Art. 1.1. This document contains the terms and conditions applicable to the services offered by SC CHROOT NETWORK SRL, hereinafter referred to as CHROOT or the PROVIDER. This document establishes the general contractual framework applicable to the provision and use of the services offered by the PROVIDER and constitutes an agreement between the PROVIDER and the CUSTOMER/USER. Contracting, activating or using the PROVIDER’s services entails acceptance of and compliance with these Terms and Conditions, subject to applicable law. Art. 1.2. The following terms have contractual effect and are governed by the following legislation: Art. 1.3. CHROOT means SC CHROOT NETWORK SRL, tax identification number: RO21052851, Trade Register: J40/2745/2007, account: RO22 INGB 5551 9999 0054 1063, bank: ING Bank, address: Str. Liviu Rebreanu, nr. 46-58, Sc. H, Et. 6, Ap. 66, Sector 3, postal code 031793, Bucharest, acting as the PROVIDER of the services offered and marketed through CHROOT. Art. 1.4 concerns data used by CHROOT for its own relationship with the CUSTOMER, such as account, billing and contact data. Content hosted on behalf of the CUSTOMER is separate and is subject to Chapter 11. The list of recipients below does not grant general access to the CUSTOMER’s emails, files or databases. SC CHROOT NETWORK SRL, acting as a personal data controller, processes personal data in accordance with applicable data protection legislation, including Regulation (EU) 2016/679 (GDPR). Personal data is processed in accordance with the following principles: This article explains how and why we collect this data, the purposes for which we use it, and how you can view and manage it. We collect personal data to provide the best possible experience when using our services. Most of this data is obtained directly from you in the following situations: Certain information may also be collected automatically or generated when you use our website and services, as follows: More information on cookies is available in the cookie policy. Personal data is processed on one or more applicable legal bases, including entering into and performing the contract, compliance with the PROVIDER’s legal obligations, protection of its legitimate interests or, where applicable, the CUSTOMER/USER’s consent. Where processing is based on consent, consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal. Depending on the circumstances and services used, personal data may be processed for: Personal data is processed only for specified, explicit and legitimate purposes and in accordance with applicable law. CHROOT does not sell personal data to third parties for commercial or marketing purposes. Access to personal data is restricted to persons and entities for whom access is necessary to provide services, administer the contractual relationship, meet legal, tax and accounting obligations, ensure service security or defend CHROOT‘s rights and legitimate interests. Depending on the services used and the particular circumstances, data may be accessed by or transmitted to the following categories of recipients: Third-party access is limited to what is necessary for the relevant purpose and may be ongoing, periodic or occasional, depending on the nature of the service, legal obligation or technical circumstances. CHROOT does not sell personal data to third parties for commercial or marketing purposes. You can access your CHROOT customer account (www.chroot.ro/login) to view and, where applicable, update certain personal data we store about you. Requests for erasure of personal data may be submitted through the contact channels indicated by CHROOT. Erasure requests will be handled within the period prescribed by applicable law. Data will not be erased insofar as processing or retention is necessary to provide active services, comply with a legal obligation, establish, exercise or defend legal claims, or in other circumstances provided for by applicable law. CHROOT applies appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, alteration or unauthorised disclosure. Personal data is retained throughout the contractual relationship and thereafter for as long as necessary to fulfil legal, tax and accounting obligations, ensure service security, prevent and investigate fraud or abuse, conduct audits, resolve disputes, establish, exercise or defend rights, or comply with requests from competent authorities. Retention periods depend on the nature of the data, the processing purpose and applicable legal obligations. CHROOT services may be contracted by persons with the legal capacity required to enter into a contract under applicable law. Minors may contract services only under the conditions prescribed by law and, where applicable, with the consent of or through their legal representative. CHROOT reserves the right to update these personal data protection provisions to reflect legislative, technical or operational changes. The updated version will be published on this page, and significant changes will be communicated to data subjects by appropriate means where required by applicable law. Data subjects have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), subject to applicable law. The authority’s current contact details are available on its official website, www.dataprotection.ro. For questions, concerns, complaints or erasure requests, please submit your request through the support ticket system at www.chroot.ro/tichet-de-asistenta or use the contact details published at www.chroot.ro/contact. We will respond within the time limits and under the conditions prescribed by applicable personal data protection legislation. Art. 2.1. The USER/CUSTOMER shall use the services in accordance with applicable law, this contract and the specific conditions of the contracted services. Art. 2.2. The USER/CUSTOMER shall keep authentication, identification and access details for the contracted services confidential and take reasonable measures to protect them against unauthorised access or disclosure. The USER/CUSTOMER is responsible for consequences resulting from disclosure, transmission or improper use of these details where attributable to the USER/CUSTOMER. If the USER/CUSTOMER discovers or suspects compromised credentials or unauthorised access to the contracted services, they shall inform the PROVIDER without undue delay and take the necessary measures to secure access. Art. 2.3. The USER/CUSTOMER shall promptly notify the PROVIDER of any change to their identification details. Otherwise, the PROVIDER assumes no responsibility for the accuracy of details not updated by the USER/CUSTOMER. Art. 2.4. Information about services, technical specifications, prices and commercial conditions displayed on the PROVIDER’s website may be updated periodically. The conditions applicable to each service are those available and communicated when the order is placed, together with this contract and, where applicable, the individual commercial offer and written communications between the parties. Art. 2.5. The USER/CUSTOMER is responsible for the content, information and communications transmitted, published, stored or processed through the contracted services and for the manner in which the services are used, in accordance with applicable law and this contract. Art. 2.6. The PROVIDER’s equipment and services shall not, in any form or under any circumstances, be used to transmit, store or publish materials or conduct activities that are illegal, contrary to applicable law or in breach of this contract. Prohibited materials and activities include, without limitation: Shared web hosting services may not be used to run malicious or compromised scripts or scripts with known security vulnerabilities that may affect the security or operation of the PROVIDER’s infrastructure. The following types of scripts or applications are also prohibited on shared web hosting services, without limitation: NOTE: Where a breach of this article is identified or confirmed, the PROVIDER may take the technical or administrative measures necessary to limit the risk, including temporary or permanent suspension of the affected service without prior notice where the nature or seriousness of the situation requires immediate intervention. Art. 2.6.1. Shared web hosting and reseller web hosting services include technical limits on sending email to protect the infrastructure, IP address reputation and service quality. For shared web hosting and reseller web hosting, the standard sending limit is a maximum of 100 messages per minute and 500 messages per hour, per hosting account, domain, email account or other technical unit determined by the PROVIDER. These are maximum operational limits and do not guarantee that sending this volume is permitted in every situation. The PROVIDER may impose stricter temporary or permanent limits where there is suspected spam, phishing, malware, a compromised account, complaints, blacklisting, abnormal sending behaviour or a risk to infrastructure reputation. Email services included in shared web hosting and reseller web hosting are intended for normal, legitimate communication, rather than bulk email, mass mailing, cold mailing, unsolicited newsletters or other activities liable to affect infrastructure reputation. For legitimate email marketing campaigns, mass notifications or high message volumes, the CUSTOMER/USER must use specialised email delivery services that are properly configured and comply with applicable law. Art. 2.7. Forms and scripts used to send email must be properly configured and secured, including appropriate mechanisms to prevent abusive or automated use. The USER/CUSTOMER is responsible for maintaining their security and keeping them updated. If a form or script is used to send spam, phishing, malware or other abusive messages, or poses a risk to the PROVIDER’s infrastructure, it may be disabled and the affected service suspended or restricted. Art. 2.8. Prohibited content and activities are governed by Art. 2.6. Art. 2.9. Restrictions on scripts and applications on shared web hosting services are set out in Art. 2.6. Art. 2.10. Administration, maintenance, configuration, troubleshooting or intervention