Table of contents

  1. Who is responsible for your data?
  2. What data do we process and why?
  3. Google sign-in, SMS and the forum
  4. Who do we share data with?
  5. How long do we retain data?
  6. Cookies and security
  7. What rights do you have?
  8. Data on customers’ websites and changes to the Policy

I. Who is responsible for your data?

The data controller is ABC Hosting Ltd., 7B Neal Pen Road, Belize City, Belize, registration number 148 538, operating under the CBA.pl brand.

For matters concerning personal data, you may contact us at obsluga@cba.pl or by post at: ul. Świętokrzyska 30 lok. 63, 00-116 Warsaw, Poland.

This Policy applies to the use of the CBA.pl website, the User Account, the Panel, our Services and contacts with customer support.

II. What data do we process and why?

Depending on how you use CBA.pl, we process your login and authentication data, first and last name, email address, telephone number, address and business details, including tax identification number, Order and payment data, correspondence and technical data, such as your IP address and the history of logins and changes to the Account.

Registration of certain Domains requires additional subscriber data, such as date and place of birth or a document number. The scope depends on the requirements of the relevant registry.

When verifying entitlement to a Domain, transferring it or changing its subscriber, we process the necessary data and documents. For a change of subscriber, this includes a signed form and a copy of an identity document to the extent specified by CBA.pl as necessary for verification.

Correspondence includes emails, tickets in the Panel, chat conversations, complaints, notices of infringements and appeals. We use the data and materials provided in them to examine the matter. Information concerning an infringement may also come from the reporting person.

If you pay for another person’s Hosting Service using the donation feature, we process the email address provided, payment data and supplied billing information in order to handle the payment, assign it to the specified Service and process a possible refund. The payment does not provide access to the Account or to the data of the User of that Service.

We use data for the following purposes:

  • maintaining the Account and providing the Services, including Domains, payments and Order processing — on the basis of a contract or steps taken before entering into a contract, under Article 6(1)(b) GDPR;
  • compliance with legal obligations, for example accounting obligations — under Article 6(1)(c) GDPR;
  • protecting the service, preventing abuse, examining infringement notices and appeals, handling other enquiries and claims — on the basis of our legitimate interests, under Article 6(1)(f) GDPR;
  • optional analytics and monitoring of activity on the website using Google Analytics and Tawk.to — on the basis of consent, under Article 6(1)(a) GDPR.

We receive data from you, while you use the website, as well as from payment operators, Domain registrars and Google when you choose Google sign-in. We may receive the data of a representative or contact person from the customer they represent; we use it on the basis of the legitimate interest in handling our cooperation.

Providing data is voluntary, but failure to provide data necessary for a particular action may prevent us from performing it. Creating an Account does not constitute consent to marketing.

We send messages connected with the operation of the Account and Services to your email address, including confirmations and reminders that the provision period of a Service is ending. These messages do not require marketing consent, provided that they do not contain advertising content.

After obtaining separate, voluntary consent, we may also send newsletters and CBA.pl offers, for example concerning website creation. For this purpose, we process your email address on the basis of consent — Article 6(1)(a) GDPR — until it is withdrawn.

You may give consent during registration or later in the User Panel. You may also withdraw it at any time in the Panel. Withdrawal does not affect the use of Services or the receipt of necessary system messages. Withdrawal of consent does not affect the lawfulness of processing carried out before it was withdrawn.

III. Google sign-in, SMS and the forum

When you use Google sign-in, we receive your user identifier, email address and information that the address has been verified. The integration also includes the basic Google account information scope. The data is used to create or link an Account and to sign in; we do not obtain access to Gmail or Google Drive.

We use your telephone number for verification and for reminders that the provision period of Services is ending. Polish mobile numbers are verified using a one-time SMS code, while landline numbers are verified manually by CBA.pl support at the User’s request. We process the SMS code, verification result and message delivery information. We provide the SMS supplier with the recipient’s number and the content of the message. We do not send advertising by SMS.

The Account is linked to access to the CBA.pl forum. Forum operation includes, among other data, the login, email address, IP address and authentication data. Posts published publicly and the author designation are visible to other persons.

