Controller
The controller of the personal data collected through this website and our services is OtakuWorld.ch Sagl, which operates the Nymora brand (domains, hosting, VPS, managed websites and e-commerce).
- Registered office
- Via Enrico Guisan 11, 6850 Mendrisio (TI), Switzerland
- UID
- CHE-252.426.910
- [email protected]
- Phone
- +41 76 740 28 56
For any question about your data or to exercise your rights, you can write to us at [email protected].
What data we process
We only process the data we need to reply to you and to provide the service. Specifically:
- Contact data: name, e-mail address and, if you provide it, your company. We collect it when you fill in the contact form or write to us by e-mail.
- Identification, service and billing data: name, address, e-mail, telephone if you provide it, domain, chosen plan, the IP address from which you place the order, and the data needed to issue invoices and manage your account.
- Payment data: card or account details are entered and processed directly by our payment provider (Payrexx: TWINT, cards, PostFinance). We only receive the data needed to reconcile the transaction (outcome, amount, last digits of the card), not the full card number. For card payments, 3-D Secure authentication may be required; it is handled by your bank and the payment provider, which may also process technical data about your device for this purpose.
- Technical logs: IP address, date and time of requests, browser type and pages requested. They are used for security, troubleshooting and keeping our systems healthy.
- Network and service usage metadata: for VPS and other services we automatically collect traffic metadata (source and destination IP addresses and ports, protocol, volumes, packets per second, number, frequency and timing of connections) and resource usage (CPU, memory, disk, bandwidth). We also use them to apply the automatic and temporary RAM and CPU limits (clause 1 of the Terms) and so that we receive an alert when a limit is triggered; when the CPU limit is activated we inform you by ticket or e-mail. Only in the event of a concrete alert, for a targeted check, do we also collect the names of the running processes and services, the listening ports and the active connections (clause 10 of the Terms). We do not read the content of communications or of the data you host.
- Identity verification data: where necessary to prevent fraud or abuse, we may ask you for an identity document, an extract from the commercial register or a verification of your payment method. You may black out on the document any data not needed to identify you.
If you use one of our e-commerce or managed websites, we may also process, on your behalf, the data of your customers held on that platform. In that case you are the controller of that data and we act as your processor according to your instructions (see the section «Who we share data with»).
We do not ask you for special categories of data (for example health data) and we do not want them: please do not enter them in the forms.
Purposes and legal basis
We use your data for specific purposes, each with its own legal basis under the revised Federal Act on Data Protection (FADP) and, where applicable to individuals in the European Union, the GDPR:
- Replying to your requests and preparing a quote (legal basis: taking pre-contractual steps at your request).
- Providing and managing the service you have activated (legal basis: performance of the contract).
- Complying with legal obligations, for example accounting and tax obligations (legal basis: legal obligation).
- Keeping our systems secure and preventing abuse (legal basis: our legitimate interest, balanced against your rights).
- Managing the servers' shared resources with the automatic and temporary RAM and CPU limits (legal basis: performance of the contract and our legitimate interest in a balanced use of the servers among customers).
- Preventing fraud and verifying the identity of customers, including by means of the order IP address, 3-D Secure and manual review of risky orders (legal basis: our legitimate interest in not providing services to people using false identities or someone else's means of payment).
- Responding to authorities when the law requires us to or a competent authority orders it, including under the LSCPT (legal basis: legal obligation).
Automated decisions. To prevent fraud, some orders may be flagged automatically on the basis of risk indicators (for example inconsistency between the card's country, the address and the order IP address). The refusal of an order is never decided solely by an automated system: a flagged order is examined by a person, and you can always make your point of view known to us and ask for the decision to be reviewed. The automatic RAM and CPU limits (clause 1 of the Terms) are also applied by an automated system; they are temporary and you can challenge them by ticket.