concerning the CUSTOMER/USER’s operating system, applications or services is not included by default in the contracted services unless expressly included in the service description or an individual commercial offer. The PROVIDER may occasionally provide additional technical assistance for certain operations without a contractual obligation to do so. Such assistance does not incorporate administration services into the contracted service or create an obligation to provide similar assistance in future. Where the CUSTOMER/USER’s requests require administration, complex technical interventions, repeated operations or a significant amount of work, the PROVIDER may make performance conditional upon purchasing an administration service or accepting a separate commercial offer. Art. 2.11. The USER/CUSTOMER shall pay for the contracted services by the due date. Art. 2.12. The USER/CUSTOMER shall cooperate with the PROVIDER to ensure service and infrastructure security and report without undue delay any incident, activity or situation known to them that may affect the security of the services, the PROVIDER’s infrastructure or other customers. The USER/CUSTOMER shall provide any information available to them that is necessary to identify, investigate and remedy the incident. Art. 2.13. The USER/CUSTOMER shall comply with the rules, policies and conditions applicable to third-party networks, platforms or services accessed or used through the PROVIDER’s services, insofar as applicable to them. Art. 2.14. The USER/CUSTOMER shall not abuse the PROVIDER’s services or infrastructure or conduct activities liable to affect their security, stability, performance or operation, or services provided to other customers. Art. 2.15. The CUSTOMER/USER is responsible for use of the contracted services and for the content, applications, data, communications and activities conducted through them. To the extent permitted by law, the CUSTOMER/USER shall bear the losses, costs, fees and reasonable expenses incurred by the PROVIDER as a direct result of the CUSTOMER/USER’s breach of these Terms and Conditions, contractual obligations or applicable law. This may include reasonable costs of notices, investigations, expert assessments, legal advice and representation, court fees and litigation expenses incurred by the PROVIDER in connection with claims, disputes, proceedings or requests from third parties or authorities arising from the CUSTOMER/USER’s content, activities or use of the services. This provision applies only insofar as the costs or losses are attributable to the CUSTOMER/USER and does not exclude the PROVIDER’s liability for its own acts where prescribed by law. Art. 2.16. The USER/CUSTOMER is responsible for keeping their own up-to-date backups of data, files, databases and configurations used in the contracted services, unless they have expressly contracted a backup service from the PROVIDER. The PROVIDER may back up certain services for operational, continuity or infrastructure protection purposes. Such copies do not constitute a guaranteed backup service or create an obligation to retain or restore the CUSTOMER/USER’s data unless such a service is expressly included in the contracted service description or an individual commercial offer. For expressly contracted backup services, the conditions, frequency, retention period and restoration possibilities are those set out in the service description, commercial offer or applicable specific conditions. The PROVIDER does not guarantee recovery from backups that are not covered by an expressly contracted backup service. Art. 2.17. The USER/CUSTOMER is responsible for administering the contracted services and for the content, data, applications and configurations used or hosted through them insofar as under their control. The PROVIDER does not exercise editorial control over content published or administered by the USER/CUSTOMER. Art. 2.18. The USER/CUSTOMER shall comply with this document and the conditions applicable to each type of contracted service. Where the CUSTOMER/USER is a consumer, the right of withdrawal is exercised under the conditions and within the periods prescribed by the legislation applicable to distance contracts. Consumers have 14 days to withdraw from the contract without giving a reason, except in the circumstances provided for by applicable law. For service contracts, the withdrawal period expires 14 days after the contract is concluded. Where a consumer requests that provision begin before the withdrawal period expires, the service may commence on the basis of their express request. If the consumer exercises the right of withdrawal after performance has begun, they may owe an amount proportionate to the services provided up to notification of withdrawal, subject to applicable law. The right of withdrawal does not apply in circumstances expressly exempted by applicable law, including, where applicable, service contracts after full performance where performance began with the consumer’s prior express consent and acknowledgement that they would lose their right of withdrawal once the PROVIDER had fully performed the contract. In addition to the statutory right of withdrawal, the PROVIDER may offer commercial refund conditions for certain services under the return policy or the commercial conditions applicable to the service. To exercise the right of withdrawal, the consumer must inform the PROVIDER of their decision by an unequivocal statement sent through the PROVIDER’s contact channels. The consumer may use the withdrawal form provided by the PROVIDER, but is not obliged to do so. To meet the withdrawal deadline, it is sufficient to send the statement exercising the right before the withdrawal period expires. Where the right of withdrawal is validly exercised, the PROVIDER will reimburse amounts due under applicable law without undue delay and in any event within 14 days after being informed of the withdrawal decision. Reimbursement will use the same payment method as the initial transaction unless the consumer expressly agrees otherwise. The statutory consumer right of withdrawal applies exclusively to persons qualifying as consumers under the law. Art. 2.20.1. The USER/CUSTOMER, as a data subject, has the right to request erasure of personal data concerning them under applicable law. The PROVIDER will erase personal data without undue delay where a ground prescribed by data protection legislation applies, including where: The right to erasure is not absolute and may be restricted in circumstances prescribed by applicable law, including where retention or processing is necessary to comply with a legal obligation or establish, exercise or defend legal claims. Art. 2.20.2. The USER/CUSTOMER has the right to receive personal data concerning them which they have provided to the PROVIDER in a structured, commonly used and machine-readable format, and to transmit it to another controller, under applicable law, where: Where technically feasible and the legal conditions are met, the data subject may request direct transmission to another controller. Art. 2.20.3. The USER/CUSTOMER may object at any time, on grounds relating to their particular situation, to processing of personal data concerning them based on the PROVIDER’s legitimate interests or other grounds for which applicable law recognises a right to object. Upon such objection, the PROVIDER will cease processing the relevant data unless it demonstrates compelling legitimate grounds overriding the data subject’s interests, rights and freedoms, or processing is necessary to establish, exercise or defend legal claims. Where personal data is processed for direct marketing, the data subject may object at any time to processing for that purpose. Art. 3.1. The PROVIDER ensures operation of its own infrastructure used to provide the services and guarantees availability (uptime) of 99.9%, except for Cluster VPS/VDS, for which guaranteed availability is 99.982%, subject to this contract and any specific conditions applicable to the contracted service. Availability is calculated monthly and concerns infrastructure and services under the PROVIDER’s control. Availability calculations exclude downtime caused by scheduled maintenance or urgent security interventions, the CUSTOMER/USER’s actions or configurations, applications or operating systems administered by them, third-party services or infrastructure, cyberattacks or abnormal traffic volumes that cannot be prevented through reasonable measures, force majeure or other causes not attributable to the PROVIDER. Downtime is taken into account insofar as it actually affects the contracted service and can be confirmed using the monitoring systems and technical information available to the PROVIDER. Any compensation or remedies for failure to meet guaranteed availability are granted only where expressly provided for in the applicable specific conditions, service description or commercial offer. Art. 3.2. The PROVIDER is not liable for modification, alteration, loss or impairment of information or communications after they have left the infrastructure and systems under its direct control. Art. 3.3. Connectivity services for the PROVIDER’s infrastructure are available around the clock. The PROVIDER uses separate connections to electronic communications networks and applies technical and operational measures to ensure connectivity availability and resilience. In the event of cyberattacks, DoS/DDoS attacks, abnormal traffic volumes or other situations liable to affect infrastructure security, stability or operation, the PROVIDER may apply technical protective measures, including filtering, limiting, redirecting or temporarily blocking traffic or affected IP addresses. The measures applied depend on the nature and seriousness of the incident and may remain in place as long as necessary to protect the PROVIDER’s infrastructure, connectivity providers and services supplied to other customers. Art. 3.5. For shared web hosting services, the PROVIDER may use common technical configurations and apply resource limits or other technical measures according to the contracted service, to ensure