Last updated: 7 November 2026
BS Hosting UG (haftungsbeschränkt)
Forsthauswinkel 6
45891 Gelsenkirchen
Deutschland
Represented by: Björn Schleyer
Email for data protection requests: privacy-policy@bs-hosting.de
Further details: Imprint
BoltLayer is a brand of BS Hosting UG (haftungsbeschränkt). BS Hosting UG (haftungsbeschränkt) operates several hosting brands on a shared technical platform. Customer accounts are kept separately for each brand; the data of a customer account is not visible to other brands. Our team manages all brands centrally.
We only process personal data to the extent necessary to provide our website, our customer area and our services, or if you have consented. The legal bases are:
Types of data processed: master data (name, address, company, date of birth if provided), contact data (email, phone), contract data (products, terms, prices), payment data (balance, transactions, bank details for direct debit), content data (tickets, attachments, data on booked products), usage and log data (IP addresses, times, browser information). There is no automated decision-making within the meaning of Art. 22 GDPR.
The website and the customer area run on our own servers in data centres in Germany (Frankfurt am Main and Düsseldorf). When you visit, our servers process the IP address, date and time, the page requested, the referrer and the browser identifier in order to deliver the pages and fend off attacks (Art. 6 (1) (f) GDPR). We delete server logs after 14 days at the latest unless they are needed to investigate a security incident.
We fend off attacks on our network (e.g. DDoS) with filter systems in our data centres; connection data is only evaluated automatically and briefly.
We load the website’s fonts, scripts and icons from our own servers; no content is loaded from Google Fonts or similar services. We do not use third-party analytics or advertising trackers.
To understand which pages and products are in demand, we count page views ourselves on our servers, without cookies and without third-party services (Art. 6 (1) (f) GDPR). We store the page requested, date and time, the domain of the referring page, campaign details from the address, language, device type, browser and operating system, as well as country, region and city, which we derive from the IP address using a local database. We do not store the IP address itself for this. To count visits, we create a short value from the IP address and browser identifier together with a random value generated anew each day; the random value is deleted the next day, after which the short value can no longer be attributed to anyone. Only our team sees the evaluation, as totals.
We only use technically necessary cookies (§ 25 (2) no. 2 TDDDG, Art. 6 (1) (b) and (f) GDPR):
All login cookies are protected against access by scripts and are only transmitted encrypted.
For the customer account, we process the details from registration and your profile, your password (only as a secure hash) and, if two-factor login is enabled, the related secret and the recovery codes (Art. 6 (1) (b) GDPR). We send a confirmation email when you register. We store the language in which you registered or last logged in with the account so that emails and notifications reach you in that language.
For each login, we store the IP address, time and browser identifier so that you can see and end active sessions and we can detect misuse. For the overview of sessions in the customer area, we derive browser, operating system and device type from the browser identifier, determine the approximate city and country from the IP address using a local database (the IP address is not passed to anyone for this) and store the sign-in method (password, passkey or linked account) and the time of last activity. We delete these login logs after 7 days, or immediately when you sign out a session. We briefly store failed login and password reset attempts with the IP address (up to 24 hours) to limit attacks by trying out passwords (Art. 6 (1) (f) GDPR).
We log important actions in your account with time, customer number and in some cases the IP address so that we can trace them in case of queries, disputes or misuse (Art. 6 (1) (b) and (f) GDPR). This includes changes to login and security (password, two-factor authentication, email address, linked accounts, profile), actions on your products (e.g. order, reinstallation, package change, suspension) and changes made to your account by our team. You can see these entries in the customer area. We delete entries on login and security after 1 year and the others after 3 years.
When you add a passkey, we store its public key, an identifier of the key, the name you choose, the domain it is valid for, a device type identifier (AAGUID, not linked to your person), a signature counter and the times it was set up and last used (Art. 6 (1) (b) GDPR). Fingerprint, face image, device PIN and the private key never leave your device and are neither received nor stored by us. If you remove a passkey in your profile, we delete it immediately.
