Privacy Policy

1. Data Controller

Worldisthelimit
Finnish Business ID: 3555278-8
Country of operation: Finland

2. Contact Person and Support Channels

Primary Support Channel:
We strictly prioritize support requests submitted via our ticketing system. For assistance, please visit:
https://vgncloud.com/support or https://valuegamenode.com/support.

Email for Privacy Matters:
[email protected]

3. Name of the Register

VGNCloud customer and user register.

4. Purposes and Legal Basis for Processing Personal Data

We collect and process personal data for the following purposes and on the following legal bases:

Provision and Maintenance of the Service:

• Purpose: Creating and managing user accounts, processing orders, delivering and configuring game servers and virtual private servers, invoicing and payment processing, customer service, and technical support.
• Measuring network traffic: VPS plans include an amount of outbound traffic per month and charge for what exceeds it, so we measure the volume each machine sends and receives in order to invoice correctly and to show you your own usage. This is part of performing the contract you entered into.
• Legal Basis: Article 6(1)(b) of the EU General Data Protection Regulation (GDPR) (performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract).

Ensuring Service Security and Preventing Misuse:

• Purpose: Monitoring Service usage, identifying, preventing, and investigating security breaches and misuse (e.g., analysis of IP addresses and log data).
• Detecting attacks originating from a Service: The same traffic volume figures are watched for sudden, sustained increases, which are usually the first sign that a machine has been compromised and is being used to attack somebody else. A machine used this way harms the target, and gets our address ranges blocklisted or null-routed, which takes every other customer offline with it. We alert our own staff; we do not suspend anything automatically on this basis.
• Legal Basis: Article 6(1)(f) of the GDPR (legitimate interest of the controller). Our legitimate interest is to protect our Service, our customers, and to ensure the integrity and availability of the Service.

Service Development and Visitor Tracking:

• Purpose: Analyzing Service usage (e.g., visitor numbers, general geographical location of users based on IP address, anonymously and in aggregate) to improve and develop the Service.
• Legal Basis: Article 6(1)(f) of the GDPR (legitimate interest of the controller). Our legitimate interest is to understand the use of our Service for its development.

Customer Support and Communication:

• Purpose: Providing real-time support via live chat widgets and ticketing systems.
• Legal Basis: Article 6(1)(f) of the GDPR (legitimate interest to provide effective customer service) or Article 6(1)(b) (contract performance).

Compliance with Legal Obligations:

• Purpose: Fulfilling legal obligations, for example, related to accounting and taxation (e.g., retention of payment transaction data).
• Legal Basis: Article 6(1)(c) of the GDPR (compliance with a legal obligation to which the controller is subject).

We do not send direct marketing communications without your consent.

Note on Communication: You may opt out of receiving marketing communications from us. However, you cannot opt out of receiving administrative or transactional emails (e.g., invoices, service suspension notices, technical alerts) as these are necessary for the performance of our contract.

5. Data Content of the Register (Personal Data Collected)

We collect the following data from our users:

• Information provided upon registration: First name, last name, email address, password (in encrypted form).
• Information collected during Service use:
  • IP addresses.
  • Log data regarding the use of the Service and game servers.
  • Game server configuration data (e.g., ordered service package, additional storage, backups).
  • Virtual private server (VPS) configuration data: the hostname you chose, the operating system image, the assigned IPv4 address, the plan, any SSH public key you supplied, and firewall rules you have set.
  • Network traffic volume for each VPS: the number of bytes sent and received per calendar month, together with the counter readings and timestamps needed to calculate it. We record the volume only. We do not inspect, log or store the contents of your traffic, nor the addresses you connect to.
  • Payment transaction data (primarily processed by our payment service provider, Stripe; we store the subscription ID).
• Information provided during customer service interactions: Messages sent via the customer service portal, email, or live chat logs (including chat history and metadata collected via tawk.to).
• Automatically collected data: Website visitor numbers and users' general geographical location based on IP address.

6. Regular Sources of Data

Personal data is primarily collected from the user themselves during registration, use of the Service, and customer service interactions. Information related to payment transactions (such as subscription ID) is also obtained from our payment service provider, Stripe.