security, availability, stability and fair infrastructure use by customers hosted on the same systems. Art. 3.6.1. The PROVIDER makes available dedicated channels for reports and communications submitted under Regulation (EU) 2022/2065 on digital services – the Digital Services Act (DSA) and Romanian Law no. 50/2024. Art. 3.6.2. For reporting allegedly illegal content hosted on the PROVIDER’s infrastructure, USERS, CUSTOMERS, natural persons, legal entities or interested third parties may use the dedicated channel available at: Art. 3.6.3. For official communications submitted by competent authorities under the DSA, the PROVIDER makes available a dedicated contact point through the same page: Art. 3.6.4. Reports concerning allegedly illegal content must allow the clear identification of the content concerned. The report must include, where applicable, the exact URL, domain name, IP address or affected service, a clear description of the reported content, the reasons why the content is considered illegal, the contact details of the person or entity submitting the report and any relevant documents or information. Art. 3.6.5. Incomplete, general, manifestly unfounded reports or reports that do not allow the clear identification of the content concerned may require additional clarification. Until the necessary clarifications are received, the PROVIDER may not be able to fully assess the report or apply measures to the reported service. Art. 3.6.6. Submitting a report does not automatically result in the removal of content, restriction of access, suspension of the service or termination of the contract. Each report is assessed based on the information provided, the applicable legal framework, the nature of the affected service and the PROVIDER’s role as an intermediary service provider. Art. 3.6.6.1. Upon receipt of a report, the PROVIDER may, as applicable: The assessment of a report does not imply an obligation on the part of the PROVIDER to adopt any particular measure and does not automatically result in the removal of content, restriction of access, suspension of the service or termination of the contractual relationship. Art. 3.6.7. The PROVIDER does not perform general preventive monitoring of the content published, transmitted, stored or administered by the CUSTOMER/USER through the contracted services. The CUSTOMER/USER is responsible for the content, applications, files, data, services, communications and activities under their control and carried out through the contracted services, within the limits of the law and these Terms and Conditions. Art. 3.6.8. Depending on the nature of the report, the seriousness of the situation, the technical or legal risks and the information available, the PROVIDER may apply one or more proportionate measures, including but not limited to: Art. 3.6.9. In urgent, obvious or high-risk cases, such as phishing, malware, compromise of systems, cyberattacks, distribution of manifestly illegal content, infringement of third-party rights, imminent harm or official requests from competent authorities, the PROVIDER may apply immediate measures to restrict, suspend or isolate the affected service, without prior notice, with the CUSTOMER/USER being informed afterwards where permitted by law. Art. 3.6.10. In the case of VPS services, dedicated servers, colocation, services with root access, services with direct administrative access or other services where the CUSTOMER/USER controls the operating system, applications or content, the PROVIDER has no obligation and, in many situations, no technical possibility to directly modify the hosted content. In such cases, the available measures may include customer notification, remediation request, access restriction, service suspension, data preservation or service termination, as applicable. Art. 3.6.11. Where the PROVIDER applies a restriction, suspension, removal, disabling or termination measure because content has been found illegal or incompatible with these Terms and Conditions, the PROVIDER will communicate a clear and specific statement of reasons to the affected CUSTOMER/USER, as prescribed by Regulation (EU) 2022/2065. The statement may include, as applicable, the nature and duration of the measure, the facts and circumstances considered, including whether the measure followed a report or an own-initiative investigation, the applicable legal basis or contractual provisions, and information on how to challenge the measure. The PROVIDER will not provide such information where its communication is prohibited or restricted by applicable law or by a request or order of a competent authority. Art. 3.6.12. The CUSTOMER/USER may submit clarifications, additional information or requests for reassessment of the measures applied through the existing ticket or the contact channels indicated by the PROVIDER. The request must contain sufficient information for reassessment, including identification of the affected service, the grounds relied upon and, where applicable, relevant documents or information. Art. 3.6.12.1. The PROVIDER may consider a report resolved once the assessment has been completed and the adopted decision has been communicated, without prejudice to the reassessment of the matter where new relevant information becomes available, a court decision is issued, a competent authority adopts a binding measure or other circumstances arise that justify reopening the assessment. Art. 3.6.13. The PROVIDER may keep internal records regarding DSA reports, official communications, measures applied, decisions taken and related correspondence, including through the ticketing system, logs, internal notes and other audit means. These records may be used to demonstrate compliance, to defend the PROVIDER’s rights, to fulfill legal obligations or to cooperate with competent authorities. Art. 3.6.14. The PROVIDER publishes transparency reports on content moderation and measures concerning intermediary services in the circumstances and at the intervals prescribed by Regulation (EU) 2022/2065. Irrespective of a statutory publication obligation, the PROVIDER may voluntarily publish aggregated information on reports received, categories of requests and measures applied. Published reports or information will not include personal data, customers’ confidential data or other information whose disclosure is prohibited by applicable law or may affect service security or third-party rights. Public transparency reports are available at: Art. 3.6.15. DSA channels are not intended for commercial requests, ordinary technical support requests, billing issues, sales requests, routine administrative issues or other communications that do not fall within the scope of Regulation (EU) 2022/2065. For these situations, the CUSTOMER/USER must use the usual support departments available in the customer portal. Art. 3.7.1. The CUSTOMER/USER may use external services such as proxy, CDN, DNS, web application firewall, DDoS protection, cache, traffic filtering or other intermediary services provided by third parties. Art. 3.7.2. If the CUSTOMER/USER configures such an external service in front of the services provided by the PROVIDER, the contractual relationship, configuration and operation of that external service belong to the CUSTOMER/USER and the respective third-party provider. Art. 3.7.3. The PROVIDER is not responsible for unavailability, errors, messages such as “Host Error”, “Origin Error”, “DNS Error”, “Timeout”, “Connection Failed”, certificate errors, cache errors, traffic blocks, firewall rules, filtering, DNS propagation issues, rate limiting, incorrect configurations or other problems insofar as generated by external services used, contracted or configured by the CUSTOMER/USER or their third-party providers. Art. 3.7.4. When using a proxy, CDN, DNS, firewall or other intermediary service, the diagnosis of an issue must take into account the entire technical path: end user – third-party provider – PROVIDER’s infrastructure – CUSTOMER/USER’s service. An error displayed by the third-party provider does not automatically represent a defect of the PROVIDER’s services. Art. 3.7.5. The CUSTOMER/USER is responsible for correctly verifying and administering DNS, proxy, CDN, SSL/TLS, firewall, cache and any other settings made in external platforms used in connection with the contracted services. Art. 3.7.6. The PROVIDER may provide best-effort assistance to identify the cause of a problem, but has no obligation to administer, modify, repair or guarantee the operation of external services contracted directly by the CUSTOMER/USER from third parties. Art. 3.7.7. Where the available technical checks establish that the PROVIDER’s services operate correctly at infrastructure or origin-service level and the incident is caused by a proxy, CDN, DNS service, firewall or other third-party service used by the CUSTOMER/USER, the incident does not constitute unavailability attributable to the PROVIDER and is not counted when determining service availability or any related compensation. Art. 3.7.8. The PROVIDER may request the CUSTOMER/USER to temporarily disable the third-party service, change DNS, bypass the proxy, test the origin service directly or provide logs and technical information for the correct diagnosis of the situation. Art. 3.8.1. Contracting a virtual service, web hosting service, VPS/VDS, cloud, storage, backup or any other service provided through the PROVIDER’s infrastructure does not grant the CUSTOMER/USER any right of physical access to data centres, technical areas, communications rooms or other locations where equipment used for the provision of the services is installed. Art. 3.8.2. Physical access may be permitted only where the nature of the contracted service justifies such access, including certain colocation services, and only with the PROVIDER’s prior approval and in accordance with the security, identification, scheduling and access procedures applicable to the relevant location. Art. 3.8.3. The PROVIDER may refuse, restrict, condition or reschedule physical access where such access is not necessary for the provision of the contracted service or where it may affect security, confidentiality, service