GDPR Compliance & Data Protection.

This GDPR notice explains how Ucartz Online Private Limited processes personal data in compliance with the EU General Data Protection Regulation (GDPR) and applicable data protection laws. Our commitment is to process data transparently, securely, and only for purposes you have authorized or that are necessary to provide our services.

GDPR Compliance Notice, updated October 2026

1) Introduction

Ucartz is committed to respecting the privacy and data protection rights of all individuals whose personal data we process. This notice describes our data processing practices under the GDPR and ensures you understand what data we collect, how we use it, who we share it with, and what rights you have.

This notice applies to all personal data processed by Ucartz when you:

• Visit our website or use our services (hosting, cloud, servers, domains, SSL, streaming, automation)
• Register for an account or place an order
• Communicate with our support or sales teams
• Use our client portal, knowledge base, or other platforms

2) Data Controller

Ucartz Online Private Limited acts as the Data Controller for personal data collected through our website and services. When you use our hosting or server services and process personal data on those servers, you act as the Data Controller and Ucartz acts as the Data Processor under a Data Processing Agreement (see section 11).

Our contact details:

• Legal name: Ucartz Online Private Limited
• Address: Near LP School, Agasthyacodu, Anchal, Kollam, Kerala 691306, India
• Email: info@ucartz.com
• Data Protection Officer: privacy@ucartz.com

3) Legal Basis for Processing

We only process your personal data where we have a lawful basis under Article 6 of the GDPR:

• Contractual necessity: Processing is necessary to provide you with our services, such as hosting, domains, or VPS, and to fulfil our contractual obligations.
• Legal obligation: Processing is required to comply with laws, regulations, or court orders (e.g., invoice record-keeping, tax compliance, combating abuse or fraud).
• Consent: We process some data only when you have given explicit consent, such as for marketing communications or optional analytics.
• Legitimate interest: We process data where necessary for our legitimate business interests, such as network security, service improvement, or fraud prevention, balanced against your privacy rights.

4) Personal Data We Collect

We collect different categories of personal data depending on your interactions with us:

• Account and registration data: Name, email address, phone number, company name, billing address, payment information, username, password, and authentication details.
• Service usage data: Server configurations, domain names registered or hosted, IP addresses assigned to your services, resource usage, logs of support tickets, and service change history.
• Communication data: Emails, chat messages, ticket submissions, and technical support interactions.
• Payment and billing data: Invoice records, billing addresses, payment methods (processed securely by WHMCS and payment processors), transaction history, and financial information necessary for billing.
• Website and analytics data: Cookie identifiers, IP address, browser type, pages visited, time spent on pages, referral source, and similar technical data collected via cookies or analytics tools.
• Data on your servers: If you host content on our servers (websites, databases, emails, files), that content may contain personal data. As the Data Processor, we access it only as necessary to provide services.
• Support and investigation data: Data you provide when reporting abuse, requesting support, or during investigations of policy violations.

5) Data Processing and Purpose

We process your personal data only for specific, explicit, and legitimate purposes:

• Service provision: Setting up, configuring, and maintaining your hosting, cloud, server, domain, SSL, streaming, or automation services.
• Billing and payment: Processing invoices, payments, refunds, and managing billing accounts.
• Customer support: Responding to your support requests, technical assistance, and resolving service issues.
• Security and compliance: Detecting and preventing abuse, fraud, illegal activity, and enforcing our Acceptable Use Policy and Terms of Service.
• Service improvement: Analyzing usage patterns, identifying service improvements, and developing new features (using anonymized or aggregated data where possible).
• Legal and regulatory compliance: Meeting legal obligations, responding to lawful requests, and maintaining compliance with applicable laws.
• Marketing (with consent): Sending newsletters, product updates, and promotional communications only if you have opted in. You may withdraw this consent at any time.
• Communication: Sending transactional emails (order confirmations, invoices, service notifications) and important account information.

6) Data Sharing and Recipients

We may share your personal data with the following categories of recipients, all bound by confidentiality and security obligations:

• Payment processors: Visa, Mastercard, Razorpay, and other payment gateways process payment information securely. We do not store full card details.
• Hosting and infrastructure providers: Data centre operators in the countries where your services are located (included in our Data Processing Agreement).
• Email and communication services: Third-party services for transactional emails, customer support, and communications.
• Analytics and monitoring tools: Third-party tools for service monitoring, performance analytics, and security (with data processing agreements in place).
• Legal and regulatory authorities: Government agencies, law enforcement, or courts when required by law.
• Service partners: Vendors, consultants, and service providers who assist us in delivering services, all under strict confidentiality agreements.
• Our team: Ucartz employees and contractors who need access to provide support, billing, or technical services.

We do not sell or rent your personal data to third parties for marketing purposes.

