Privacy Policy

1337 Services GmbH ("we", "us", or "our") operates RDP.sh and is committed to protecting your privacy. We are based in Hamburg, Germany and comply with the European Union General Data Protection Regulation (GDPR).

We process your personal data based on various legal grounds as described in this policy, including contract performance, legal obligations, and legitimate interests.

The data controller responsible for your personal data is:

We use the collected information for the following purposes:

• To provide and maintain our services
• To process transactions and send invoices
• To send service-related notifications (server status, billing reminders)
• To detect and prevent fraud and abuse
• To provide customer support
• To comply with legal obligations (tax laws, court orders)

Under the GDPR, we process your personal data based on the following legal grounds:

• Contract Performance (Article 6(1)(b)) - Processing necessary to provide our services, including account creation, service provisioning, and customer support.
• Legal Obligation (Article 6(1)(c)) - Processing required to comply with legal requirements, such as tax laws, accounting regulations, and responding to lawful requests from authorities.
• Legitimate Interests (Article 6(1)(f)) - Processing for fraud prevention, security monitoring, service improvement, and protecting our legal rights, where these interests are not overridden by your rights and freedoms.

We use essential cookies, and a referral cookie when you arrive through an affiliate link. We do not use third-party analytics or tracking cookies.

• Session Cookie - maintains your login session (expires after 2 hours of inactivity)
• CSRF Token - protects against cross-site request forgery attacks
• Referral Cookie (rdp_ref) - set only when you open an affiliate's link, and holds nothing but that affiliate's code for 30 days, so an account you create in that time is credited to them. The affiliate then sees the type and net amount of your paid server invoices, never your name or email address.

Cookies are only transmitted over HTTPS. The session cookie and CSRF token are encrypted.

We use third-party payment processors to handle payments. We do not store your credit card details. These processors act as recipients of your personal data within the meaning of Article 13(1)(e) GDPR, and each has its own privacy policy governing the use of your payment information.

• Cryptomus - Cryptocurrency payments
• DebloMassi (deblomassi.com) - Credit and debit card payments
• Platega (platega.io) - Payments in rubles through SBP, for customers in Russia

Card payments

If you choose to pay by card, we open a checkout with DebloMassi and redirect you to their website to complete the payment. The only information we transmit to them is the invoice amount, the currency, your invoice number as the payment reference, a short description of the invoice and the address to return you to afterwards. We do not send them your name, your email address or any other account data.

You enter your card details, and any name and email address their checkout asks for, directly on DebloMassi's page. That information is collected by DebloMassi rather than by us, under their own privacy policy, and your card number is never transmitted to or stored on our systems.

Once the payment completes, DebloMassi notifies us with the payment reference, the amount, the currency, the payment status and the name and email address you entered at their checkout. We store that notification together with the invoice as proof of payment.

Legal basis: Article 6(1)(b) GDPR - the processing is necessary to perform our contract with you, namely to collect payment for the service you ordered. We additionally retain the stored payment confirmation under Article 6(1)(c) GDPR to satisfy our accounting and tax record-keeping obligations, as set out in Data Retention below.

Who they are: DebloMassi contracts under the name DebloMassi Inc. and is registered in the State of Delaware, United States, as DEBLOMASSI LIMITED LIABILITY COMPANY under file number 10111325. Its registered agent is Legalinc Corporate Services Inc., 131 Continental Drive, Suite 305, Newark, DE 19713, United States.

International transfer: Because DebloMassi is established in the United States, and states in its own privacy policy that it may transfer personal data on to further countries, paying by card involves a transfer of your personal data outside the European Economic Area. If you would like information about the safeguards that apply to this transfer, contact us at [email protected]. You can always avoid this transfer by paying with cryptocurrency or from your account balance instead.

Payments in rubles (SBP)

If you choose SBP (Russian Customers), we open a payment page with Platega and redirect you to it. We transmit the invoice total converted to rubles, the currency, your invoice number as the payment reference, a short description of the invoice and the addresses to return you to afterwards. Platega's fraud checks also require your account ID, the name on your account and the IP address you pay from, so we send those too. We do not send them your email address or any other account data.

You complete the payment on Platega's page, usually in your bank's app. Whatever Platega or your bank collect there is collected by them, under their own privacy policies; Platega's is published in Russian.