continuity, the PROVIDER’s infrastructure, other customers or contractual obligations undertaken towards third parties. Art. 3.8.4. Contracting the services does not grant the CUSTOMER/USER any general right to audit, inspect or directly examine the PROVIDER’s infrastructure, systems, networks, configurations, internal procedures, technical documentation or premises. Art. 3.8.5. Requests for audits, assessments, inspections, completion of compliance questionnaires, provision of documentation, participation in supplier assessment procedures or other similar requests shall be reviewed taking into account the nature of the contracted service, applicable legal obligations, the reasonableness of the request and the resources required to process it. Art. 3.8.6. The PROVIDER may make the processing of the requests referred to in Art. 3.8.5 subject to the execution of a confidentiality agreement, restrictions on the information provided, the use of existing reports or documentation, and payment of the costs associated with working time, travel, interventions, preparation of documentation or the involvement of technical, administrative or legal personnel. Art. 3.8.7. The PROVIDER shall not be required to disclose confidential information, trade secrets, security configurations, data relating to other customers, complete network topologies, credentials, information that may affect the security of the infrastructure or information whose disclosure is restricted by law or by contractual obligations undertaken towards third parties. Art. 3.8 does not exclude mandatory GDPR verification rights, exercised under the confidentiality and security conditions in Art. 11.10. Art. 4.1–4.2 concern CHROOT as controller for its own data processing. Art. 4.3 and 11.9 apply to data hosted on behalf of the CUSTOMER. Art. 4.1. In the event of a personal data breach, the PROVIDER will assess the nature of the incident, the categories of data affected, the potential consequences and the risks to individuals’ rights and freedoms. Where the personal data breach is likely to result in a risk to individuals’ rights and freedoms, the PROVIDER will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of it, as prescribed by applicable law. Art. 4.2. Where a personal data breach is likely to result in a high risk to individuals’ rights and freedoms, the PROVIDER will inform the affected data subjects without undue delay, as prescribed by applicable law. Communication to data subjects is not required in circumstances exempted by applicable law, including where the PROVIDER has implemented appropriate technical and organisational protective measures and applied them to the affected data, such as encryption rendering the data unintelligible to unauthorised persons, or has taken subsequent measures ensuring that the high risk is no longer likely to materialise. Art. 4.3. Where the PROVIDER processes personal data on behalf of the CUSTOMER/USER as a processor, it will inform the CUSTOMER/USER without undue delay of personal data breaches of which it becomes aware affecting processing carried out on their behalf, in accordance with applicable law. The CUSTOMER/USER, as controller, remains responsible for assessing their obligations to notify the supervisory authority and, where applicable, inform data subjects. Art. 5.1. Orders for the PROVIDER’s services are placed through its website or platforms. The CUSTOMER/USER shall provide complete, accurate and current details and is responsible for their accuracy. Art. 5.2. After the order is completed, the documents and information necessary for payment are sent to the email address associated with the customer account and/or made available in the Customer Account. A pro forma invoice is not a tax invoice. Art. 5.3. The CUSTOMER/USER pays in advance for the contracted service period unless the PROVIDER and CUSTOMER/USER have agreed other billing or payment conditions in writing. Art. 5.4. Pro forma invoices and payment notifications may be sent electronically and are available, where applicable, in the Customer Account. The CUSTOMER/USER must pay by the due date indicated in the payment document. Art. 5.5. Service and product prices are those displayed on the PROVIDER’s website, communicated during the order process or established by an individual commercial offer accepted by the CUSTOMER/USER. Costs for additional features, resources or services requested by the CUSTOMER/USER are determined under the applicable price list or commercial offer communicated by the PROVIDER. Art. 5.6. Service prices are set in euro, exclude VAT and are converted into Romanian lei using the EUR/RON exchange rate published by the National Bank of Romania and available to and retrieved by the PROVIDER through its automatic update mechanisms, plus 2%. If the exchange-rate source is temporarily unavailable or automatic updating is not possible, the PROVIDER may use the latest exchange rate successfully retrieved. The CUSTOMER/USER shall pay for the services provided and any additional services, resources or options requested and supplied by the PROVIDER. Art. 5.7. The PROVIDER reserves the right to change service and product prices, including as a result of changes in operational costs, supplier prices, economic conditions, exchange rates, taxes, legal obligations or other factors affecting the cost of service provision. Price changes for recurring services will be communicated to the CUSTOMER/USER before application and will take effect for billing periods following the date specified in the notice. If the CUSTOMER/USER does not accept the new prices, they may request termination before the change takes effect, subject to payment obligations for services already provided. Continued use or renewal after the new prices take effect constitutes acceptance of the updated prices insofar as permitted by applicable law. Art. 5.8. Once receipt of payment is confirmed, the PROVIDER issues the tax invoice in accordance with applicable tax law. Art. 5.9. Tax invoices are issued and communicated electronically in accordance with applicable law. They are available, where applicable, in the Customer Account and/or sent electronically. Where legislation requires submission through Romania’s national electronic invoicing system, RO e-Factura, the PROVIDER will submit the invoice through that system under the conditions and within the periods prescribed by law. Art. 5.10. Services are activated or renewed after the PROVIDER confirms receipt of payment, depending on the service and the technical time required to provide it. In justified circumstances, the PROVIDER may request additional information or documents necessary to identify and verify a payment. Art. 5.11. The payment date is the date on which the amount paid by the CUSTOMER/USER is received in the PROVIDER’s account or confirmed through the PROVIDER’s payment processor. Art. 5.12. If amounts owed remain unpaid for 7 (seven) calendar days after the due date, the PROVIDER reserves the right to suspend, limit or restrict access to the services corresponding to the unpaid amounts, without an additional prior notice, until payment in full. Art. 5.13. Any payment extension is granted at the PROVIDER’s discretion and must be confirmed in writing. Failure to suspend, limit or restrict services immediately after the payment deadline does not waive the PROVIDER’s right to apply those measures later or terminate services if outstanding amounts remain unpaid. Art. 5.14. Where a service is suspended, expires or terminates due to non-payment, the PROVIDER reserves the right to permanently delete its data after the retention period applicable to that service type has elapsed. The retention period may vary according to the service, technical resources used and applicable specific conditions. The PROVIDER does not guarantee retention or recovery of data after service expiry unless an express provision to the contrary applies to the contracted service. CHROOT is a RoTLD partner for .RO domain registration and administration. Art. 6.1. Registration, transfer, renewal and administration of .RO domains are carried out under RoTLD’s rules, procedures and conditions and applicable law. The terms and rules applicable to .RO domains are available on RoTLD’s website. Art. 6.2. International domains are registered through the registries, registrars or partner providers used by the PROVIDER and are subject to the rules, policies and procedures applicable to the relevant domain extension. Registration, transfer or activation time may vary according to the domain extension, necessary checks, documents requested by the registry or registrar and the procedures of the providers involved. Art. 6.3. The CUSTOMER/USER is responsible for providing complete, accurate and current details required for domain registration and administration, and updating them when changes occur. Domain-related data may be published, hidden, redacted or made available through registration data access services under the rules of the registry, registrar, domain extension and applicable law. The availability and conditions of registration data protection services, such as WHOIS Privacy, ID Protection or similar services, may vary according to the domain extension and providers involved. Art. 6.4. Domain registration depends on availability when the request is actually processed. Displaying a domain as available in the PROVIDER’s systems does not guarantee registration until confirmed by the competent registry or registrar. Art. 6.4.1. Adding a domain to the shopping cart, submitting an order, issuing an invoice, making payment or receiving automatic order confirmation does not reserve or guarantee domain availability or registration. Art. 6.4.2. If another person registers a domain before registration is completed, whether through the PROVIDER, another registrar or directly with the competent registry, the PROVIDER cannot be held liable for the inability to register it. Art. 6.5. The PROVIDER does not guarantee registration, transfer or renewal where the operation is refused, restricted, cancelled or delayed by the registry, registrar or provider involved for