7) International Transfers

Ucartz operates from India and the UAE. If you are in the EU and use our services, your data may be transferred to these countries for processing. Such transfers are made:

• Under Standard Contractual Clauses (SCCs) approved by the European Commission, which provide appropriate safeguards equivalent to GDPR protection.
• With your explicit consent where SCCs are not available.
• Only where necessary to provide the services you have requested.

Data centres in EU countries (e.g., Germany, Ireland) are available for customers requiring data to remain within the EU. We comply with data localization requirements where applicable.

8) Data Retention

We retain personal data only as long as necessary for the purposes it was collected:

• Account data: Retained during your service and for up to 3 years after termination for legal, billing, and dispute resolution purposes.
• Billing and payment records: Retained for 7 years to comply with tax and legal obligations.
• Support and communication records: Retained for 2 years unless longer retention is required by law.
• Website analytics and cookies: Retained for up to 24 months unless you consent to longer retention.
• Data on your servers: Retained only as long as your service is active; deleted upon account termination unless you request backup or archival services.
• Abuse and enforcement records: Retained as long as necessary to prevent repeated violations.

Where data is no longer necessary, we securely delete or anonymize it. Legal or contractual obligations may require longer retention.

9) Your Data Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Article 15): You can request a copy of all personal data we hold about you in a structured, commonly used format.
• Right to rectification (Article 16): You can request correction of inaccurate or incomplete data (e.g., update your billing address or contact information).
• Right to erasure (Article 17): You can request deletion of your data, subject to legal or contractual retention requirements. This right may be limited if data is necessary for service provision or legal compliance.
• Right to restrict processing (Article 18): You can request that we limit how we use your data while you contest its accuracy or our processing.
• Right to data portability (Article 20): You can request your data in a portable format for transfer to another provider.
• Right to object (Article 21): You can object to processing based on legitimate interest or direct marketing. We will cease processing unless we have compelling reasons to continue (e.g., legal obligations).
• Rights related to automated decision-making and profiling (Article 22): You have the right not to be subject to decisions based solely on automated processing that significantly affects you.
• Right to withdraw consent: If processing is based on your consent, you can withdraw it at any time by contacting us. This does not affect the lawfulness of prior processing.

To exercise any of these rights, contact our Data Protection Officer at privacy@ucartz.com with your name, account details, and a description of your request. We will respond within 30 days (extendable to 90 days for complex requests).

10) Security Measures

We implement comprehensive technical and organizational measures to protect your personal data:

• Encryption: Data in transit is encrypted via TLS/SSL. Sensitive data at rest is encrypted using industry-standard algorithms.
• Access controls: Only authorized personnel access personal data, and access is logged and monitored.
• Firewalls and DDoS protection: Network infrastructure is protected by firewalls and multi-layered DDoS mitigation.
• Regular audits and assessments: We conduct security assessments, penetration testing, and vulnerability scans.
• Employee training: Our team receives data protection and security training.
• Incident response: We have a documented data breach response plan and will notify you within 72 hours if a breach is likely to pose a risk to your rights.
• Backup and recovery: Data is backed up regularly and tested for disaster recovery; backups are encrypted and stored securely.

While we implement strong safeguards, no online system is entirely risk-free. We encourage you to use strong passwords and secure authentication methods.

11) Data Processing Agreement

If you process personal data on Ucartz hosting, cloud, VPS, or dedicated server services, you are the Data Controller and Ucartz is the Data Processor under Article 28 of the GDPR.

A Data Processing Agreement (DPA) governs our relationship and includes:

• The subject matter, duration, nature, and purpose of processing
• Types of personal data processed
• Categories of data subjects
• Our obligations and your rights as Data Controller
• Sub-processor information and data transfer mechanisms
• Assistance with data subject rights requests
• Deletion or return of data upon service termination
• Audit rights and security certifications

A standard DPA is available upon request and is automatically included in enterprise service agreements. To request a DPA or custom terms, contact our sales team at sales@ucartz.com or open a ticket in the client area.

12) Contact Us

If you have questions about our GDPR compliance, data protection practices, or wish to exercise your data rights:

• Data Protection Officer: privacy@ucartz.com
• General inquiries: info@ucartz.com
• Support tickets: Open a ticket in the client area, 24/7
• Mailing address: Ucartz Online Private Limited, Near LP School, Agasthyacodu, Anchal, Kollam, Kerala 691306, India

We will respond to all data protection inquiries and requests within 30 days.

GDPR Rights and Complaints

If you believe we have violated your data protection rights, you have the right to lodge a complaint with your national data protection authority. You can find your authority at the European Data Protection Board (EDPB) website.

We welcome your feedback and are committed to resolving any concerns about our data processing practices.