7. Regular Disclosures of Data and Transfer of Data Outside the EU or EEA

Your personal data is treated confidentially. We may disclose data to third parties only in the following cases:

• Payment Service Provider: We use the Stripe payment service to process payments. In this context, necessary payment information (such as name, email address, and payment card details) is transferred to Stripe. Stripe is a US-based company, and your data may be transferred and processed by Stripe outside the EU/EEA (e.g., in the United States). Stripe is responsible for the appropriate safeguards for these transfers (e.g., Standard Contractual Clauses). More information on Stripe's privacy practices can be found on their website.
• Customer Support Service (tawk.to): We use tawk.to to provide a live chat function for customer support. When you use the chat widget, data such as your IP address, name (if provided), email address (if provided), and the content of the chat conversation is processed by tawk.to. Tawk.to may transfer data outside the EU/EEA. Tawk.to acts as a data processor and their processing is governed by their Data Processing Agreements and Terms of Service. By using the live chat, you acknowledge this processing.
• Authorities: We may disclose data to competent authorities based on a legal obligation or a valid legal request (e.g., police, court).

No other regular disclosures of data are made. Our service servers, where we store the data we manage ourselves, are located in Finland.

8. Principles of Register Protection

We are committed to protecting your personal data. We use appropriate technical and organizational security measures to protect personal data against unauthorized access, use, disclosure, alteration, or destruction. These measures include, among others:

• SSL/TLS encryption for data transmission.
• Passwords are stored in an encrypted format.
• Access to personal data is restricted to only those individuals who need the data to perform their duties.
• Regular maintenance and updates of the server infrastructure.
• Firewalls.
• Regular backups.

Data Breach Notification: In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the supervisory authority within 72 hours and, where applicable, inform the affected users without undue delay.

9. Data Retention Period

We retain your personal data only for as long as necessary to fulfill the purposes defined in this Privacy Policy or to comply with legal obligations.

• Customer Account Information: Retained as long as the customer relationship is active. If a user account is inactive (no paid services) and the user does not log into their account, the account and associated basic information may be deleted one year after the last activity, unless the user reactivates the account.
• Termination of Customer Relationship: If a user requests the deletion of their account or the customer relationship otherwise ends, we will delete the user's personal data (such as name, email, server configurations, customer service messages) from our active databases within a reasonable time. Please note that payment transaction data processed through Stripe will remain in Stripe's own systems according to their own retention periods and legal obligations (e.g., accounting laws), over which we have no control. We will delete references to Stripe from our own database, such as the subscription ID, when it is no longer necessary.
• Log Data: Log data related to Service use (e.g., IP addresses for security monitoring) may be retained for a shorter, necessary period (e.g., from a few months to a year) for investigating misuse and maintaining security.
• Network traffic volume: The monthly totals for each VPS are the basis on which any overage was invoiced, so they are retained with our accounting records for the period Finnish accounting law requires. The short-lived counter readings used to calculate them are deleted with the machine.
• Legal Obligations: Certain data, such as accounting records (e.g., invoicing data), will be retained for the period required by Finnish accounting law (generally at least 6 years from the end of the financial year).

10. Rights of the Data Subject

You have the following rights regarding the processing of your personal data:

• Right of access: You have the right to know what personal data we process about you and to obtain a copy of this data.
• Right to rectification: You have the right to request the correction of inaccurate, incorrect, or incomplete personal data.
• Right to erasure ("right to be forgotten"): In certain situations, you have the right to request the deletion of your personal data, for example, if the data is no longer needed for the purposes for which it was collected, or if you withdraw your consent (if processing was based on consent) and there is no other legal ground for processing. Note that legal obligations may limit this right (e.g., retention of accounting data).
• Right to restriction of processing: In certain situations, you have the right to request the restriction of the processing of your personal data.
• Right to object to processing: When the processing of your personal data is based on our legitimate interest, you have the right to object to the processing of your data on grounds relating to your particular situation.
• Right to data portability: To the extent that processing is based on contract or consent and is carried out by automated means, you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format and the right to transmit that data to another controller.

You can exercise your rights by contacting us by email at: [email protected]. We will respond to your request as soon as possible, usually within one month of receiving the request. If necessary, we may request additional information to verify your identity before processing the request.

