PicoVPS1. General Provisions
1.1. This Policy sets out how PicoVPS (the Operator), owner of picovps.com and of the Telegram bot @PicoVpsOfficial_bot, processes and protects user personal data.
1.2. The Policy applies to all data the Operator receives when a user uses the Website, the Dashboard and the Telegram bot.
1.3. Using the Service constitutes agreement with this Policy. A user who disagrees must stop using the Service.
1.4. The Operator follows applicable data protection law and GDPR principles.
2. Data Processed
2.1. Registration data: email address, password hash, Telegram account ID and username (when linked), interface language.
2.2. Order data: configuration of rented servers, location, rental period, payment amounts and dates, Balance movements, payment service transaction identifiers.
2.3. Technical data: IP address, browser and operating system type and version, referrer, cookies, authorization and Dashboard activity logs.
2.4. Correspondence: the content of support tickets and Telegram bot messages, attached files, and reviews left on the Website.
2.5. The Operator does not collect passport data, health information, biometrics or other special categories of data, and does not store card numbers, CVV codes or account access credentials: payment details are entered on the side of the payment service and are never passed to the Operator.
2.6. The Operator has no access to the content of files and databases the user places on a rented server and does not process them.
3. Purposes of Processing
3.1. Registration, authorization and identification of the user.
3.2. Creation, activation and maintenance of rented virtual servers.
3.3. Accepting and confirming payments, maintaining the Balance, issuing refunds, handling payment disputes (including chargebacks through a bank).
3.4. Providing technical support and handling correspondence.
3.5. Notifying the user about service status, payment deadlines and maintenance.
3.6. Securing the Service and preventing fraud and abuse.
3.7. Analysing traffic and improving the Website on an anonymized basis.
3.8. Complying with legal requirements.
4. Legal Bases
4.1. Conclusion and performance of the agreement with the user (public offer).
4.2. Consent given by the user at registration and while using the Service.
4.3. Legitimate interests of the Operator in protecting the Service from abuse.
4.4. Requirements of applicable law.
5. Cookies and Web Analytics
5.1. The Website uses technical cookies required for authorization, storing the interface language and protecting the session. The Website does not work correctly without them.
5.2. Yandex.Metrica is used for traffic analysis, including click maps and anonymized session recording. That data is processed by the analytics service under its own policy.
5.3. A user may disable cookies in the browser settings; some Website features will then be unavailable.
6. Disclosure to Third Parties
6.1. The Operator does not sell personal data and does not share it with third parties for advertising purposes.
6.2. Data is shared to the minimum extent required: with payment services, banks and payment systems — to process payments and refunds and to handle payment disputes (information on orders, Balance movements, support tickets and Dashboard actions related to the disputed payment); with infrastructure partners and datacenters — to create and maintain virtual servers; with analytics services — in anonymized form.
6.3. Data may be disclosed to competent state authorities upon a reasoned lawful request.
7. Retention
7.1. Account data is retained for the lifetime of the account and for up to 12 months after its deletion, unless a longer period is required by law.
7.2. Payment records are retained for the period required by law for financial records.
7.3. Technical logs are retained for no longer than 12 months.
7.4. After these periods data is deleted or anonymized.
8. Security Measures
8.1. Traffic between the user and the Website is protected by TLS encryption (HTTPS).
8.2. Passwords are stored as irreversible hashes and are not accessible to Operator staff.
8.3. Database access is restricted; rate limiting is applied to authorization forms and administrative actions are logged.
8.4. The Operator takes reasonable organizational and technical measures but cannot guarantee absolute security if the user own device or credentials are compromised.
9. User Rights
9.1. The user may request information about the data processed, request its correction, restriction or deletion, withdraw consent and request that processing stop.
9.2. Requests are submitted through the ticket system in the Dashboard or the Telegram bot @PicoVpsOfficial_bot. Response time is up to 30 calendar days.
9.3. Deleting an account terminates the services and deletes the rented servers together with their content.
10. Cross-Border Transfers
10.1. Server capacity is located in Russia, the Netherlands, Germany, the United States, Finland, Czechia, Romania and the United Kingdom. When a foreign location is selected, the technical data required to create the server is processed in that country.
11. Minors
11.1. The Service is not intended for persons below the age at which they may independently enter into transactions. The Operator does not knowingly collect data of such persons.
12. Changes to this Policy
12.1. The Operator may amend this Policy by publishing a new revision on this page with its date. The current revision is always available at picovps.com/en/privacy.
13. Operator Contacts
Questions about personal data processing: the ticket system in the Dashboard, or the Telegram bot @PicoVpsOfficial_bot. All channels are listed on the Contacts page.