1. Controller and Contact
FuturaHosters.com is operated by Mercury Labs SAGL, Via Industria 16, CH-6850 Mendrisio, Switzerland. Company Number: CHE-113.042.422; VAT Number: CHE-113.042.422 VAT.
Mercury Labs SAGL is the controller for the customer account, administrative and website data described in this notice. For privacy questions or requests, contact privacy@futurahosters.com.
2. Scope and Our Roles
This notice explains how we process personal data in connection with our website, customer portal and services. Swiss data protection law applies; additional data protection requirements apply where relevant to the processing concerned.
We distinguish our own customer administration from content customers entrust to hosting, email and Swiss Backup. For personal data in customer-controlled content, the customer determines the purposes of processing and we provide the service on the customer's instructions, subject to the applicable service and data processing agreements. A customer may itself act for another controller.
3. Personal Data We Process
Depending on your interactions with us and the services purchased, we process:
- Identity and contact details, including name, company, address, email address and telephone number.
- Account identifiers, authentication and security information, preferences and service configuration.
- Quotes, orders, invoices, payment status, transaction references and related administrative records.
- Support tickets, system emails and other correspondence.
- Technical records, including IP addresses, access times, requested resources, browser information and security events.
- Website usage information collected through Google Analytics after consent.
- Content and technical metadata entrusted to the services, including websites, email and backup data.
Some data is supplied by you or your authorized contacts; other data is generated when using our services or received from payment operators and service partners in connection with your orders. Please provide only information relevant to your request and ensure you are entitled to disclose information about others.
4. Purposes of Processing
We use personal data to:
- Create and administer accounts, prepare quotes, process orders and provide purchased services.
- Handle billing, payments, accounting and contractual records.
- Provide support and communicate operational, billing and security information.
- Authenticate users, prevent fraud and abuse, investigate incidents and protect our infrastructure.
- Register and administer domains and related services.
- Analyze website use through consent-based analytics.
- Send occasional newsletters where permitted and in accordance with your marketing preferences.
- Meet legal obligations and establish, exercise or defend legal claims.
Where consent is required, we request it for the relevant processing. Refusing optional analytics or marketing does not prevent purchase of our services. Information necessary to fulfill an order or meet a legal obligation may be required before we can provide the relevant service.
5. Payments
Payments are handled through Stripe and/or PayPal according to the method selected. For a Swiss Stripe account, the standard agreement identifies Stripe Payments Europe, Limited, with additional Stripe entities where the applicable service terms provide. PayPal services are provided by PayPal Pte. Ltd., Singapore. These operators receive the information necessary to process the payment and may process data for their own regulatory, security and fraud-prevention purposes.
We do not ask you to disclose your PayPal password. Our administrative records include payment status and transaction references and may include payment tokens or limited payment-method details supplied by the operator. Do not send full card details or payment credentials through support tickets.
For further information, see the Stripe Privacy Policy and the PayPal Privacy Statement.
6. Domains and Service Partners
We use Hosting Concepts B.V., trading as OpenProvider and established in the Netherlands, for domain services. Registration and administration require disclosure of relevant registrant, contact and technical information to OpenProvider and the applicable registry or other parties involved in the domain lifecycle.
Publication or disclosure of registration data depends on the applicable domain, registry and registrar rules. Domain registration does not mean that all registrant details are automatically public. See the OpenProvider Privacy Policy and applicable domain terms.
Email and Swiss Backup content is hosted on our proprietary infrastructure in Swisscom Tier IV datacenters in Switzerland. Customer backup data is encrypted and stored on that infrastructure. The Acronis backup administration console associated with our service is hosted in a datacenter in Switzerland. Acronis receives only technical data for administration and operation of the backup service and has no access to customer backup contents. Hosting the infrastructure at Swisscom does not authorize Swisscom to access customer content.
We do not sell personal data. Disclosures to the identified service partners are limited to their relevant functions. We may also disclose information where legally required or where lawfully necessary to protect rights or respond to an incident; this is not unrestricted disclosure on informal request.
NordVPN and MarketConnect
For NordVPN orders, we use MarketConnect to arrange activation and manage the subscription. This involves sharing the customer account email address and the order and service identifiers, subscription and status information needed for those operations with the distribution platform and Nord. Nord sends activation instructions to that email address; you manage the separate Nord Account with Nord.
We remain responsible for our customer administration. Nord independently determines the processing associated with its account and VPN service, as explained in the Nord Privacy Policy and NordVPN Privacy Notice. These are distinct from our website analytics and Swiss Backup processing. A VPN traffic no-logs statement does not mean that no account, subscription or technical data is processed.
7. Processing Outside Switzerland
The Swiss location of our email and backup infrastructure does not mean that every administrative, payment, domain or analytics operation takes place exclusively in Switzerland.
Payment, domain and analytics providers may process relevant data outside Switzerland. The Netherlands is the establishment country of Hosting Concepts B.V. (OpenProvider), and Singapore is the establishment country of PayPal Pte. Ltd. These establishment countries do not describe all locations in which the providers or their partners may process data.
Stripe's international processing may include the United States. Its Data Processing Agreement and Data Transfers Addendum distinguish its processing roles and provide transfer arrangements, including standard contractual clauses adapted for Swiss data protection law where applicable. PayPal's Privacy Statement likewise describes processing in the United States and other countries and the protective arrangements it uses.
Google Analytics 4 is provided under the applicable terms with Google Ireland Limited, Ireland, and may involve international processing by Google and its subprocessors, including in the United States. An Irish contracting entity does not restrict all processing to Ireland, the European Economic Area or Switzerland. Google's data processing terms and applicable transfer provisions govern the relevant processing. Analytics remains subject to the consent controls described below.
