GDPR & Your Data Rights
Last updated: March 2026
We take GDPR seriously
BurroHost is built on Hetzner infrastructure located in the European Union (Finland and Germany). Your data never leaves EU jurisdiction as part of our normal operations.
The General Data Protection Regulation (GDPR) gives EU/EEA residents specific rights over their personal data. This page explains those rights and how to exercise them with BurroHost.
Right of Access
Article 15You can request a copy of all personal data we hold about you, including account information, billing history, support tickets, and logs associated with your account.
How to exercise this right: Email us with the subject line "Data Access Request" and we will provide a structured export within 30 days.
Right to Rectification
Article 16If any personal data we hold is inaccurate or incomplete, you have the right to have it corrected.
How to exercise this right: You can update most account details directly in your control panel. For other corrections, contact us by email.
Right to Erasure
Article 17Also known as the "right to be forgotten". You can request that we delete your personal data where we no longer have a legal obligation to retain it (e.g., after your account is closed and any mandatory retention period has expired).
How to exercise this right: Submit an erasure request by email. We will confirm what data can be deleted, process the deletion, and notify you when complete.
Right to Data Portability
Article 20You can request a machine-readable export of the personal data you have provided to us, in JSON or CSV format.
How to exercise this right: Email us with the subject line "Data Portability Request". We will prepare and send your data export within 30 days.
Right to Object
Article 21You can object to us processing your data where we rely on legitimate interest as our legal basis — for example, certain analytics or security monitoring activities.
How to exercise this right: Contact us by email explaining what processing you object to. We will assess and respond within 30 days.
Right to Withdraw Consent
Article 7(3)Where we process your data on the basis of consent (such as marketing emails or non-essential analytics cookies), you can withdraw that consent at any time without affecting the lawfulness of prior processing.
How to exercise this right: Unsubscribe from marketing emails using the link in any email, or manage cookie preferences via our Cookie Policy. For other consent-based processing, contact us.
Right to Restrict Processing
Article 18In certain circumstances (such as while a data accuracy dispute is resolved), you can request that we restrict how we process your data.
How to exercise this right: Contact us by email. We will acknowledge and apply the restriction within 72 hours.
How to Contact Us
To exercise any of the rights above, email us at hello@burrohost.top with a clear description of your request. We may ask you to verify your identity before processing sensitive requests.
We aim to respond to all data rights requests within 30 days. For complex requests, we may extend this by up to 2 months and will notify you if so.
Right to Complain
If you believe we have not handled your data in accordance with GDPR, you have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi) or with your national supervisory authority.
Where Your Data Lives
All BurroHost infrastructure runs on Hetzner Online GmbH servers in the European Union:
- Primary: Helsinki, Finland (HEL1)
- Backup: Nuremberg, Germany (NBG1)
Your data is not transferred outside the EEA as part of our normal operations. Hetzner is certified under ISO 27001 and is a member of eco — Association of the Internet Industry.