1. Scope and Applicable Law
This page explains our role when customers entrust personal data to our hosting, email and Swiss Backup services. Mercury Labs SAGL operates FuturaHosters.com at Via Industria 16, CH-6850 Mendrisio, Switzerland.
We address Swiss data protection requirements and the GDPR where it applies to the processing concerned. Using our services does not by itself make a customer compliant. Our Privacy Policy separately explains processing for our own account administration, payments, website and communications.
2. Customer and Provider Responsibilities
The customer determines the purposes and permitted use of personal data in customer-controlled content, or acts on behalf of the relevant controller. We process that content to provide the purchased service on documented instructions, subject to applicable agreements and law.
The customer is responsible for a lawful basis for its activities, required notices and permissions, and the security of applications and credentials under its control. We are responsible for protecting the infrastructure and service components we manage. Neither role removes the obligations of the other.
3. Swiss Hosting and Service Location
Email and Swiss Backup content is hosted on our proprietary infrastructure in Swisscom Tier IV datacenters in Switzerland. Backup contents are encrypted. The Acronis administration console associated with our service is hosted in a Swiss datacenter; Acronis receives technical operating data and has no access to customer backup contents.
These statements concern the identified services and must not be read as a promise that every category of data remains exclusively in Switzerland. Payment, domain and analytics processing involves separate recipients and may involve international transfers, as explained in our Privacy Policy. Other service locations must be established for the service concerned.
NordVPN is a third-party VPN subscription, not a service hosted on our Swiss Backup infrastructure. Its account and network processing must be assessed separately; choosing a Swiss VPN exit server does not establish that all related personal data is processed exclusively in Switzerland.
4. Security Measures
We maintain technical and organizational measures appropriate to the risks affecting the systems and data we manage. Measures include restrictions on authorized access, protection of infrastructure and communications, maintenance and security updates for managed systems, and handling of security incidents.
Customers must keep their own applications and plugins updated, protect access credentials and enable multi-factor authentication where available. Security responsibilities depend on the purchased service and the components each party controls. This page does not assert an independent certification, a fixed penetration-testing schedule or absolute security.
5. Backup Configuration and Retention
Swiss Backup customers control backup policies, retention, deletion and restoration while their service is active. They must monitor actual backup execution and check that their configuration meets their operational and legal needs.
Restoration is initiated by the customer using the available service bandwidth. Completion depends on data volume and technical conditions. Remaining service data is removed 30 days after effective deactivation; for non-payment, the period runs from suspension as specified in the Terms of Service.
This is separate from the retention of administrative account data described in our Privacy Policy. Customer-configured backup retention does not extend the post-deactivation period.
6. Service Partners and International Processing
The involvement of service partners must be assessed by function: hosting infrastructure, backup administration, domain registration, payments and website analytics do not all involve the same data or processing role.
The applicable data processing agreement should identify authorized subprocessors and the conditions for their engagement or replacement, including information and objection arrangements where required. Where data is disclosed abroad, applicable destinations and safeguards must be established. Refer to the Privacy Policy and request service-specific details through privacy@futurahosters.com.
For NordVPN, distinguish our order and billing administration, MarketConnect distribution and Nord's independent account and VPN processing. The provider's privacy notices describe that processing. Nord must not automatically be treated as a Swiss Backup subprocessor merely because both products are sold through the same portal.
7. Security Incidents and Assistance
If we become aware of a personal data security breach affecting content we process on a customer's behalf, we notify the relevant customer without undue delay and provide available information needed to assess the incident and fulfill applicable obligations. Information may be provided in stages as the investigation progresses.
We cooperate with requests concerning affected data, security and individual rights within our role and the applicable agreement. The controller remains responsible for deciding and fulfilling its own notification obligations to authorities or individuals. Suspected incidents should be reported promptly through the ticket system or to our privacy contact.
8. Data Processing Agreement
A public information page is not a substitute for a binding data processing agreement. Where we process personal data on your behalf, the applicable contractual arrangements must cover the processing concerned.
A service-specific DPA should describe the subject matter, duration, purposes, data categories and parties' roles, together with instructions, confidentiality, security, subprocessors, international transfers, incident assistance, requests from individuals, verification arrangements and return or deletion of data.
Contact privacy@futurahosters.com to discuss the agreement and documentation applicable to your service before entrusting data where such arrangements are required. This page does not claim that a particular DPA has already been signed or provide certification of your compliance.
An agreement covering our hosting or Swiss Backup processing does not automatically cover NordVPN. If the intended use involves personal data for which you require processing instructions, specific locations or a processor agreement, establish the applicable Nord arrangements and eligibility before using the service.
9. Frequently Asked Questions
Does Swiss hosting automatically ensure compliance?
No. Hosting location is one factor. The purposes, permissions, security, retention and actual use of personal data also matter.
Do you act only as a processor?
No. We act in a provider role for customer-controlled content and as controller for our own administrative processing, as explained in the Privacy Policy.
Who should handle a request about data hosted by a customer?
The relevant customer or controller normally handles the request. We assist within our role and applicable contractual and legal duties.
Where can I ask for more information?
Contact privacy@futurahosters.com. Our Terms of Service, Acceptable Usage Policy and Privacy Policy provide the related service and privacy rules.