When you register, change or reset your password and when you sign in, we check whether your password appears in known data breaches to protect your account from takeover (Art. 6 (1) (b) and (f) GDPR). To do so, we create a hash of the password on our server and send only its first 5 characters to the "Pwned Passwords" service of Have I Been Pwned (Superlative Security Pty Ltd, Australia). The service replies with all known hashes beginning that way, and we do the comparison ourselves. Your password, the full hash, your IP address and details of your account are not sent to the service; the 5 characters reveal neither your password nor your identity. We only store whether there was a match (as a notice in your customer area).
We protect forms with our own captcha without external services.
If a team member switches into your account to help you or to provide products, this is logged.
You can link your customer account to an account with Google (Google Ireland Limited, Ireland), GitHub (GitHub, Inc., USA), Facebook (Meta Platforms Ireland Limited, Ireland) or Discord (Discord Inc., USA) and log in with it. You are redirected to the provider; from there we receive your account identifier, email address and, if applicable, your name, and store the identifier for assignment. The legal basis is your consent (Art. 6 (1) (a) GDPR), which you can withdraw by unlinking the account in the customer area. If two-factor login is active, we also ask for the code with this login. Our server retrieves your profile picture from the provider and caches it; your browser does not connect to the provider for this.
For providers in the USA, the transfer is based on the EU-US Data Privacy Framework if the provider is certified, and otherwise on standard contractual clauses. The provider’s privacy notice applies to processing by the provider: Google, GitHub, Facebook, Discord.
If you link your Discord account to your customer account via our Discord bot, we store your Discord ID in order to assign you suitable roles on our Discord server and to match support requests (Art. 6 (1) (a) GDPR). You can remove the link at any time. On the Discord server itself, Discord’s privacy notice also applies.
We use Discord for internal notifications to our team (e.g. new orders, payments, dunning). In doing so, we mainly transmit customer and product numbers and, where necessary for processing, individual details such as domain, subject or email address. These messages are only visible to our team.
For orders, renewals and provisioning, we process master, contract and payment data (Art. 6 (1) (b) GDPR). Orders are also possible via our application programming interface (API); we log the requests with time, API key used and IP address for billing, troubleshooting and prevention of abuse.
Depending on the product, we pass the necessary data on to the following recipients:
Resellers can set up webhooks via the API. We then send events about their products (e.g. product provisioned, suspended, low balance) to the address specified by the reseller. The reseller is responsible for the processing there. In the API test mode (sandbox), no real orders or data are passed on to third parties.
If businesses conclude the data processing agreement in the customer area, we store the signed text with checksum, name, signature (as an image), IP address, browser identifier and time as proof (Art. 6 (1) (c) and (f) GDPR) for as long as the agreement applies and thereafter until the limitation period expires (3 years).
We only process data that you store on booked products yourself on your behalf. For businesses, the data processing agreement (DPA) applies, which you can conclude in the customer area under Settings → DPA.
We process payments and top-ups via payment service providers, which process the payment data as independent controllers (Art. 6 (1) (b) GDPR). We only receive the details needed for matching (e.g. transaction number, amount, status, for direct debit the name and IBAN of the account holder):
The payment service providers may carry out their own checks to prevent fraud. You can see which payment methods your brand offers in the customer area.
We create and manage invoices with accounting software, depending on the brand Lexware Office (Haufe Service Center GmbH, Freiburg) or orgaMAX (Deltra Business Software GmbH & Co. KG, Paderborn). For this, we transmit the billing address, contact data and invoice items as processing on our behalf (Art. 6 (1) (b) and (c) GDPR). We keep invoices and accounting records for eight to ten years in accordance with § 147 AO and § 257 HGB.
If businesses from another EU member state provide a VAT identification number, we verify it via the European Commission’s VAT Information Exchange System (VIES) and store the result (Art. 6 (1) (c) GDPR).
We match open invoices with incoming payments. If an invoice remains unpaid, we send payment reminders and dunning notices and, if necessary, suspend the affected products (Art. 6 (1) (b) and (f) GDPR). For resellers and business customers with a credit limit, we process the agreed credit limit. For products billed by the hour, we store usage per hour for billing.
If you redeem a voucher or promotional code, we store the redemption with your customer account in order to check the redemption conditions.
If you visit our website via a partner link, we store the identifier of the referring customer in your session cookie and the visit with your IP address to avoid counting it twice. If you then register, we assign your account to the referring customer so that they receive their credit; they do not see your contact details (Art. 6 (1) (f) GDPR).