reasons not attributable to the PROVIDER. Art. 6.5.1. For certain extensions, some domains may be classified by the registry or registrar as premium, reserved, restricted or subject to special registration, eligibility or pricing conditions. The PROVIDER may require payment of the applicable price, refuse to process the order or cancel it if the domain cannot be registered on the conditions initially displayed. Art. 6.5.2. If registration, transfer or renewal cannot be completed for reasons not attributable to the PROVIDER, including domain unavailability, premium classification, registry or registrar restrictions, changes to registration conditions or other registry or registrar decisions, the PROVIDER will refund only the amounts paid for the service that could not be performed, without other compensation, interest or penalties. Art. 6.5.3. The PROVIDER does not guarantee availability of any particular domain and is not liable for decisions of registries, registrars or competent authorities concerning domain allocation, reservation, suspension, transfer, revocation, deletion or administration. Art. 6.6. The CUSTOMER/USER is responsible for checking domain details, associated contact details and domain status. The PROVIDER may send expiry or administration notices, but the CUSTOMER/USER remains responsible for requesting and paying for renewal on time. Art. 6.7. Registration, transfer, renewal or administration does not grant the PROVIDER rights over the domain name or its associated content. The CUSTOMER/USER is responsible for choosing the domain name and respecting third-party rights and applicable law. Art. 7.1. The commercial money-back guarantee applies exclusively to shared web hosting services and is separate from the statutory consumer right of withdrawal under Art. 2.19 and applicable law. Where the CUSTOMER/USER has benefited from a free period, testing period, trial, promotional credit or another facility allowing use without payment for that period, that period counts towards the 30-day commercial money-back guarantee. A free period, trial or similar facility does not start a new 30-day period upon subsequent payment, renewal or conversion to a paid service. Discounts, promotional codes and reductions applied to paid services do not count as free or trial periods for this article. Requests under the commercial money-back guarantee must be submitted through the support ticket system. The CUSTOMER/USER must provide the information necessary to identify the service and process the refund. Art. 7.2. The following service categories are excluded from the commercial money-back guarantee in Art. 7.1: Exclusion from the commercial money-back guarantee does not restrict consumers’ statutory rights under applicable law. Art. 7.3. The commercial money-back guarantee does not apply to extension or renewal of existing services. Art. 7.4. The commercial money-back guarantee may be refused where the CUSTOMER/USER has breached this contract, the Acceptable Use Policy or applicable law, or used the service abusively, fraudulently or in bad faith. Art. 7.5. Payments for services excluded from the commercial money-back guarantee in Art. 7.1 are not refundable under this commercial policy. Art. 7.5.1. No refund is granted for fees, commissions or other costs charged by registries, registrars, authorities, payment institutions or other third-party providers insofar as the PROVIDER cannot recover those amounts. Art. 7.6. For recurring services, termination at the CUSTOMER/USER’s request does not, under this commercial policy, entitle them to a pro-rata refund of the paid but unused period unless the PROVIDER expressly agrees or applicable law requires otherwise. Art. 7.7. Changing nameservers, DNS records or domain configuration does not itself constitute a request to terminate hosting and does not suspend the CUSTOMER/USER’s contractual or payment obligations. Termination must be requested through the means provided by the PROVIDER. Art. 7.8. Approved commercial guarantee refunds will be made using a method determined by the PROVIDER, taking into account, where applicable, the original payment method and technical processing possibilities. Art. 7.9. The same CUSTOMER/USER may use the commercial money-back guarantee only once for the same service type. The PROVIDER may refuse repeated or abusive requests aimed at obtaining successive free use of the services. Art. 8.1. The PROVIDER is liable for direct, certain and proven loss caused to the CUSTOMER/USER by a failure to perform contractual obligations attributable to the PROVIDER, within the limits of this contract and applicable law. To the extent permitted by applicable law, the PROVIDER is not liable for indirect loss, loss of profit, business opportunities or revenue, or other indirect consequences of service use or temporary unavailability. The PROVIDER is not liable for unavailability, data loss, interruptions or other loss caused by circumstances not attributable to it, including the CUSTOMER/USER’s acts or omissions, configurations or applications administered by them, third-party services, cyberattacks, incidents external to the PROVIDER’s infrastructure, force majeure or other situations beyond the PROVIDER’s reasonable control. This article does not exclude or limit the PROVIDER’s liability where such exclusion or limitation is prohibited by applicable law. Art. 8.2. The PROVIDER supplies technical support within the features and conditions of the contracted service. Support does not include administration, configuration, troubleshooting or modification of operating systems, applications, scripts or services administered by the CUSTOMER/USER unless expressly included in the contracted service or a separate commercial offer. Art. 8.3. The PROVIDER may make third-party applications, scripts, automatic installers or other software components available to the CUSTOMER/USER. The PROVIDER does not guarantee their permanent availability, compatibility, security or operation and is not obliged to support them unless expressly agreed otherwise. Art. 8.4. The PROVIDER is not the author, publisher or editorial administrator of content published, transmitted, stored or administered by the CUSTOMER/USER through the contracted services. The CUSTOMER/USER is responsible for the lawfulness, security and compliance of content, applications, files, data, communications and activities under their control. Art. 8.5. As an intermediary service provider, the PROVIDER benefits from the liability exemptions prescribed by applicable law where the legal conditions are met. The PROVIDER may assess and apply measures following a report, a request or order from a competent authority, or identification of information or circumstances indicating potentially illegal content or activity. Specific measures, voluntary investigations or assistance to the CUSTOMER/USER do not in themselves create a general monitoring obligation or editorial control over content administered by the CUSTOMER/USER. Art. 8.5.1. To the extent permitted by applicable law, the CUSTOMER/USER shall indemnify and hold the PROVIDER harmless against any demands, claims, actions, judicial or administrative proceedings, penalties, litigation expenses, legal fees, damages or other costs incurred by the PROVIDER arising from content, services, activities or acts under the CUSTOMER/USER’s control or responsibility, insofar as attributable to the CUSTOMER/USER. Art. 9.1. The CUSTOMER/USER may submit reports, complaints or requests concerning the services through the contact channels provided by the PROVIDER. Termination at the CUSTOMER/USER’s request and any refunds are governed by this contract, including Art. 2.19 on withdrawal and Chapter 7 on the refund policy. Art. 9.2. The PROVIDER may investigate security incidents, abusive service use, breaches of this contract and activities liable to affect infrastructure security, stability or operation, or third-party rights. The PROVIDER will cooperate with competent authorities under the conditions and within the limits prescribed by applicable law. The CUSTOMER/USER is liable for acts and activities attributable to them under applicable law. Art. 9.3. Where the CUSTOMER/USER has several services, accounts or resources administered through the same customer account or within a reseller service, the PROVIDER may also apply measures to associated services where the nature, seriousness or scale of the breach indicates a risk to the PROVIDER’s infrastructure, other customers, third parties or continued secure service provision. Measures depend on the nature and seriousness of the situation and may include limiting, restricting, suspending or, in serious or repeated cases, terminating affected or associated services. Art. 9.4. Where a breach of this contract is established, the PROVIDER may notify the CUSTOMER/USER and request remediation within a period determined by the nature and seriousness of the breach. In cases of serious or repeated breaches, security incidents, illegal activities or situations posing an immediate risk to the PROVIDER’s infrastructure, other customers or third parties, the PROVIDER may immediately limit, restrict, suspend or terminate the service without prior notice, insofar as permitted by applicable law. Where a measure follows content considered illegal or incompatible with these Terms and Conditions, the PROVIDER will give the affected CUSTOMER/USER the reasons for the measure as prescribed by Art. 3.6 and applicable law. Art. 9.5. The PROVIDER assesses potential breaches of this contract using the available information and circumstances, the nature of the service, identified risks and applicable law. Measures depend on the nature and seriousness of the breach and may include warnings, requests for remediation, limitation or restriction, temporary suspension or termination, subject to this contract and applicable law. Non-compliance with this contract may justify the measures set out in this article. Art. 10.1. The PROVIDER may organise promotions, campaigns or trials, or grant promotional codes, discounts or other commercial benefits under the conditions and for the period