates of systems, and backups for operational recovery purposes.

7. Your Rights

As a data subject, you have the right to:

• access your personal data (Art. 15 GDPR),
• rectify inaccurate data (Art. 16),
• erasure (“right to be forgotten,” Art. 17),
• restrict processing (Art. 18),
• data portability (Art. 20),
• object to processing based on legitimate interest, including direct marketing (Art. 21),
• withdraw consent, if the processing is based on consent; withdrawal does not affect the lawfulness of processing carried out before withdrawal.

You may exercise your rights by e-mail at gdpr@noronetwork.cloud. We will respond without undue delay, no later than within one month.

If you believe we are processing your data unlawfully, you have the right to lodge a complaint with the supervisory authority: Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, www.dataprotection.gov.sk.

8. Cookies

The website noronetwork.cloud uses:

• Necessary (technical) cookies — required for the website to function, for the cookie banner, and for logging into the customer account; these do not require consent.
• Analytical cookies — cookies from our self-hosted Matomo tool (_pk_id, _pk_ses); we use these only with your consent given via the cookie banner on your first visit. You can withdraw or change your consent at any time.

Details of analytical processing are set out in point 3.6 of this Policy.

9. Automated Decision-Making

We do not carry out automated individual decision-making or profiling with legal effects on data subjects.

10. Changes to This Policy

We may update this Policy; the current version is always published at noronetwork.cloud. We will inform customers by e-mail of any material changes.

Effective from: July 4, 2026