Ludom Hosting — Privacy Policy

DRAFT FOR REVIEW — not published or effective. Prepared: 11 October 2026. Proposed version: 2026-10-11-draft-1.

1. Who is responsible

This policy describes personal data processed through Ludom Hosting at ludomhost.net and its hosting services.

[REVIEW: Insert the legal name and address of the responsible business/personal information controller, its privacy representative's contact details, and the countries in which the business operates.]

Proposed contact: [email protected] or an authenticated support ticket. [REVIEW: Confirm the monitored privacy contact and establish a way for former customers to submit requests.]

2. Information we process

• Account information: name, email address, verification state, password hash, account roles and recorded policy acceptance.
• Hosting information: chosen domains/subdomains, plan and service identifiers, hosting-account credentials needed for provisioning, status, quotas, cached resource usage and setup activity. Website content and databases reside on the hosting node.
• Billing information: orders, issued invoice details, payment references, amounts, status, allocations, refund and credit records, and billing support correspondence.
• Support information: ticket messages, associated services and files you submit. Staff may add internal operational notes.
• Security and technical information: session records and cookies, request/server logs, IP addresses and operational audit records. Staff authenticator secrets and verification state are processed for staff security where enrolled.

Payment-card entry takes place on Maya's hosted checkout. The application does not collect or store full card numbers or card security codes. Do not place card details, passwords or unnecessary sensitive information in support tickets or attachments.

3. Purposes and lawful grounds

We use information to create and verify accounts, supply and manage hosting, issue invoices, verify and reconcile payments, answer support requests, prevent abuse, secure systems and maintain operational and financial records.

[REVIEW: Confirm the applicable lawful ground for each processing purpose, including contract performance, legal obligations, legitimate interests where appropriate, and consent for any optional processing. Do not treat acceptance of this notice as blanket consent to unrelated processing.]

The National Privacy Commission distinguishes a privacy notice from consent; the notice should explain the actual processing activities. NPC guidance on privacy notices

4. Cookies and sessions

The client area uses cookies and session information for sign-in, security and form protection. These support account access; blocking them may prevent the portal from working correctly. You can sign out and use the account page to invalidate other authenticated sessions.

[REVIEW: Inventory production cookies, their actual expiry periods and Cloudflare features. Confirm whether any analytics or marketing tools will be added; none are authorized by this draft.]

5. Service providers and disclosures

The current system uses hosting infrastructure managed through HestiaCP, Cloudflare for relevant DNS/network services and Maya for enabled online payments. HestiaCP is hosting-management software; identify the actual infrastructure business separately. A transactional email provider has not yet been configured.

Providers receive information necessary for the services they supply. Authorized staff can access information according to their role. We may disclose information when lawfully required or where necessary to handle an incident or a customer's authorized request.

[REVIEW: Identify the actual infrastructure and email providers, processing locations, provider contracts, recipients and any cross-border processing safeguards. Review each provider's practices before publication.]

6. Retention, cancellation and deletion

Service cancellation, account access and financial retention are separate processes. The current system suspends approved cancellations, retains financial history and quarantines included subdomains. It does not automatically purge customer accounts, support records or hosted content.

[REVIEW: Specify a retention schedule for account data, website content, invoices/payments, support attachments, audit/server logs, sessions and backup copies. Confirm applicable recordkeeping duties, legal holds and a workable deletion/anonymization process. Do not promise a deletion deadline the system cannot meet.]

Requests involving deletion or restriction are reviewed against applicable rights and legitimate retention requirements. If some records must be retained, explain the reason and scope to the requester.

7. Security

The application uses HTTPS, password hashing, role and ownership checks, staff MFA, private support-file storage and encryption for sensitive integration credentials. Staff actions such as payment review and hosting repairs create audit records. Local application backups are encrypted; independent off-server replication is not configured yet.

No security measure eliminates every risk. Report suspected unauthorized access through support. [REVIEW: Confirm the operational incident-response owner, notification procedure, backup destination and recovery arrangements before opening registration.]

8. Privacy requests and complaints

Subject to applicable conditions, you may request access to your personal data, correction of inaccurate information, and appropriate restriction or deletion. Other applicable rights can include objection, portability and a complaint to the National Privacy Commission. We may need proportionate identity verification before releasing information or changing an account.

Use the confirmed privacy contact to make a request. Do not send a password or payment-card data as proof of identity.

[REVIEW: Assign a request handler and define the response process and applicable response periods.]

These proposed rights disclosures should be checked against the business's actual obligations. NPC data-subject rights, Philippine Data Privacy Act

9. Hosted website visitors

If you host a website that collects personal information, you are responsible for its notices, permitted purposes and lawful instructions to hosting providers. This platform policy does not replace your own website's privacy notice.

[REVIEW: Define the business's processor responsibilities for customer website content and the appropriate hosting/data-processing agreement.]

10. Changes

The published policy will identify its effective date and version. Material changes will be communicated through an appropriate channel. This draft has no effective date and is not currently presented for registration acceptance.