Privacy policy
This policy describes how 1up-servers processes the personal data of its users, of visitors to this site and of the players who join our customers' servers, in accordance with the GDPR, the UK GDPR and the Spanish LOPDGDD.
1. Controller and contact
The controller is Xabier Martínez Parada, a sole trader with tax ID (NIF) 72502232E, trading under the name 1up-servers, with address at Calle Jaizkibel 10, escalera izquierda, 3.º B, 20110 Pasaia (Gipuzkoa), España. For any matter relating to privacy, you may write to support@1up-servers.com or by post to that address; we respond within one month, which may be extended by two further months for complex requests, in which case we inform you of the reasons. We have not appointed a data protection officer, as none of the cases set out in article 37 of the GDPR or article 34 of the LOPDGDD applies; we maintain a record of processing activities. The appointment of the representative in the United Kingdom is pending; in the meantime, you may contact support@1up-servers.com.
To create the account we need your email, your date of birth and a password or a sign-in through Google or Discord; to contract a paid plan, your billing details, which are also required by tax legislation. Without these data it is not possible to provide the service. All other data are optional. We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you: a person reviews the automated signals before an account is suspended and, if an ongoing attack forces us to act beforehand, reviews the measure afterwards.
2. Processing activities and purposes
The following table sets out each processing activity with its purpose, the data processed, the legal basis and the retention period. We do not sell your personal data or build advertising profiles: ad personalisation is disabled in all cases.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Create and manage your account and your servers | Email, display name, date of birth, password hash, Google or Discord identifier, server settings | Performance of the contract | For as long as the account remains active and for 30 days after its closure |
| Charge for plans and add-ons and issue invoices | Name, billing address, tax ID (NIF), invoices, payment references | Performance of the contract and legal obligation | 6 years from issue, the period laid down in article 30 of the Spanish Commercial Code, which covers the 4-year tax limitation period; during that time they remain blocked and are used only to comply with legal obligations or to handle claims |
| Respond to payment disputes (chargebacks) with evidence of the purchase; the IP address is sent to Stripe only when we contest a dispute | IP address and country at the time of accepting the payment terms | Legitimate interest (defence of our charges) | 540 days from acceptance, the maximum dispute period of the card networks; once that period has elapsed, they are deleted |
| Security logs, session history and fraud prevention | IP address, user agent, access times, country | Legitimate interest in the security of the service | 90 days (730 days for actions taken by our staff) |
| Diagnose failures and degradations of the service | IP address, user agent, country, account identifier and the requests made (route, result and duration; never their content) | Legitimate interest in the proper functioning of the service | 30 days (logs) and 14 days (traces) |
| Anti-bot verification and detection of abuse on servers | IP address, Turnstile signals, server resource usage | Legitimate interest | 90 days, and for as long as a case remains open |
| Show the server owner who played and when | Player name, Steam or game identifier, IP address, connection times, in-game chat in the console | On behalf of the server owner (see Players) | While the server exists |
| Display the Steam names and avatars of players | Steam identifier and public profile | Legitimate interest of the server owner | Cached for 24 hours |
| Provide support and record team access to your panel | Messages, attachments, audit log of team sessions | Performance of the contract and legitimate interest | 2 years after the ticket is closed |
| Service communications about your servers, billing and security | Email, notification preferences | Performance of the contract | For as long as the account remains active |
| News and offers by email | Email, language | Consent, which may be withdrawn at any time | Until the subscription is cancelled |
| Determine the origin of registrations (search engine, social network, link or campaign) | Referring website (domain only), first page visited, UTM tags and registration method; no cookies, no storage in your browser and no click identifiers | Legitimate interest in measuring acquisition channels | For as long as the account remains active |
| Measure at which point payments are interrupted (pricing page, payment window and addition of the payment method) | Steps of each payment attempt: plan, billing period, currency, country, type of payment method (card or PayPal) and Stripe error codes; never card details, Stripe messages or your email. Visits to the pricing page without an account carry no identifier whatsoever | Legitimate interest in correcting a payment process that loses customers | 13 months |
| Aggregate analytics and ad measurement | Pseudonymous identifiers, pages visited, device data | Consent | Up to 24 months (analytics) and 90 days (ad measurement) |
| Non-personalised ads in the panel of the Free, Casual and Starter plans | Cookies and identifiers of Google and its partners, IP address, device data | Consent | Google cookies, up to 13 months |
| Backups and cold archiving of stopped servers | World files and server configuration | Performance of the contract | Backups, 35 days; archive, until the expiry date notified by email |
| Publish your server in the public list | Server name, description, address, player count | Your decision to publish it (opt-in) | Until you remove it from the list |
3. Recipients of the data
We share data only with the providers that assist us in providing the service, listed with their function and location on the sub-processors page: OVHcloud (servers and email), Amazon Web Services (content delivery, DNS and backups), Stripe (payments; also an independent controller for its own fraud prevention), Google (sign-in; Analytics and Ads measurement and, in the panel of the Free, Casual and Starter plans, non-personalised Ad Manager and AdSense ads, only with consent), Discord (sign-in), Cloudflare (anti-bot verification) and Valve (Steam profile queries, as an independent controller). We disclose data to authorities only when required by law.
