GDPR Privacy Notice
Last updated: October 27th, 2026
This notice is for people in the European Economic Area (EEA), the United Kingdom, and Switzerland. It supplements our Privacy Policy with the information Articles 13 and 14 of the GDPR require, and it tells you which legal basis we rely on for each thing we do.
1. Who is responsible
Controller. For your account, billing, and website data, the controller is Shiloh, LLC, doing business as Last Hour Hosting, P.O. Box #15264, 517 America's Way, Box Elder, SD 57719, USA. Contact: privacy@lasthourhosting.org.
Processor. For personal data you store inside a service you bought from us (your customers' data, your mailing list, your users' accounts), you are the controller and we are your processor. We act only on your documented instructions, under our Data Processing Addendum.
EU and UK representative. We do not have an establishment in the EU or UK and we do not target consumers there; we sell to businesses. If we begin offering services to individuals in the EEA or UK, we will appoint a representative under Article 27 and publish their details here before doing so. If you are an EU or UK business customer and need a representative named for your own records, contact us and we will arrange it.
2. What we process and why
| Purpose | Data | Legal basis (Art. 6) |
|---|---|---|
| Creating and running your account | Name, email, password hash, 2FA secret, country | Contract (6(1)(b)) |
| Billing and tax | Billing address, tax ID, invoice records, payment token | Contract; legal obligation (6(1)(c)) |
| Providing the service you bought | Your content and its metadata | Contract (6(1)(b)) — as your processor |
| Keeping accounts secure | IP address, user-agent, sign-in records, audit log | Legitimate interests (6(1)(f)): preventing unauthorized access and account takeover |
| Preventing fraud and abuse | IP address, payment signals, usage patterns | Legitimate interests (6(1)(f)); legal obligation for sanctions screening |
| Support you asked for | Ticket contents and attachments | Contract (6(1)(b)); legitimate interests |
| Service and security notices | Email address | Contract; legal obligation |
| Marketing email (only if you opted in) | Email address, engagement | Consent (6(1)(a)), withdrawable any time |
| Legal claims and compliance | Relevant records | Legal obligation (6(1)(c)); legitimate interests (6(1)(f)) |
We do not use automated decision-making that produces legal or similarly significant effects. Our fraud and sanctions screening can block a signup, but a person reviews any block on request — email support@lasthourhosting.org and we will look at it.
3. International transfers
Our servers and backups are in the United States, so your account data is transferred out of the EEA or UK. We use these safeguards:
- the European Commission's Standard Contractual Clauses (2021/914), module 2 (controller to processor) and module 3 (processor to processor), incorporated into our Data Processing Addendum;
- the UK International Data Transfer Addendum to those clauses, for UK data;
- the EU-US Data Privacy Framework where a subprocessor is certified under it;
- a transfer impact assessment for each subprocessor, covering access by public authorities, and supplementary measures where needed (encryption in transit and at rest, minimization, and no remote backdoor access).
You can request a copy of the applicable clauses from privacy@lasthourhosting.org.
4. Your rights
- Access (Art. 15) — a copy of your personal data and how we use it.
- Rectification (Art. 16) — correct inaccurate data. Most of it you can edit yourself in the portal.
- Erasure (Art. 17) — delete your data. We delete or de-identify within 30 days, except records we must keep for tax or legal reasons, which we keep in a restricted form.
- Restriction (Art. 18) — pause our use of your data while a question is resolved.
- Portability (Art. 20) — get your data in a structured, machine-readable format. The portal exports JSON and CSV.
- Object (Art. 21) — object to processing based on legitimate interests. We will stop unless we have compelling grounds, and you can always object to marketing outright.
- Withdraw consent (Art. 7(3)) — where we rely on consent, at any time, without affecting what happened before.
- Complain (Art. 77) — to your national supervisory authority. We would rather you came to us first, and we will not penalize you for complaining.
To exercise any right, email privacy@lasthourhosting.org. We answer within one month and will tell you if we need the two-month extension the GDPR allows and why. We may ask you to confirm control of the account email address before acting.
If you are a customer of one of our customers and want your data erased from a site we host, the controller is that business, not us. Ask them. If they ask us to act, we will.
5. Security and breach notification
Our security measures and our breach-notification commitments are in sections 7 and 8 of the Privacy Policy. We notify affected controllers without undue delay and within 72 hours of confirming a breach, with the information Article 33(3) requires.
6. Subprocessors
Our current subprocessors are listed, with their location and purpose, at /subprocessors. We give at least 30 days' notice before adding one that processes personal data, so you can object.
7. Retention
Retention periods by category are in section 6 of the Privacy Policy. We keep data no longer than the stated period, and we review retention annually.
8. Complaints
Contact us first at privacy@lasthourhosting.org. If we do not resolve it, you may complain to the supervisory authority in the country where you live or work, or where the alleged infringement happened.