Once the payment completes, Platega notifies us with the transaction ID, the amount, the currency, the payment status and the payment method you used. We store that, together with Platega's record of the transaction, with the invoice as proof of payment.

Legal basis: Article 6(1)(b) GDPR - the processing is necessary to collect payment for the service you ordered. The account ID, name and IP address we pass on for Platega's fraud checks are processed under Article 6(1)(f) GDPR, our legitimate interest in preventing payment fraud. We retain the stored payment confirmation under Article 6(1)(c) GDPR, as set out in Data Retention below.

Who they are: Platega (platega.io) is a payment service operating under the law of the Russian Federation. Its terms name [email protected] as its contact address.

International transfer: Platega processes payment data in Russia, so paying in rubles involves a transfer of your personal data outside the European Economic Area, to a country for which the European Commission has not adopted an adequacy decision. If you would like information about the safeguards that apply to this transfer, contact us at [email protected]. You can always avoid this transfer by choosing another payment method.

VAT and your country of residence

To prove which country's VAT we charged, we keep with each invoice the country you stated, the IP address you paid from and the country it points to (looked up on our own servers), plus the time you confirmed your country if the two differed; for older invoices we keep only the country your sign-ins pointed to. If your account has no country yet, we save the country your first sign-in points to; you can change it under Settings › Billing details. Legal basis: Article 6(1)(c) GDPR together with Articles 24b and 63c of Implementing Regulation (EU) No 282/2011; kept for 10 years with the invoice.

We retain your data for the following periods:

• Account Data - retained until you request account deletion
• Session Data - automatically deleted after 2 hours of inactivity
• Invoices and Billing Records - retained for 10 years as required by German tax law
• Support Tickets - retained for 3 years after resolution

Under the GDPR, you have the following rights:

• Right to Access - request a copy of your personal data
• Right to Rectification - request correction of inaccurate data
• Right to Erasure - request deletion of your data ("right to be forgotten")
• Right to Restriction - request limitation of processing of your data
• Right to Data Portability - receive your data in a machine-readable format (JSON or CSV)
• Right to Object - object to processing of your data
• Right to Withdraw Consent - withdraw consent at any time
• Right to Lodge a Complaint - file a complaint with a supervisory authority

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days.

We implement appropriate technical and organizational measures to protect your data:

• All data transmitted over HTTPS/TLS encryption
• Passwords hashed using bcrypt algorithm
• Two-factor authentication available for all accounts
• Regular security assessments and software updates
• Data stored in EU-based data centers

We use the following third-party services to operate our platform. Each service processes data as described below:

• Postmark - Transactional email delivery. Processes: email address, name. Location: USA (EU SCCs in place).
• Cloudflare Turnstile - Bot protection during registration. Processes: IP address, browser data. Location: Global (EU SCCs in place).
• Internet.bs - Domain registration services. Processes: contact information for WHOIS. Location: Bahamas.
• Cryptomus - Cryptocurrency payment processing. Processes: transaction data. Location: Lithuania (EU).
• DebloMassi - Credit and debit card payment processing. Processes: card details, cardholder name and email address you enter on their checkout, plus the invoice amount, currency and invoice reference. Location: Delaware, United States (transfer outside the EEA - see Payment Processing above).
• Platega - Payment processing in rubles (SBP). Processes: account ID, account name and IP address, plus the invoice amount, currency and invoice reference, and whatever you enter on their payment page. Location: Russia (transfer outside the EEA - see Payment Processing above).

Your personal data is primarily stored and processed within the European Economic Area (EEA). However, some of our third-party service providers may process data outside the EEA.

When data is transferred outside the EEA, we rely on one or more of the following safeguards, depending on the provider:

• Standard Contractual Clauses (SCCs) - approved by the European Commission
• Adequacy Decisions - where the destination country ensures adequate protection
• Data Processing Agreements - with our third-party processors

The transfers that take place when you pay by card or in rubles through Platega are described separately under Payment Processing above. You can avoid them by paying with cryptocurrency or from your account balance.

Our services are not intended for individuals under the age of 16. We do not knowingly collect personal data from children under 16 years of age.

If we become aware that a child under 16 has provided us with personal data, we will take steps to delete such information promptly. If you believe a child has provided us with their data, please contact us at [email protected].

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach
• Inform affected individuals without undue delay if the breach is likely to result in high risk
• Document all breaches and the remedial actions taken

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us: