Rules you can
rely on.
For us, compliance means: we follow the law and our own guidelines – and show openly how. Here you'll find, in plain English, what applies to us, which documents you get and how to report a violation to us.
Applies to Hostingmonster® and MiU24® KG.
- Data protection under the GDPR
- Data processing agreement under Art. 28 GDPR
- No ad trackers
- Report concerns confidentially
- For businesses only
Ten statements you can hold us to
Hostingmonster is a brand of MiU24® KG. The guidelines of MiU24 KG apply to us – in how we deal with customers, with partners and with each other.
- Empathy and respectWe listen before we answer and take every concern seriously – even the third password problem of the week.
- Commercially responsibleWe recommend what pays off for your business, not what's most profitable for us.
- High ethical standardsIntegrity comes before revenue. If something isn't right, we don't do it – not even on request.
- Acting cost-effectivelySolutions should be worth the money: as much as necessary, as simple as possible.
- TransparencyPrices, processes and decisions are easy to follow. You know beforehand what will happen and what it will cost.
- Communicating honestlyClear answers instead of excuses. If something goes wrong, we say so – and what we're doing about it.
- Direct communicationShort lines of communication: you reach people who know what your request is about.
- Self-reflectionWe review our work regularly and learn from our mistakes. What we've improved is listed in the changelog.
- Long-term relationshipsWe focus on trust that lasts for years rather than quick deals.
- People at the centreTechnology serves the people in your company. Decisions about you are made by people.
Your data, your rules
We only process what we need for your job. Exactly how is set out in the privacy policy.
- The GDPR as our benchmark. Data minimisation, purpose limitation and clear deletion periods. It's all in our privacy policy.
- A DPA before we start. If we process data on your behalf, you get a data processing agreement under Art. 28 GDPR before the contract begins – with the list of our subprocessors and our technical and organisational measures (TOMs). How it works
- Data preferably in Europe. If a service is based outside the EU, we say so openly and safeguard the transfer by contract.
- Your rights. Access, rectification, erasure or your data to take with you: we answer requests within one month, as the GDPR requires.
- If something does happen. In the event of a data breach, we inform you as our client without delay and, where necessary, report it to the supervisory authority within 72 hours (Art. 33 GDPR).
- Confidentiality. What we see at your company stays with us. On request, we'll sign a non-disclosure agreement (NDA).
Security we practise ourselves
What we recommend to you, we put into practice ourselves. This is how we protect hostingmonster.eu and our Monster-Zentrale:
- EncryptedEvery connection runs over HTTPS. Browsers remember this permanently (HSTS).
- Two factorsSigning in to the Monster-Zentrale requires a password and a second factor – a code by email or authenticator app.
- Roles and permissionsEveryone on the team only sees what they need for their task.
- Audit logWe record important changes with the time and the person who made them.
- Detecting attacksA security log detects typical attack patterns and automatically blocks suspicious addresses.
- Backup before every updateBefore we update the platform, a full backup is created automatically.
- Nothing loads without askingExternal services only start once you've given your consent. A Content Security Policy blocks everything else.
- Found a vulnerability?Thank you! Please report it responsibly – how is explained under Report a security vulnerability and in the security.txt.
For the systems we look after for you, we agree on the measures together and record them in the DPA.
Integrity isn't an extra
How we deal with customers, partners and competitors.
- No favours for decisions. We neither offer nor accept gifts or payments intended to influence decisions.
- Commissions disclosed. We recommend what suits you. If we earn something from a provider, we tell you beforehand.
- Prices upfront. Fixed prices or billing in 15-minute increments, all prices net. More under Prices & packages.
- Your logins belong to you. If you switch providers, you get your data and logins handed over – just as the EU Data Act provides. More in the magazine
- Fair competition. No agreements with competitors on prices, territories or customers.
- Businesses only. We work exclusively for businesses, the self-employed, associations and public institutions. Our terms apply only to them.
AI, accessibility and partners
New technology, new obligations – and our network, to which the same rules apply.
- AI with its cards on the tableWhere AI helps out, for example with pre-sorting or summarising, we say so. Decisions about you and your job are made by people. Background: What the EU AI Act requires
- AccessibilityWe build to WCAG 2.2 AA and keep an eye on the German Accessibility Strengthening Act (BFSG). Accessibility statement
- Partners in the networkIf a partner from our network works for you, we bind them by contract beforehand – with a DPA if they process data. Become a monster
Something's not right? Tell us.
Have you noticed a violation of the law or of these guidelines – at our company or at a partner we work with? Then we want to hear about it.
- Confidentially by email. Write to help-entfernenhostingmonster-x.eu with the subject “Compliance report”. We treat your report confidentially.
- Anonymously by letter. Send your report to the management of MiU24® KG. You'll find the address in the legal notice.
- What happens next. We confirm receipt within seven days and tell you within three months at the latest what action we've taken – provided we can reach you.
- No repercussions. If you report something in good faith, you have nothing to fear from us.
- Report externally. You can also contact the Federal external reporting office at the Federal Office of Justice: bundesjustizamt.de.
Documentation when you need it
Your procurement team, data protection department or auditor wants the details – for NIS2, ISO 27001 or a supplier assessment, for example? You'll get these documents from us:
- Data processing agreementUnder Art. 28 GDPR, before we start working together.
- Technical and organisational measuresOur TOMs as part of the DPA.
- SubprocessorsWhich service providers we use and where they're based.
- Non-disclosure agreementOn request as an NDA, before we look at your systems.
- Supplier questionnaireSend us your questionnaire – we'll fill it in.
- Company detailsCommercial register and VAT ID are listed in the legal notice.
Good to know
Do you have a data protection officer?
No, we're not legally required to have one. We answer data protection questions directly – the address is in the privacy policy.
Are you certified, for example to ISO 27001?
No, we don't have a certification. We describe our measures openly in the TOMs that come with the DPA, and we give you specific answers to your questions about them.
Where is my data stored?
Preferably in Europe. Which service providers we use and where they're based is set out in the privacy policy and the DPA.
Does this also apply to companies in Switzerland?
Yes. For customers in Switzerland, we also comply with the Swiss Federal Act on Data Protection (FADP/DSG).
How do you handle reports of violations?
Confidential and without disadvantages for whistleblowers – regardless of whether the German Whistleblower Protection Act (HinSchG) requires us to have our own reporting office. Channels and deadlines are listed above under “Report a concern”.
This page sums up how we work and is not legal advice. The privacy policy, terms and your agreement with us are binding.
Just ask a monster.
A DPA, documents for your procurement team or a specific question: tell us briefly what you need. A human will get back to you.