If you believe that the processing of your personal data infringes data protection legislation, you have the right to lodge a complaint with a supervisory authority (in Finland, the Office of the Data Protection Ombudsman).

11. Data Protection of Minors

Our Service is intended for individuals who are at least 16 years of age. We do not knowingly collect personal data from children under the age of 16 without verifiable parental or guardian consent. If you are under 16, you may not use the Service without such consent. If we become aware that we have collected personal data from a child under 16 without the required consent, we will take steps to delete that information.

12. VGNCloud as a Data Processor (Data on Your Servers)

When you rent a game server from us, you act as the data controller for all personal data that you or the users of your game server (players) store or process on the server you rent (e.g., players' IP addresses, game identifiers, in-game chats). You are responsible for the lawfulness of the processing of this data, for obtaining any necessary consents, and for informing your own players about the processing of their personal data.

The same applies to a virtual private server, and applies more widely: you hold root access and may run anything on it, including applications that process personal data belonging to your own customers or users. You are the controller for all of it, and you are responsible for its lawfulness, for any consents it requires, and for informing the people concerned. If the data on your VPS requires a data processing agreement, contact us and we will enter into one.

In relation to this data, VGNCloud acts as a data processor on your behalf. We process the data on the servers only as required for the technical provision and maintenance of the Service and according to your instructions (for example, when you use the Pterodactyl control panel to manage your server). We do not use the data on our customers' game servers for our own purposes.

It is your responsibility to ensure that you have the right to process your players' or users' data on our servers.

What we can technically reach. A VPS runs on hardware we operate, so our staff can in principle access the underlying virtual disk and open a console to the machine. We do so only where it is necessary to provide or repair the Service, to comply with a legal obligation, or where you ask us to. When a VPS is first built, or its root password is reset, that password is generated by us and sent to you by email; it is erased from our systems as soon as it has been sent, and we hold no copy. Adding an SSH key avoids the password being emailed at all, and changing the password once you are in means we never knew the one you use.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, for example, due to changes in legislation or as our Service evolves. We will notify users of material changes by email and/or by publishing an updated version in our Service's client panel or on our website. We recommend reviewing this policy regularly. By continuing to use the Service after changes have been made, you accept the updated Privacy Policy.

15. Automated Decision-Making and Fraud Detection

We may use automated decision-making processes, including profiling, to prevent fraud and ensure the security of our Service. For example, our payment processor (Stripe) analyzes transaction data to identify patterns associated with fraudulent activities. If a transaction is flagged as high-risk, it may be automatically declined.

This automated processing is based on our legitimate interest in preventing fraud and financial loss. If your transaction is declined based on an automated decision, you have the right to request a human review of the decision or to express your point of view and contest the decision by contacting our support.

Two further processes run automatically, and both have real consequences, so they are set out here in full:

• Charging for traffic over the included allowance. Once a calendar month closes, we compare the outbound traffic your VPS sent against what its plan includes, and any excess is charged to the payment method on file at the rate stated in our Terms. The calculation is arithmetic on a measured figure and involves no profiling or assessment of you. The figure is visible to you in the cloud panel throughout the month, and we email you both when you approach the allowance and after any charge is made.
• Suspending and terminating a Service for non-payment. If an invoice goes unpaid, the Service is suspended automatically after three days and terminated automatically after fourteen, which for a VPS destroys its disk permanently. Reminders are sent throughout, including a final notice at least three days before termination.

In both cases you may contact support at any point to have a person look at the decision, and we would rather you did so before the fourteenth day than after it. Nothing is suspended or terminated automatically on the basis of unusual traffic volume: that raises an alert for our staff, and any action a person then takes is a human decision.

16. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to track the activity on our Service and hold certain information. Cookies are files with small amount of data which may include an anonymous unique identifier. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent.

• Essential Cookies: We use these cookies to authenticate users and prevent fraudulent use of user accounts.
• Third-Party Cookies (tawk.to): Our support chat widget provided by tawk.to places cookies to maintain chat sessions and recognize returning visitors. By using the chat feature, you consent to the use of these cookies.