Domain services involve OpenProvider and the registry or other authorized recipients relevant to the extension purchased. Destinations depend on the extension and the parties involved; the domain suffix alone does not establish every processing country. OpenProvider's Privacy Policy describes international transfers and the safeguards it uses where required.
Applicable safeguards depend on the recipient and transfer concerned and may include a legally recognized adequate level of protection or appropriate contractual safeguards. We do not represent that one mechanism covers every provider or destination. You may request further information about the recipients, countries and safeguards applicable to your service at privacy@futurahosters.com.
Nord identifies nordvpn S.A., Panama, as its controller. MarketConnect involves WHMCS Ltd., United Kingdom, and the relevant WebPros entities described in the WHMCS/WebPros Privacy Policy. NordVPN also involves an international server network. These activities are not covered by our Swiss email and backup storage commitment. Processing countries depend on the recipient, operation and server used; the provider's establishment country is not an exhaustive list of destinations. Applicable transfer arrangements must be assessed for the processing concerned; purchasing a VPN does not itself establish Swiss-only processing.
8. Cookies and Google Analytics
We use necessary cookies and related technologies to operate the customer portal, maintain sessions, support the shopping cart, remember relevant preferences and provide security functions. Authentication cookies support account access; this notice does not describe them as storing your password.
Google Analytics 4 is blocked until you accept analytics cookies. When enabled, it processes website interaction and technical information to help us understand use of the website. The provider identified in the applicable Analytics terms is Google Ireland Limited, Ireland. We do not use Analytics advertising features.
We have enabled the Analytics data-sharing setting named "Google products & services". Under that setting, Google may also use shared Analytics data to understand online behavior and trends and improve its own products and services. For this additional processing, Google acts as an independent controller under the applicable measurement controller-controller data protection terms; this is separate from processing performed on our behalf to provide Analytics. This sharing is not limited to producing reports for our website. See Google's explanation of shared measurement data.
You may decline optional analytics or withdraw consent through the website's cookie controls. Browser settings also allow cookies to be removed or restricted, although blocking necessary cookies can affect login, ordering and other functions. Withdrawal does not undo processing already carried out. See Google's Privacy Policy for Google's processing.
9. Communications and Newsletters
We send communications needed to administer your account and services, including order confirmations, invoices, support replies and security or service notices. These operational communications are separate from optional marketing.
We may send an occasional newsletter, potentially around once per year, subject to applicable requirements and your preferences. You can unsubscribe using the mechanism provided in the message or by contacting us. Unsubscribing from marketing does not stop necessary service communications.
10. Logs and Security
Access and security logs help us operate services, diagnose faults, detect abuse and investigate incidents. IP addresses and account-related logs may identify or be linked to a person; we do not treat them as automatically anonymous.
We apply technical and organizational measures appropriate to the risks, including access restrictions and protected communications. Access to customer content is limited to authorized handling necessary for service delivery, customer instructions or applicable legal requirements. We do not undertake routine review of all customer content.
HTTPS protects data in transit between your browser and our website. It does not, by itself, establish that every category of stored data is encrypted. No system can provide absolute security; this does not remove our contractual or legal responsibilities for protecting data.
11. Retention and Deletion
Customer account and administrative data are retained while at least one service remains active. When the account is classified as inactive because no services remain active, it remains accessible and consultable during the following six-month retention period. Inactive is an administrative status and does not itself disable access.
The six months run from the date the account is classified as inactive. At the end of that period, account and administrative data are deleted, subject to the exceptions below. These data include personal details, payment records, system emails, quotes, orders, support correspondence and associated records. If a service is reactivated, the active-account retention rule applies again.
Documents and information that must be retained by law, including required accounting records, are kept for the applicable statutory period. Information may also be retained where lawfully necessary for an existing dispute or legal claim. Such retention is limited to the relevant purpose and does not mean that the customer account remains generally available after its deletion.
Service content follows the separate service deletion rules in our Terms of Service. For Swiss Backup, the customer defines backup policies, retention and deletion while the service is active. Remaining Swiss Backup data is removed 30 days after effective service deactivation. For voluntary cancellation this runs from the effective deactivation date, not the date of the cancellation request; for non-payment the applicable period runs from suspension as specified in the Terms of Service.
The six-month account-data period does not extend the retention of deactivated service content. Domain registries, payment operators and other recipients may have their own independent legal retention obligations.
These periods concern records and content under our control. Nord Account data and other data processed independently by Nord follow its own retention rules. Cancelling NordVPN through our portal does not itself request deletion of the Nord Account. Requests concerning our records can be sent to privacy@futurahosters.com; requests concerning Nord's independent processing should be made through Nord's privacy channels.
12. Your Privacy Rights
Depending on applicable law and the processing concerned, you may request information about your personal data, access, correction, deletion, restriction or cessation of processing, and data delivery or transfer where the legal conditions are met. You may withdraw consent for processing based on consent, with effect for the future.
You can update available account details through the customer portal. For other requests, email privacy@futurahosters.com. We may request proportionate information to verify your identity. Requests are handled within applicable legal time limits and remain subject to lawful exceptions, retention duties and the rights of others.
If your request concerns personal data controlled by one of our customers within their hosted content, contact that customer first. We assist the relevant controller as required by the applicable arrangement and law.
You may contact the Swiss Federal Data Protection and Information Commissioner (FDPIC) or another competent supervisory authority, as applicable.
13. External Websites and Updates
External websites and independent service operators have their own privacy notices. A link does not bring their processing under our exclusive control.
We update this notice when our processing practices or applicable requirements change. The current version and effective date appear above. Material changes are communicated where required; publishing an update does not replace consent where consent is needed for a new purpose.
Questions about this notice can be sent to privacy@futurahosters.com.
