GPU Server Hub Privacy Policy

Version 1.12 dated 23 October 2026
Editorial revision r2 dated 25 October 2026 — privacy settings available in the footer after acceptance English translation EN-1.

This document is an English translation provided for convenience. The Polish version 1.12 is binding. In the event of any discrepancy, the Polish version prevails, subject to the priority of an individually agreed Order and any mandatory provisions of law.

Public path on the Provider's website: Privacy Policy

This Policy applies to gpuserverhub.com: the English version at the root, the Polish version under /pl/ and the German version under /de/; the gpuserverhub.pl and gpuserverhub.eu domains and www variants redirecting to this website; the gpu.bestconnect.pl administration portal; sales and technical contact; and the data of individuals representing B2B customers. Data stored by the Customer on the rented Server is governed by the separate data processing terms in the Terms available at Terms.

1. Controller

The controller is Janusz Ciuruś, conducting business under the business name BESTCONNECT CIURUŚ JANUSZ, Królówka 261, 32-722 Królówka, Poland, Polish Tax Identification Number (NIP) 8681799622, National Business Registry Number (REGON) 120967456, operating under the GPU Server Hub brand.

Contact for all data-related matters: gpu@bestconnect.pl.

2. Data we process

Depending on the contact and use of the website, we may process:

• first name, surname, position, business name, address, Polish Tax Identification Number (NIP), EU VAT number or an appropriate foreign tax or business registration identifier, registration details and the selected billing currency;
• when checking a business: the normalised NIP or EU VAT number and country, source and purpose of the check, outcome or status, effective date and request and response times, response reference, and a limited extract containing the name, address, REGON or KRS identifier and VAT status where returned by the source; as integrity evidence we store a SHA-256 digest of the limited extract and a digest of the source response, not its full contents;
• email address, telephone number and the content of correspondence and reports;
• Order, invoice, payment and Agreement history data;
• IP address, date and time of connection, requested resource, session identifier, browser type and security information recorded in ordinary access and security logs;
• when our first-party website analytics is enabled, by default or through an explicit choice: the path of the page viewed, event time, hostname of an external acquisition source, utm_source, utm_medium and utm_campaign parameters, a random page-open identifier generated in the current tab's memory and sent with events to group them, active-attention checkpoints, scroll depths and sections reached, the start of calculator use, a limited record of the chosen configuration (number of servers, term, bandwidth and optional HDD choice), offer-related button clicks, GPU use-case selection, and the mere start and attempted submission of a form;
• within the same analytics module: approximate country, region and city, ASN number and network-operator name, general device, operating-system and browser-family category, a pseudonymous HMAC digest derived from the IP address and user-agent information and changed daily, and a technical classification of events by engagement level and probable automation;
• technical Service data, addressing, and failure, abuse, administrative access and intervention logs;
• data necessary to comply with a legal obligation or defend against a claim.

The analytics module processes the IP address transiently in server memory only to resolve approximate location, ASN and network operator locally, create the daily HMAC digest and limit abuse of the collector. Full user-agent information is used transiently to derive a general device, operating-system and browser category. Neither the raw IP address nor the full user-agent information is stored in the analytics-events table. They may nevertheless be stored independently in ordinary access or security logs under the rules set out in this Policy.

Analytics does not store form-field contents, email addresses, telephone numbers, passwords, keys pressed, selected text or pointer coordinates. The random page-open identifier is not stored in cookies or persistent browser storage; its browser-side copy disappears when the tab is closed or reloaded, while the transmitted copy is retained with the raw event for the period set out in section 7.

If a person acting for a company voluntarily submits an enquiry, registration or Order while analytics is enabled, the conversion event may contain an internal organisation, User and session identifier where available at that stage. The common page-open identifier submitted with the form permits the conversion to be linked precisely to analytics events from that single page opening for the raw-event retention period, no longer than 90 days. The daily HMAC digest may additionally permit an approximate link between the conversion and events from other page openings on the same day. This allows the administrator to analyse the journey of a specific, verified company. The linkage does not extend across days, and aggregated statistics contain no organisation, User, session or page-open identifier or daily digest. Form-field contents, email addresses and telephone numbers remain excluded from analytics. Submitting a form does not constitute consent to analytics; the event retains its separately recorded activation mode.

We do not request passwords, private keys or unnecessary special-category data to be sent by email.

After Google Ads measurement is enabled as described in point 11.4, we also use the Google Ads measurement described in section 11a. The information transmitted may include ad-click and measurement-cookie identifiers, event time and type, a restricted page address, a random identifier for an accepted enquiry to prevent duplicate counting, and technical request data, including the IP address and browser information. We do not send Google the form contents, first or last name, company name, email address, telephone number, or internal customer or organisation identifiers. Separately, we retain minimal consent evidence with an accepted enquiry: consent state, purpose and method, choice time and server-recording time, consent-notice and Policy versions, and an internal link to the enquiry. This evidence contains no IP address, user-agent information, form contents or contact details and is not sent to Google.

For separate paid-Order measurement, only after Google Ads consent, we may retain an ad-click identifier (gclid, gbraid or wbraid), its capture time, the consent state and version, and a technical link to the Order. The event sent from our server to Google contains the selected click identifier, a random event identifier to prevent duplicates, the Order's net value and currency, and the actual time an administrator confirms payment in the system. We do not add contact details, an internal Order number, bank-transfer descriptions or references, the customer's IP address, an SSH key or portal contents to this event. Locally, we also retain minimal delivery status and a technical record of attribution withdrawal, as described in sections 7 and 11a.

3. Purposes and legal bases

Our legitimate interests are the secure provision of B2B services, communication with persons representing the Customer, prevention of fraud, establishment of facts, and protecting and enforcing rights. The default behaviour of first-party analytics depends on the language version: without an explicit choice it is disabled on /pl/ and enabled on English and /de/ pages, under the technical rules in section 11. We do not treat the absence of a choice or continued use of the website as consent. Within first-party analytics, we limit measurement, do not create a persistent visitor identifier and change the visitor digest daily. Separate Google Ads measurement may use cookies only after the consent described in section 11a. Both modules respect the GPC and DNT signals described below. An option to disable measurement does not replace prior consent where that consent is required.

4. Sources of data

We obtain data directly from the contacting person or the Customer, from the operation of the website and infrastructure, from the browser and HTTP requests sent when the website is used, from authorised Users, network operators, the bank, a credible person reporting abuse, and the following official sources: the Statistics Poland (GUS) REGON BIR service, the Polish Ministry of Finance VAT taxpayer register (the “VAT White List”), and the European Commission VIES system.

From register responses we retain only the scope needed to complete company details, assess B2B or VAT status, and document the check, as described in section 2. We do not retain bank-account numbers, representatives, partners or PESEL identifiers from the VAT White List. A VIES result is advisory: it records what the system returned at that time, may be incomplete or temporarily unavailable, and does not by itself automatically accept or reject a Customer or Order. A negative, ambiguous or unavailable result may be referred for human review.

We resolve approximate country, region and city, ASN and network-operator name for analytics locally using IP Geolocation by DB-IP files — the DB-IP City Lite and ASN Lite databases made available under CC BY 4.0. We do not send the IP address to the database provider's API. The result is indicative: it may identify a telecommunications provider, data centre or network owner rather than the visitor's business, and it is not a person's precise location.

If we did not obtain data directly from the relevant person, we provide that person with a link to this Policy no later than at first contact or within the period required by Article 14 GDPR. Information may be withheld only under a documented exception provided for by law.

5. Recipients

Data may be received, only to the extent necessary, by:

• authorised persons acting for Bestconnect;
• the bank, accounting provider, Polish National e-Invoice System (KSeF), legal advisers and authorities empowered by law;
• providers maintaining our own infrastructure and email, if engaged;
• Quicktel Sp. z o.o., operator of 4DataCenter, with respect to colocation, physical security and commissioned remote-hands interventions;
• telecommunications operators cooperating in traffic transmission and incident handling.

First-party analytics runs on our server and does not send events to an external analytics provider. The local DB-IP files enrich an event only on our server; their provider receives neither a query nor an IP address in that process. After consent to Google Ads measurement, the browser loads the Google Ads tag, and our server may separately send a limited paid-Order event through the Google Data Manager API under section 11a. The recipients are Google Ireland Limited, Ireland, and Google entities involved in providing the service. For EEA data, Google Ireland Limited acts as a separate controller under the Google data protection terms. We do not implement Google Analytics 4, remarketing, personalised advertising or enhanced conversions. The current website does not provide social-network integrations or card payments. Before a further technology or recipient is introduced, we will update this Policy and obtain consent where required.

6. Transfers outside the EEA

The website, Orders, email, control plane, first-party analytics and security logs are maintained in Poland, and the Servers are located in Katowice. The analytics collector makes no external requests. However, communications, document delivery or making data available in the portal to the Customer or another recipient outside the EEA may involve a transfer outside the EEA. Where such a transfer is subject to Chapter V GDPR, before it begins we ensure an appropriate legal mechanism, in particular an applicable adequacy decision or appropriate safeguards, including standard contractual clauses, together with any required supplementary measures. Information about the mechanism used and how to obtain a copy of the safeguards is available from the Controller’s contact address. Adding a provider or location in another country requires the information to be updated in advance. Data entrusted on the Server is separately governed by Part E of Annex 1 to the Terms.

Data sent to Google after measurement consent may also be processed outside the EEA, including in the USA. Google identifies the EU–US Data Privacy Framework for covered transfers to certified entities, and standard contractual clauses where applicable. Details and safeguards are available in Google’s advertising data transfer information. Measurement consent is not used in this configuration as a substitute legal mechanism for transfers.

7. Retention periods

• enquiries that do not result in an Agreement — normally up to 12 months after the contact is closed;
• Agreement data, register-check results and evidence, evidence of acceptance and service records — for the term of the Agreement and the limitation period for related claims; we limit the evidential register to the identifier, time, representation details, versions and SHA-256 hashes of documents, IP address, and normalised browser information needed to demonstrate the process;
• accounting and tax documents — for the period required by law, normally 5 years calculated under the applicable tax legislation;
• individual first-party analytics events, including activation mode, daily HMAC digest, approximate location, ASN and operator, technical categories, path, source, campaign data, attention checkpoints, scroll depth, sections, interactions, limited calculator parameters and — for a voluntary conversion while measurement is enabled — organisation, User and session identifiers — for up to 90 days from the event;
• aggregated daily analytics statistics — for up to 24 months; the aggregates do not contain the raw IP address, daily visitor digest or a User, organisation or session identifier;
• aggregated daily security counters, including Fail2Ban ban counts without a list of banned addresses — for up to 24 months;
• website, security and administrative-access logs — normally up to 12 months, and longer where they concern an incident, claim or legal obligation;
• abuse and incident reports — until the matter is closed and for the period necessary to defend rights or required by law;
• data based solely on consent — until consent is withdrawn, without affecting the lawfulness of earlier processing.
• privacy choices in browser storage — until replaced by a later choice or removed with site data; stored acceptance has no automatic expiry, subject to the rules in point 11.4. Minimal consent evidence linked to an accepted enquiry — 90 days from acceptance, followed by deletion during the next daily retention cycle. Residual records in technical backups may remain until the separate backup retention cycle ends; they are not used for active measurement;
• Google measurement cookies in the _gcl_* family — normally up to 90 days according to Google’s cookie information, unless deleted earlier; a cookie lifetime is not the retention period for all data held by Google. Retention of Google data and reports depends on the information, service settings and provider obligations; see Google’s retention policy. Withdrawing consent stops further measurement but does not itself delete data already transmitted;
• the ad-click identifier and Order attribution link — no more than 90 days from click capture; the paid-Order event record and minimal queue and delivery metadata — no more than 90 days from creation of the event record; the technical withdrawal record that prevents re-queuing — no more than 90 days from withdrawal. After the applicable period, the data is no longer used for sending and is deleted in the retention cycle. This does not extend the click's validity or change how long the privacy choice itself is retained. Residual data in technical backups follows the separate backup retention cycle and is not used for active measurement;

Retention of Customer Data on the Server is described in the Terms, including the export and provider-switching procedure.

8. Rights

Within the limits of the GDPR, a person has the right to:

• access their data and receive a copy;
• rectification;
• erasure or restriction of processing;
• data portability where applicable;
• object to processing based on legitimate interests, including direct marketing;
• withdraw consent at any time where processing is based on consent, without affecting prior lawful processing;
• lodge a complaint with the President of the Polish Personal Data Protection Office: uodo.gov.pl.

A request may be sent to the contact address. We may request information necessary to verify identity securely.

9. Requirement to provide data

Providing data in an ordinary contact form is voluntary, but we cannot respond without return contact details. Identification, representation, contact and billing data required in an Order is necessary to conclude and perform the Agreement and comply with legal obligations.

10. Automated decisions

We do not make decisions about individuals that produce legal or similarly significant effects based solely on automated processing. A GUS, VAT White List or VIES result is not by itself an automated decision about a Customer or Order; a case requiring assessment is reviewed by a person. The module may technically classify events as a page view, engagement, sales intent or probable automation. This segmentation is used for aggregate statistics, not to establish identity or individually evaluate a customer.

Fail2Ban may automatically and temporarily block an IP address after a series of clearly malicious requests, such as attempts to read configuration files or known attack paths, or repeated rate-limit violations. Refusal of analytics consent, a short visit, absence of JavaScript, failure to scroll, or an ordinary single 404 error is not a reason for a ban. A technical ban does not produce legal or similarly significant effects for an individual.

11. Cookies, browser storage and first-party analytics

1. The account portal uses only cookies or storage necessary for transmission, security, maintaining a session, remembering selected interface preferences, including language and whether panels are collapsed, and operating forms. Removing or blocking these mechanisms may prevent sign-in or the use of some functions.
2. On Polish pages under /pl/, where no explicit choice has been stored, analytics remains disabled until explicitly enabled. On English pages at the root and German pages under /de/, analytics on public sales pages, articles and forms is enabled by default. The automatically displayed settings are described in point 4. A previously stored “Necessary only” choice, a “Close” choice or a later opt-out continues to block measurement across all language versions. If the browser preference cannot be read, measurement does not start automatically. Disabling it does not restrict content, registration, forms or an Order.
3. Our first-party analytics does not set or read a persistent user identifier in cookies, localStorage or sessionStorage, and it does not load a third-party tracking script. A random identifier for one page opening is created only in script memory and is then sent with accepted events to group them. We send only the event categories and limited values listed in section 2, with a maximum of 32 events per page opening.
4. On public pages without stored acceptance of Google Ads measurement, a small “Privacy settings” window appears automatically at the bottom of the screen and remains available while scrolling. “Accept” enables first-party analytics and Google Ads measurement. “Close” saves a refusal for both and collapses the window for the current view only. Until acceptance is stored, the window reappears after navigating to another page or subpage, reloading the page or returning to the browser tab; scrolling or typing in a form alone does not reopen it. An icon links to this Policy. After acceptance, the floating settings icon disappears. The text button “Privacy settings” in the page footer remains available to reopen the window and change the decision. We do not display separate category checkboxes. Stored acceptance has no programmed expiry and prevents further automatic prompts in the same browser while site storage is retained and the acceptance matches the current scope of consent. Withdrawing consent, clearing site data, using another browser or changing the scope in a way that requires fresh consent may cause the prompt to appear again. Previously stored separate analytics and Google Ads choices retain their values until a new decision. Ignoring or closing the window is not consent. Google Ads remains disabled by default in every language, and a previous first-party analytics choice is not transferred to Google Ads. The automatic prompt does not appear on private Order pages or in the administration portal; the GPC and DNT signals described below continue to be respected.
5. We use the gsh_privacy_preferences_v2 key in localStorage to remember category choices, time, format version and privacy-information version. It does not assign a visitor identifier. The previous gsh_analytics_preference_v1 key is respected only for first-party analytics until replaced by a new choice. Default first-party analytics activation does not store consent. Preferences on gpuserverhub.com are shared by EN, /pl/ and /de/. Redirects cannot transfer old choices from gpuserverhub.pl. If a new choice cannot be saved, Google Ads measurement remains disabled.
6. The IP address and user-agent information are used transiently on the server as described in section 2. The daily HMAC digest may be used to link events from different page openings on the same day approximately, including to a company conversion; the common page-open identifier provides a precise link only within one tab. The digest changes at midnight in the Europe/Warsaw time zone and is not used to recognise the same person on subsequent days.
7. A Global Privacy Control signal (Sec-GPC: 1) or Do Not Track signal (DNT: 1) blocks both first-party analytics and Google Ads, including where consent was previously stored. This does not disable necessary security logs, Order records, or data required to perform an Agreement or comply with law.
8. First-party analytics does not use analytics or marketing cookies. The separate Google Ads tag may use measurement cookies only after consent to this measurement, as described in section 11a. We do not create remarketing lists or link our first-party analytics data to a profile held by an external service.
9. Raw events distinguish default_enabled (default activation) from analytics_consent (explicit activation or a previously stored analytics choice). Historical events are not reclassified. Once raw events are deleted, aggregate statistics remain without a historical breakdown by activation mode. A technical mode is not a declaration of a legal basis.