communicated through the website, Customer Account, email or other official channels used by the PROVIDER. Art. 10.2. Promotions and commercial benefits are valid for the period and under the conditions communicated for each campaign. The PROVIDER may set specific conditions concerning eligible services, customer category, contract period, payment method, number of uses or other eligibility criteria. Art. 10.3. Promotional codes, discounts, loyalty discounts and other commercial benefits cannot be combined unless the PROVIDER expressly states otherwise. A promotion or discount does not change the service’s standard renewal price unless its conditions expressly extend the discount to subsequent periods. These Terms and Conditions are supplemented by the order accepted by the CUSTOMER/USER, the specific conditions of the contracted service, any individual commercial offer and written communications between the parties. In the event of discrepancies, an individual commercial offer or an agreement negotiated and accepted in writing by the parties prevails over these Terms and Conditions solely for the matters expressly addressed in those documents. This document is governed by Romanian law. If interpretation differs between the Romanian version and any translation, the Romanian version prevails. Other language versions are for information unless the parties expressly agree otherwise in writing. The PROVIDER may amend these Terms and Conditions for justified reasons, including legislative or regulatory changes, changes to the services, infrastructure, technologies used, security requirements, supplier or partner conditions, service provision costs or operational or commercial conditions. Changes significantly affecting the CUSTOMER/USER’s rights or obligations for recurring services will be communicated electronically or through the Customer Account before application, to the extent and within the period required by applicable law. If the CUSTOMER/USER does not accept a significant change applicable to a recurring service, they may request termination before the change takes effect, subject to obligations for services already provided. Changes that do not significantly affect the CUSTOMER/USER’s rights or obligations, including correction of clerical errors, drafting clarifications, contact detail or URL updates, or changes required by applicable law, may take effect upon publication. Art. 11.1. Scope. This agreement forms part of the contract between CHROOT and the CUSTOMER identified in the accepted order and applies where CHROOT processes personal data on their behalf. The CUSTOMER is a controller or a processor authorised to appoint CHROOT as a subprocessor. For data used for its own purposes, such as account administration and billing, CHROOT is a separate controller. This agreement and amendments are accepted in writing, including electronically, with evidence retained and a copy made available to the CUSTOMER; publication alone does not replace acceptance required by law. Art. 11.2. Subject matter and duration. CHROOT provides the technical functions of hosting, email, servers, storage and the contracted backup or support services. The CUSTOMER determines the content, purposes of use and authorised persons. Technical operations may include storage, transmission, delivery, access for persons authorised by the CUSTOMER, replication, backup, restoration, export and deletion, within the service scope. Processing continues throughout service provision and subsequent return, deletion or legally required retention operations. Art. 11.2.1. Content confidentiality. In ordinary service provision, CHROOT personnel do not read correspondence, routinely examine files or databases, or search them for information for their own purposes. “Processing” under the GDPR includes storage or transmission alone, without personnel reading the information. Automated antispam, antivirus and other security functions, where enabled, may technically analyse messages or files. Human access to content is permitted only insofar as necessary to follow the CUSTOMER’s instructions, carry out a justified security intervention or fulfil legal obligations, including those concerning illegal content; access is limited, authorised, confidential and documented. Content is not used for advertising, commercial profiling or training artificial intelligence models for CHROOT’s own purposes. Art. 11.3. Data subjects and data. Content supplied by the CUSTOMER may concern their personnel, customers, users, correspondents, suppliers and partners and may include identification, contact and authentication data, online identifiers, professional, contractual and transactional data and other information in files, databases and messages, together with associated metadata and logs. This is a description for the DPA and does not involve routine inventorying or examination of content by CHROOT. For special categories of data, minors’ data or data covered by Art. 10 GDPR, the CUSTOMER ensures the necessary legal bases and safeguards and selects a suitable service. Special requirements needing additional configuration or services must be communicated without unnecessarily transmitting sensitive documents. The DPA does not certify the CUSTOMER’s applications or sector-specific compliance. Art. 11.4. Instructions. The order, configurations and requests from authorised persons constitute documented instructions within the service scope. The CUSTOMER ensures lawful use, information to data subjects and the right to transmit the data. CHROOT processes only on documented instructions, including for transfers, except where required by applicable law, of which it informs the CUSTOMER beforehand if legally permitted. If CHROOT considers an instruction to infringe data protection law, it immediately informs the CUSTOMER and does not execute the unlawful instruction. Art. 11.5. Personnel and security. Access is restricted to authorised personnel bound by confidentiality. CHROOT applies measures appropriate under Art. 32 GDPR, proportionate to the risks and its responsibilities, including MFA, logs, encryption where appropriate and restoration testing. Applicable measures are documented and assessed according to risk, without guaranteeing the absence of every incident. Full encryption or MFA for CUSTOMER-administered applications is not guaranteed. The CUSTOMER is responsible for accounts, access and applications under their control; for unmanaged services, they also manage the operating system. CHROOT is responsible for components under its control within the contracted service and the law. Its own security obligations are not excluded by Art. 2.16; they do not create a commercial backup service with parameters that have not been contracted. Art. 11.6. Subprocessors. Engaging a subprocessor requires the CUSTOMER’s prior specific or general written authorisation. Identity, activities, processing countries and relevant safeguards are communicated through confidential documentation without publishing the general list of partners. Under general authorisation, additions or replacements are notified in advance, giving an effective opportunity to object before engagement; the procedure and notice period are documented. Urgency does not replace the necessary authorisation. CHROOT imposes the same relevant obligations on the subprocessor and remains responsible to the CUSTOMER for their performance under Art. 28(4) GDPR. Art. 11.7. Locations and external access. Hosted content and backups managed by CHROOT are stored in Romania and other EU Member States. Troubleshooting without external access is preferred; where necessary, technical providers may receive specific access, including from outside the EU, on request, monitored, limited to the intervention and withdrawn on completion. Countries, recipients and safeguards are documented and communicated to the CUSTOMER confidentially. Transfers comply with instructions and Chapter V GDPR through adequacy decisions or appropriate safeguards, including standard contractual clauses and supplementary measures where applicable. Hosting location does not automatically extend to external providers’ administrative data. Physical infrastructure addresses and sensitive security details are not published. Art. 11.8. Assistance. Taking into account the nature of processing and information available, CHROOT assists the CUSTOMER with data subject requests and obligations under Art. 32–36 GDPR, including impact assessments and consultation with the authority. Requests received directly concerning the CUSTOMER’s data are forwarded without undue delay; CHROOT does not respond on the CUSTOMER’s behalf without instructions or a legal obligation. Statutory assistance concerns operations and information under CHROOT’s control; it does not automatically include legal advice, compliance of the CUSTOMER’s applications or unlimited completion of their questionnaires. Additional work is charged under an accepted offer without obstructing legal obligations. Art. 11.9. Incidents. CHROOT notifies the CUSTOMER without undue delay after becoming aware of a breach affecting data processed on their behalf, without waiting for the investigation to finish or for a risk threshold to be exceeded. As information becomes available, CHROOT communicates the nature of the breach, data and persons affected, a contact for further information, consequences and mitigation measures, supplementing missing information later. The controller’s 72-hour deadline is not a waiting period for CHROOT. For its own processing, its controller obligations apply. Art. 11.10. Verification of compliance. CHROOT makes available information necessary to demonstrate compliance with Art. 28 GDPR and allows for and contributes to audits, including inspections, by the CUSTOMER or their mandated auditor. Verification concerns the CUSTOMER’s data and services at reasonable intervals or where there are indications of non-compliance. Documents and remote checks are used first where sufficient, without excluding necessary inspections. Inspections are arranged with reasonable notice, a defined scope, scheduling and confidentiality, adjusted for justified emergencies. Verification is limited to compliance of processing for the CUSTOMER and does not authorise general infrastructure access, access to other customers’ data, credentials or source code, or intrusive testing. Necessary information is provided, as appropriate, through extracts, redaction and controlled access, protecting confidentiality and security without depriving the statutory right of substance. The CUSTOMER bears their auditor’s costs and reasonable, justified and previously communicated costs of additional CHROOT assistance, unless otherwise agreed and where legally permitted. CHROOT does not charge for remedying its own non-compliance or use excessive fees to obstruct statutory verification. Art. 3.8 does not exclude these rights or authorities’ powers. Art. 11.11. Return and deletion. At the end of processing, CHROOT, at the CUSTOMER’s choice, returns the data and deletes copies or deletes it directly, except where retention is legally required. Export uses the service’s functions and formats and a secure channel, without automatically including customised conversions or administration of the new provider. Chapters 15 and 17 and mandatory obligations apply. Backups are protected and removed under the documented cycle, without a general exception to statutory deletion; deletion instructions are reapplied upon restoration. Legally required retention is limited in purpose and duration. Operations are confirmed on request; return does not extinguish amounts lawfully owed. Art. 11.12. Documentation and liability. The order, specific conditions and DPA documentation specify the service, parties, contacts, operations, data and data subject categories, measures, subprocessors, countries and transfers, retention and export. The CUSTOMER supplies information on their use and CHROOT on its service and providers; changes are documented. GDPR requests use the channels in Art. 1.4.9 without assuming that a DPO has been appointed. No clause limits data subjects’ rights, authorities’ powers or mandatory liability, including Art. 82 GDPR. Art. 12.1. Obligations apply according to the service’s actual function. Hosting is not automatically an online platform. The exemption in Art. 6 DSA requires the legal conditions to be met, including expeditious action after actual knowledge of illegality; the absence of general monitoring does not permit well-founded notices to be ignored. Art. 12.2. The channels in Art. 3.6 accept Romanian and English communications and allow direct contact without relying exclusively on automated tools. Reporting illegal content does not require a contract with CHROOT. The notice mechanism must allow submission of the reasons for illegality, the exact location, the notifier’s name and email and a statement of good faith. Identity and email are not mandatory in the exceptions under Art. 16 DSA concerning offences in Art. 3–7 of Directive 2011/93/EU. Art. 12.3. Where electronic contact details are available, CHROOT acknowledges receipt and communicates the decision and redress options without undue delay. Assessment is timely, diligent, objective and non-arbitrary; use of automated means is disclosed as required by law. These obligations are not optional when applying Art. 3.6.6.1. Art. 12.4. In cases covered by Art. 17 DSA, affected recipients whose electronic contact details are known receive reasons no later than the restriction is imposed: the measure and, where relevant, its duration and scope, the facts, the notice or own-initiative investigation, automation used, the legal or contractual basis and explanation of its application, and redress options. Statutory exceptions and prohibitions on disclosure are respected; urgency alone does not remove the obligation. Art. 12.5. Reassessment may be requested through the channels in Art. 3.6.12, without prejudice to judicial remedies or complaints to the Digital Services Coordinator, ANCOM in Romania. Art. 20–21 DSA obligations apply only to services and providers within their scope, subject to statutory exemptions; in that case, eligible complaints are free, available for at least six months and not decided solely by automated means. Art. 12.6. Authorities’ orders are handled under Art. 9–10 DSA and Law no. 50/2024. Suspected criminal offences threatening persons’ lives or safety are reported under Art. 18 DSA. Restrictions are proportionate and respect the parties’ rights. Transparency complies with Art. 14–15 DSA and Regulation (EU) 2024/2835 where applicable, including statutory exemptions based on provider size. Art. 13.1. Each operation is subject to the extension’s rules, made available before contracting, identifying the registry/registrar where necessary. Eligibility conditions, premium prices and recovery costs are communicated before acceptance. Third-party rules do not override mandatory law or CHROOT’s own liability. Art. 13.2. .ro. The RoTLD registration rules, registration agreement and dispute resolution policy apply. The registered holder may differ from the payer; anyone acting for the holder must be authorised. Transfer of administration, transfer of the right of use and DNS changes are separate operations. Renewal and disputes follow registry rules, without automatically applying ICANN gTLD time limits. Art. 13.3. .eu, .ею and .ευ. The EURid rules and applicable documents published in the official repository, including terms and ADR rules, apply. The holder must remain eligible: a citizen of the EU, Iceland, Liechtenstein or Norway regardless of residence; a natural person resident in, or an undertaking/organisation established in, the eligible territories. The holder must keep details accurate and current, maintain a functioning email address and respond to verification requests. Registration is for 1–10 years; tacit renewal under registry rules does not by itself authorise a debit or recurring order with CHROOT. Termination and deletion requests are processed through the registrar in good time under the applicable rules. Art. 13.4. Other extensions. Relevant registry and registrar policies apply to gTLDs, including registrant rights, transfers, expiry/recovery, UDRP and, where applicable, URS. Other country-code extensions have their own rules; the operator can be identified through IANA. Examples include DENIC .de, Nominet .uk and AFNIC .fr. These references do not imply that CHROOT offers every extension. Art. 13.5. The CUSTOMER monitors expiry and pays on time; CHROOT fulfils its own notification and other obligations. Grace and recovery periods vary, and recovery is not guaranteed. Legitimate transfers are facilitated under applicable policies. Hosting termination does not automatically transfer or delete a domain. Commercial exclusions do not override mandatory rights or liability for one’s own acts. Art. 14.1. Before ordering, the service, limits, price, duration, renewal and termination conditions are communicated; input errors can be corrected. The stage at which the contract is concluded is indicated in the order process, and the accepted version and evidence are retained. The contract and confirmation are provided on a durable medium where legally required. Consumers are shown the total including VAT and mandatory costs; additional paid options require express consent. Art. 14.2. The commercial guarantee and SLA do not replace statutory withdrawal rights or mandatory remedies. Activating ongoing hosting does not constitute full performance of the subscription. Withdrawal exceptions apply only under the statutory conditions, not merely because external costs or a customised configuration are involved. Services covered by Government Emergency Ordinance no. 141/2021 are subject to its conformity, update and remedy requirements. Statutory refunds are not conditional on accepting credit. Consumers may, but need not, use this model: “To SC CHROOT NETWORK SRL, using the contractual contact details: I hereby give notice of withdrawal from the contract for [service/order], concluded on [date]. Name: […]; address: […]; date: […]; signature, only if on paper: […].” Art. 14.3. For its own processing, CHROOT applies the appropriate basis for each purpose: contract, legal obligation, assessed legitimate interests or consent. Company representatives’ data is not automatically processed on the basis of a contract with those individuals. CNP and identity documents are requested only where justified and proportionate. GDPR rights, including access, rectification and restriction, are exercised through Art. 1.4.9; a response is normally provided within one month, with a reasoned statutory extension of up to two further months. Identity checks are proportionate; the rules on free requests and exceptions are those prescribed by law. International transfers comply with Chapter V GDPR; information on destinations, safeguards and obtaining a copy is provided as required by law. Art. 14.4. Communications necessary for the service are distinct from marketing. Marketing and cookies that are not strictly necessary comply with Law no. 506/2004, including consent where required, the conditions for exceptions and simple withdrawal/unsubscription. Art. 14.5. NIS2 obligations apply under Government Emergency Ordinance no. 155/2024, approved by Law no. 124/2025, according to the actual activities and classification. NIS2 reporting does not replace GDPR or DSA obligations. Orders and services covered by Regulation (EU) 2021/784 are subject to the statutory one-hour deadline for removing or blocking terrorist content, with the statutory safeguards and exceptions; that deadline does not automatically apply to private reports. European electronic evidence orders are handled under Regulation (EU) 2023/1543, applicable from 18 August 2026, verifying the issuer, limiting data and respecting applicable deadlines, information duties and remedies. Art. 14.6. No clause excludes liability that cannot lawfully be limited, mandatory consumer or data subject rights, or authorities’ powers. Indemnification does not automatically transfer penalties for CHROOT’s own acts to the CUSTOMER. Choosing Romanian law does not remove mandatory consumer protection or statutory