4. Ads in the panel
The panel of Free, Casual and Starter accounts displays ads from Google Ad Manager and Google AdSense; Pro and higher accounts do not display ads. They are loaded only if you accept the “Advertising and measurement” category. In that case, Google and its partners place cookies in your browser and read identifiers (cookies, IP address and device data) in order to serve the ads, limit the frequency with which each one is shown, measure them in aggregate and prevent fraud.
We always request non-personalised ads: they are not based on your history or on a profile of you, and we never send Google your email or your account data. Google processes these data as an independent controller in accordance with its own privacy policy. You may withdraw your consent at any time from the cookie settings in the footer, and manage Google's use of advertising cookies in its Ads Settings. The links below lead to those settings and to the page where Google explains how it uses information from sites or apps that use its services.
5. International transfers
Our game servers operate in London (United Kingdom) and Paris (France). Transfers to the United Kingdom are based on the adequacy decision of the European Commission, renewed until 27 December 2031. Transfers to the United States are based on the EU-US Data Privacy Framework for certified providers, with the standard contractual clauses as a subsidiary safeguard. When measuring the latency to our regions, your browser contacts AWS points of presence on several continents, which receive your IP address.
6. Your rights
You may access, rectify and erase your data, restrict or object to their processing, request a copy in a portable format and withdraw any consent at any time, without affecting the lawfulness of prior processing. Most of these actions can be carried out from your account (data export and account deletion); otherwise, write to support@1up-servers.com. If you are not satisfied, you may lodge a complaint with the Spanish Data Protection Agency (AEPD, aepd.es) or with the supervisory authority of your country.
7. Players of our customers' servers
When you join a server hosted by us, the server records your player name, your game or Steam identifier, your IP address, your connection times and what you write in the game chat, and displays them to the server owner. We process these data on behalf of the server owner under the Data Processing Agreement, and it is the owner who decides how the server operates. In addition, as controller, we use the IP address and connection data of players to protect the network and detect abuse, on the basis of legitimate interest, for 90 days. To exercise your rights, contact the server owner or write to us at support@1up-servers.com stating your player name and the server address; we will forward the request or handle it directly.
8. Minors
The service is intended for persons aged 16 and over. The minors page describes the measures we take upon detecting the account of a person under 16 and the contact channel for parents and guardians.
9. United States residents
If you reside in the United States, the US privacy notice describes the categories of data, whether they are sold or shared, how we honour the Global Privacy Control signal and how to use Your Privacy Choices.
10. Security
We encrypt traffic in transit, store passwords using argon2id, offer two-step verification, isolate each game server in its own container with resource limits and without host access, and restrict internal access to the staff who require it. Team access to your panel is logged and notified to you.
11. Amendments
This policy displays its own version date. Where an amendment is substantial, we notify you of it by email before it applies.
Exercise your data rights
Ask for access, a copy, correction, erasure, restriction or objection, ask us not to sell or share your data, or appeal an answer. Users, players of a server hosted here and visitors can write. We answer within one month and may ask you to prove who you are.