11a. Google Ads — enquiry and paid-Order measurement after consent

On public PL, EN and DE pages, we use Google Ads tag AW-18531457010 only after explicit consent to this measurement as described in point 11.4. It measures whether a paid ad led to a contact enquiry accepted by our system, and supports campaign evaluation and optimisation. Clicking “Send”, a form error, registration, merely creating an Order or a visit alone is not reported as a paid rental. Enquiry measurement does not confirm a sale.

Before consent, we do not load the tag or send Google events or cookieless pings. Earlier first-party analytics consent, submitting a form, continued browsing or closing the settings does not enable Google Ads. Consent is not a condition of contact, registration, ordering or content access. We use basic consent mode; ad personalisation is disabled.

After consent, Google may read or store cookies to attribute an enquiry to an earlier ad click. The tag receives the limited event and request information described in section 2. The address supplied as the page address is restricted to the public path and permitted ad identifiers; we do not add form contents, customer data or arbitrary URL parameters. A random conversion identifier limits duplicate counting of the same accepted enquiry; it is not a customer number or email address. We do not use enhanced conversions or send contact details to Google, including in hashed form. The one-time marker confirming an accepted enquiry in the form session is valid for 10 minutes. In the current tab’s sessionStorage, we may record a random conversion already handled under a key beginning gsh_ads_lead_v1: to avoid sending it again after a reload; the record disappears when the tab session ends.

We separately measure paid Orders. After Google Ads consent, a gclid, gbraid or wbraid identifier present in the landing address may be stored in site storage with its capture time. When a new Order is submitted, a valid identifier may be linked to it on our server. Without consent or a valid click identifier, we do not create a purchase conversion on this basis. The attribution window is no more than 90 days from click capture; saving an Order or confirming payment does not renew that period.

A purchase event is created only when an administrator confirms the Order's payment in the system. We send the Google Data Manager API a limited set: the click identifier, a random event identifier, the Order's net value and currency, the actual time payment was confirmed in the system, and consent state. We do not substitute an earlier date entered in bank-transfer details. The purchase report is separate from an accepted enquiry; the same purchase is not counted again after a reload, another save of the confirmation or a technical delivery retry.

Measurement covers a new Order with a valid advertising attribution link and consent. We do not backfill historical payments or report subsequent renewals of the same service as new purchases; a separate new Order can be measured only with its own valid attribution. Delivery occurs from our server, without loading the Google tag on private Order, payment or administration pages. If the API connection is not ready, the event remains unsent; entering the queue alone does not confirm receipt or attribution by Google.

Withdrawing consent removes the local advertising attribution. The browser can send our server a withdrawal request using a random technical key retained in that browser, without sending the key to Google. Once we receive the request, we block further delivery and re-queuing of the linked purchase that has not yet been sent. This mechanism requires the retained key and a connection to our server; it does not recall data already delivered to Google. If site data has been cleared or the request cannot be delivered, the Controller can be contacted using the address in section 1.

Consent can be withdrawn at any time by opening “Privacy settings” using the button in the page footer and selecting “Close”. This saves a refusal for both first-party analytics and Google Ads. This stops further events and removes Google measurement cookies accessible to our website; cookies belonging to other domains can be removed in the browser. If the tag is already loaded, withdrawal may reload the page to unload it; the settings window then explains this before the reload. Following that reload, as with opening another view, the window will reappear as described in point 11.4; its reappearance does not enable measurement. Withdrawal does not affect the lawfulness of earlier processing. Information already sent to Google is subject to the rules and rights described in Google’s privacy policy and its information about data from partner sites.

12. Security and roles in relation to the Server

We protect data using measures appropriate to the risk, including access restrictions, intervention logging, infrastructure safeguards and an incident procedure. A local Fail2Ban mechanism analyses security logs, temporarily blocks addresses matching narrowly defined attack patterns, and supplies the administration panel only with ban counts and their categories, without a list of IP addresses.

With respect to data that the Customer places on the Server, the Customer normally determines the purposes and means of processing, while Bestconnect acts as a processor solely with respect to the infrastructure layer. Details and the shared responsibility model are set out in the Data Processing Agreement forming part of the Terms.

13. Amendments to the Policy

We publish the current version at Privacy Policy on the Provider's website. We will notify the Customer by email of a material change affecting an ongoing Agreement. The version history remains available for download.