IV. Who do we share data with?

To the extent necessary, we use the following providers:

  • LeaseWeb Netherlands B.V. — server infrastructure;
  • PayPro S.A. / Przelewy24 — payments;
  • PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) — payment processing for users in the EEA; the entities applicable to other countries are identified in the PayPal Privacy Statement;
  • NASK and Internet Domain Service BS Corp. / Internet.BS, as well as the relevant registries — Domain services;
  • Digital Virgo S.A. / JustSend — sending SMS messages;
  • Google Ireland Limited (Ireland) and Google LLC (USA) — Google sign-in, taking into account the region of the user’s Google account, in accordance with Google’s information about the applicable entity;
  • Google LLC (USA) or Google Ireland Limited (Ireland) — Google Analytics, depending on the terms applicable to the CBA.pl account: Google LLC terms and Google Ireland Limited terms;
  • Google LLC (USA) — provider of reCAPTCHA, processing data on behalf of ABC Hosting Ltd. to protect forms against bots, fraud and abuse;
  • tawk.to Inc. (USA) — Tawk.to chat, in accordance with its Terms of Service.

We provide payment operators with data required to process payments, and Domain registrars and registries with subscriber data required to service a Domain. The j.pl and cba.pl subdomains are not registered to the User in an external registry.

We may also disclose data to authorised authorities where an appropriate legal basis exists. Not every provider receives all of your data.

The hosting infrastructure is located in the EU. This does not mean that all provider operations and all access to data take place exclusively within the European Economic Area.

Data may be transferred outside the European Economic Area only to the extent necessary to use the services of our providers.

V. How long do we retain data?

We retain data for the period necessary to fulfil the relevant purpose. Closing an Account does not automatically delete documents that must be retained by law or data necessary to handle claims.

We retain Account data until the Account is closed and for one further year, and Domain data for the duration of its servicing and for one year after it ends. We retain correspondence for one year after the matter to which it relates is closed. We retain security logs and information about sent SMS messages for 12 months, and an SMS code until it is used. We retain Google Analytics data for 14 months. We retain accounting documents for the period required by laws applicable to the Controller. If data is needed in pending proceedings or to handle a claim, we may retain it until the matter is concluded.

Available copies of Hosting Service data are retained for at least one year after the end of the Service provision period, in accordance with the Terms of Service and the applicable data-processing arrangements. If, before that period expires, the User pays for preparation of a downloadable copy, we retain the required copy until it has been prepared and made available.

VI. Cookies and security

We use cookies and browser storage that are necessary for signing in, processing Orders, saving settings and protecting forms with reCAPTCHA. Google Analytics is used to create statistics, while Tawk.to is used for chat support and monitoring user activity on the website, including pages visited. Google Analytics and Tawk.to are activated after consent is given in the cookie window. Consent may later be changed or withdrawn in the cookie settings. Google Analytics cookies may operate for up to 2 years, and the Tawk.to user identifier for up to 6 months.

We use access safeguards and encrypt connections to the website. We treat data not intended for public disclosure as confidential.

Automated safeguards analyse attempts to perform operations and may block them to prevent abuse. You may challenge a block and request review by a CBA.pl employee by writing to obsluga@cba.pl.

VII. What rights do you have?

Under the conditions set out in the GDPR, you may request access to your data, a copy of it, rectification, erasure, restriction of its use or data portability. Where we process data on the basis of legitimate interests, you may object for reasons relating to your particular situation. An objection to direct marketing does not require justification.

You may withdraw consent at any time without affecting the lawfulness of earlier processing. Write to obsluga@cba.pl.

We respond to data requests within 14 days. If, due to the complexity of the matter or the number of requests, we need more time, we will inform you within that period of the reason and the new response deadline, in accordance with the GDPR.

You may lodge a complaint with the President of the Polish Personal Data Protection Office or another competent supervisory authority.

VIII. Data on customers’ websites and changes to the Policy

We process data stored by customers on websites, in databases, email accounts and VPSs on their behalf, including when performing ordered technical work and preparing or restoring copies. For this purpose, we may receive the necessary information, access credentials or a copy provided by the customer. Data processing on behalf of a customer requires separate, binding arrangements; this Policy does not replace them.

To enter into a personal data processing agreement (DPA) with ABC Hosting Ltd., please contact us individually at obsluga@cba.pl.

The current Policy is made available on CBA.pl. CBA.pl reserves the right to amend the Policy. Information about changes is published on the CBA.pl forum and on the welcome page of the User Panel. Updating the Policy does not replace consent where consent is required.

Effective date: 14 September 2026.