Cooperation partners appear publicly on our partner page with project name, logo, website, social media links and the texts they have provided (Art. 6 (1) (b) GDPR). The partner can change this information in the customer area; when the partnership ends, we remove the profile from the page.
If you contact us via the contact form, email, phone or ticket, we process your details and uploaded attachments to handle your request (Art. 6 (1) (b) or (f) GDPR). We store ticket attachments on our own servers. For contact requests, we also store the language of the page so that our reply reaches you in your language.
We send emails via our own mail server. You receive system messages about your contract (e.g. order confirmations, invoices, expiry notices, dunning notices) for as long as you have products with us.
If you subscribe to the newsletter during registration or in the customer area, we send you news, offers and promotions from BoltLayer by email (Art. 6 (1) (a) GDPR). The subscription only takes effect once you confirm it via the link in our confirmation email (double opt-in); during registration, this is done with the link that activates your customer account.
As proof of your consent, we store the time, your IP address, the browser identifier and the wording of the consent for every subscription and unsubscription (Art. 6 (1) (c) and (f) GDPR in conjunction with Art. 7 (1) GDPR). We send the newsletter via our own mail server; we do not track whether you open it or click links.
You can withdraw your consent at any time with effect for the future: in the customer area under Profile, via the unsubscribe link in every newsletter or the unsubscribe function of your email program. Emails about your contracts are sent regardless.
In the customer area, we record technical errors with a self-hosted Sentry instance. The error message, the page requested, browser details and shortened connection data are stored on our servers and deleted after 90 days at the latest (Art. 6 (1) (f) GDPR).
If an action in the customer area fails at one of our service providers, we show you an error number and store the technical error message, your customer number and the page requested under that number so that our support can trace the error (Art. 6 (1) (b) and (f) GDPR).
We use LIVCK for our status page; no customer data is transmitted there.
If you use our forms to withdraw from or terminate a contract, to report illegal content (Digital Services Act), or if an authority sends a removal order, we store your details (name, email address, affected contract or content, your message), the IP address and the time of receipt as a case, confirm receipt by email and inform our team (Art. 6 (1) (b), (c) and (f) GDPR). For notices under the Digital Services Act, the affected customer learns the reasons for a decision, but not the name and contact details of the person reporting, unless this information is indispensable for the review or required by law. We keep the cases until the limitation period expires (3 years after completion); we keep removed terrorist content for six months in accordance with Art. 6 of Regulation (EU) 2021/784.
If you apply for an advertised position, we receive your documents by email at the address stated in the job advertisement. We only use them for the application process (§ 26 BDSG, Art. 6 (1) (b) GDPR) and delete them at the latest six months after it has ended, unless you have consented to longer storage or an employment relationship is established.
So that our team can first take care of accounts with open problems, we internally calculate a customer status from payment behaviour (open or overdue invoices, balance), number of products, open tickets and the time of the last login (Art. 6 (1) (f) GDPR). The status is only visible to our team and serves as an indication; decisions with legal effect, such as suspensions or terminations, are always made by a person. For our business figures (e.g. revenue, number of products), we only evaluate aggregated values.
We maintain profiles on social networks. Links to them lead via an intermediate page (/go/…) that points out the change before you leave our website; we do not pass any data on to the network. The privacy notice of the respective network applies on the profiles.
Our services are aimed at persons aged 14 and over. For minors, we may request the consent of the legal guardians and proof of age; we only use this proof for the check and delete it afterwards. Information for parents can be found on our page Information for parents.
In addition to the recipients named above, we use processors for data centre and infrastructure, with whom agreements under Art. 28 GDPR exist. Data is only transferred to countries outside the EU or EEA if there is an adequacy decision (e.g. EU-US Data Privacy Framework), appropriate safeguards (standard contractual clauses) or an exception under Art. 49 GDPR. We do not sell personal data.
We delete personal data as soon as it is no longer needed for the purpose. In particular:
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent given at any time with effect for the future. You can also download information about your data yourself as an export in the customer area. Please send requests to privacy-policy@bs-hosting.de.
You can lodge a complaint with a data protection supervisory authority, in particular in the member state of your residence or with the authority responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.
We adapt this privacy policy when our processing or the legal situation changes. The version published here applies.