jurisdiction. Significant changes are communicated as required by law; publication alone does not replace necessary DPA acceptance or express written acceptance of clauses covered by Art. 1203 of the Civil Code. Acceptance does not validate an unfair term. Art. 15.1. For services covered by Chapter VI of Regulation (EU) 2023/2854 (Data Act), CHROOT enables switching providers or moving to the CUSTOMER’s own infrastructure. This right is separate from GDPR portability and does not automatically apply to every domain or colocation service. Art. 15.2. Requests are submitted through contractual support channels. Methods, formats, exportable data and digital assets and justified exclusions are communicated without obstructing switching. Pre-contractual information and the online register under Art. 26 are provided in accordance with the Regulation. The parties cooperate on security and continuity; interoperability and facilitation of functional equivalence comply with Art. 30 according to the service type, without guaranteeing identical functionality in every respect. Art. 15.3. The notice period for initiating switching does not exceed two months, and the transition period is at most 30 calendar days, subject to statutory extensions. Technical infeasibility is justified within 14 working days of the request, indicating an alternative period of at most seven months; the CUSTOMER may request an extension permitted by the Regulation. Data retrieval remains available for at least 30 calendar days after transition. Termination, deletion and the option to delete without switching follow Art. 25, subject to legally required retention. Art. 5.14 and 17 do not permit premature deletion during this procedure. Art. 15.4. Until 11 January 2027 inclusive, switching charges do not exceed legally permitted direct costs and are communicated in advance; from 12 January 2027, no switching charges are imposed in covered cases. Standard service fees and any termination obligations are separate and payable only where lawful; prohibited charges cannot be relabelled. Exceptions for certain customised or testing services apply only under the Regulation’s conditions. This contract is supplemented, within the applicable scope, by the GDPR, Law no. 190/2018, DSA, Law no. 50/2024, Law no. 365/2002, Law no. 506/2004, Government Emergency Ordinance no. 34/2014, Government Emergency Ordinance no. 141/2021, Law no. 193/2000, Government Emergency Ordinance no. 155/2024, Law no. 124/2025, Regulation (EU) 2021/784, Regulation (EU) 2023/1543, the Data Act and the Civil Code, in their applicable versions. Links do not replace specific contractual information. Art. 17.1. Unpaid services. For shared web hosting and reseller web hosting, active data is deleted 30 calendar days after issuance of the pro forma invoice for the service that remains unpaid. Renewal pro forma invoices are normally issued 15 days before expiry; in that case, the period ends 15 days after expiry. For other services, retention is up to 90 days after issuance, according to the specific period communicated for the product. Data is not deleted during an already paid period, before the due date or expiry of a valid extension, or without the contractual suspension/termination conditions being met. Payment before deletion removes the basis for deletion for that non-payment. These periods do not guarantee access to a suspended service and do not automatically extend to other paid services or CUSTOMER equipment not administered by CHROOT. Art. 17.2. Backups. Copies covered by the standard cycle are removed between 90 and 150 days after each copy was created; replication alone does not restart the period. On service termination, the last copy containing the data is relevant. Until removal, access is restricted and deletion instructions are reapplied upon restoration. Other cycles are communicated for each service; this interval does not guarantee that a copy exists or is recoverable and does not derogate from statutory deletion obligations. Art. 17.3. Logs and exceptions. Logs may be retained for up to 180 days after the event, according to category and purpose. Longer retention requires a justified, necessary and proportionate purpose, such as incident investigation, preservation of evidence, a legal obligation or defence of rights. Categories, duration or criteria, legal basis and access are documented and reassessed; data is deleted or anonymised when no longer necessary. Message or file content is not reclassified as logs to avoid deletion. Tax records have their own retention periods; the DPA applies to data processed exclusively on the CUSTOMER’s behalf. Retention does not override export, return or mandatory preservation required by law. Art. 17.4. Compensation. This scheme expressly supplements Art. 3.1. Base B is the amount excluding VAT actually paid, after discounts, for the affected service and incident month; payments for longer or partial periods are allocated proportionately. Independent services are excluded. Total SLA compensation for the same month does not exceed 100% of B, with the legally required tax adjustment. Availability A = 100 × (T − D) / T, where T is the number of minutes in the service period within the month and D is eligible downtime under Art. 3.1. Overlapping incidents are not counted twice. The CUSTOMER’s evidence is assessed together with CHROOT’s monitoring; exclusions do not automatically cover CHROOT’s own fault. Art. 17.5. Procedure. Compensation is requested by ticket within 30 days after the end of the affected month, identifying the service and incidents. CHROOT communicates its reasoned decision and calculation within 30 days of the request. Only one tier applies; percentages are not added together, and the base is zero for free periods. Commercial SLA compensation is granted as credit for CHROOT services within 30 days after approval; cash reimbursement is made where required by law or expressly accepted by CHROOT. SLA credit does not replace statutory refunds. Art. 17.6. Statutory limits. The commercial cap and deadline concern SLA compensation only and do not limit mandatory liability, consumer rights, remedies for non-conformity or data subjects’ rights. There is no double recovery for the same loss, subject to law. The version of these Terms and Conditions in force is the version published on the PROVIDER’s website.
Update history:
Terms & Conditions
Summary
General framework
Rights, obligations and service use
Billing, payments and refunds
Services, security and liability
1. DEFINITIONS OF TERMS
Art. 1.4. INFORMATION ON PERSONAL DATA PROTECTION
Art. 1.4.1. WHAT INFORMATION DO WE COLLECT? HOW DO WE COLLECT IT?
Art. 1.4.2. PURPOSES OF DATA COLLECTION AND PROCESSING
Art. 1.4.3. WHO HAS ACCESS TO THIS DATA?
Art. 1.4.4. HOW TO VIEW, MODIFY AND DELETE THE INFORMATION WE STORE ABOUT YOU
Art. 1.4.5. HOW WE SECURE AND STORE YOUR DATA
Art. 1.4.6. AGE RESTRICTIONS
Art. 1.4.7. CHANGES TO THE PRIVACY PROVISIONS
Art. 1.4.8. COMPETENT DATA PROTECTION AUTHORITY
Art. 1.4.9. QUESTIONS, CONCERNS, COMPLAINTS OR ERASURE REQUESTS
2. RIGHTS AND OBLIGATIONS OF THE USER AND CUSTOMER
Art. 2.19. RIGHT OF WITHDRAWAL
Art. 2.20. RIGHTS TO ERASURE, DATA PORTABILITY AND OBJECTION
3. RIGHTS AND OBLIGATIONS OF THE PROVIDER
Art. 3.4. The PROVIDER shall provide:
Applicable technical limits may include processing resources, memory, processes, input/output (I/O) operations, connections, scheduled tasks (cron jobs) and email sending, without limitation.
For shared web hosting, the minimum cron job interval is 5 minutes unless the PROVIDER expressly sets another limit for particular services or plans.
Email service limits are set out in Art. 2.6.1.Art. 3.6. DSA COMPLIANCE AND ILLEGAL CONTENT REPORTING
https://www.chroot.ro/raportare-continut-ilegal/.
https://www.chroot.ro/raportare-continut-ilegal/.
https://www.chroot.ro/raport-dsa/.Art. 3.7. EXTERNAL SERVICES USED BY THE CUSTOMER: PROXY, CDN, DNS, FIREWALL AND SIMILAR SERVICES
Art. 3.8. ACCESS TO INFRASTRUCTURE, VISITS AND AUDIT REQUESTS
4. NOTIFICATION OF PERSONAL DATA BREACHES
5. BILLING AND PAYMENT POLICY
6. DOMAIN REGISTRATION
7. REFUND POLICY
8. LIMITATION OF LIABILITY
9. FINAL CLAUSES
10. PROMOTIONS
11. AGREEMENT ON PROCESSING DATA ON BEHALF OF THE CUSTOMER (DPA)
12. ADDITIONAL DSA PROCEDURE PROVISIONS
13. ADDITIONAL DOMAIN CONDITIONS
14. ADDITIONAL CONTRACTING AND APPLICABLE LAW PROVISIONS
15. PROVIDER SWITCHING AND DATA EXPORT
16. OFFICIAL REFERENCES
17. DATA RETENTION AND SLA COMPENSATION
Monthly availability A
SLA 99.9%
Cluster VPS/VDS, SLA 99.982%
A ≥ 99.982%
0%
0%
99.9% ≤ A < 99.982%
0%
5% of B
99.5% ≤ A < 99.9%
10% of B
10% of B
99.0% ≤ A < 99.5%
25% of B
25% of B
95.0% ≤ A < 99.0%
50% of B
50% of B
A < 95.0%
100% of B
100% of B
09.05.2018: initial update of the Terms and Conditions.
23.05.2018: addition of Art. 1.4 on personal data protection information.
2024-2025: implementation of compliance measures under Regulation (EU) 2022/2065 — the Digital Services Act (DSA), including dedicated channels for reporting allegedly illegal content, an authority contact point and a DSA report.
20.05.2026: addition of provisions on the DSA, Law no. 50/2024, the email policy for shared web hosting and reseller web hosting, the refund policy, non-refundable services, external services used by the customer, limitation of liability and clarifications on access to personal data.
13.07.2026: general revision of the Terms and Conditions, including updates to data protection, consumer rights, the refund policy, billing, domains, intermediary services, DSA reports, technical support, limitation of liability and service use conditions.
16.07.2026: additions to the procedure for reporting and handling notices under Regulation (EU) 2022/2065 (Digital Services Act), clarifying report assessment, available measures and reassessment based on new information or orders from competent authorities.
30.09.2026: additions concerning the technical data processing agreement (DPA), content confidentiality and specific access, compliance verification, the DSA, domain rules, consumer protection, data export, deletion and retention periods and the SLA compensation scheme.