Abuse prevention. Network and usage metadata is used to detect and stop attacks, scans, spam, malware, mining and other uses prohibited by the Terms (clause 10), to protect other customers and to prevent IP addresses from ending up on blocklists. This processing is based on our legitimate interest in the security of the network and services (art. 31(1) FADP; art. 6(1)(f) GDPR), is automated and proportionate, and does not involve examining the content of communications, except where required by law, ordered by an authority, requested or specifically authorised by you, or in the event of serious and imminent danger. Targeted checks take place only on a concrete alert, are logged and are notified to you within 24 hours. Where abuse is established, we may pass the strictly necessary information to the operators of the networks involved and to the infrastructure provider in order to stop the activity.
Where the data is hosted
The data of the website and services is hosted in a data centre in France, in the European Union, compliant with the GDPR. Nymora, based in Switzerland, processes your data in compliance with the FADP and the GDPR.
The data therefore resides in the European Union, not in Switzerland, and we tell you so plainly. Transfers from Switzerland to the EU are permitted because the Swiss Confederation recognises the European Union as providing an adequate level of data protection; for any processing outside the EU and Switzerland (for example certain ancillary services) we rely on the safeguards provided by law, such as standard contractual clauses.
If in the future a specific service involves processing by other providers (for example a third-party tool you choose to activate), we will tell you beforehand and put in place the safeguards provided by law. No hidden transfers. If your case requires the data to reside in Switzerland, write to us: we can look into a dedicated option.
How long we keep it
We keep data for as long as necessary for the purposes for which we collected it, then we delete or anonymise it. In practice:
- Contact messages: for as long as needed to handle your request, and for a reasonable period afterwards in case of follow-up.
- Billing data and accounting records: for the duration of the contract and, after it ends, for 10 years (art. 958f CO).
- Other identification data and order IP address: for the duration of the contract and, after it ends, for a maximum of 12 months, unless they are needed to handle a case of abuse, fraud, a dispute or proceedings, or an authority requests their retention. Should extended surveillance obligations under the LSCPT be imposed on us in the future, we will retain the required data for the periods laid down in the relevant ordinance (OSCPT) and update this policy.
- VPS backup copies: on a rotating basis, 7 daily and 2 weekly. Data deleted from your VPS may remain in the copies until they expire naturally, normally within three weeks. On termination of the service the VPS and its data are deleted immediately; the nightly copies already taken remain in the backup storage until their automatic rotation, at most 21 days, and are then deleted (clauses 8 and 9 of the Terms), unless a legal obligation or a request from the authorities requires otherwise.
- Technical logs: for a short period, sufficient for security and troubleshooting.
- Network and usage metadata: normally for a maximum of 90 days, after which it is deleted or aggregated in anonymous form. If it relates to a case of abuse, a dispute or proceedings, we keep it for as long as needed to handle the matter or for as long as an authority requires.
- Log of targeted checks: for 12 months, or longer if it relates to a case of abuse, a dispute or proceedings.
- Identity verification data: only for as long as needed for the verification; we keep the outcome of the verification for the duration of the contractual relationship and, if the verification relates to fraud or abuse, for as long as needed to protect our rights.
Who we share data with
We do not sell your data and we do not pass it on for third-party advertising. We share it only with those we need to make the service work for you, and only to the extent necessary. These parties act as our processors (or sub-processors), contractually bound to use the data solely to provide their service to us. The main ones are:
| Provider | Role | Location |
|---|---|---|
| OVHcloud | Hosting and infrastructure (sub-processor) | France (EU) |
| Payrexx AG | Online payments | Thun, Switzerland |
| E-mail provider | Sending and receiving communications | EU / Switzerland |
This list may change as our services evolve; the current version is always the one published here. We also disclose data to law enforcement authorities, courts and other competent authorities, in Switzerland or abroad, when the law requires us to or a binding order requires it, including to the Post and Telecommunications Surveillance Service (PTSS) as a provider of derived communication services under the LSCPT, where applicable, and we may also do so to report clearly unlawful activities carried out through our services or to defend our rights in legal proceedings. We disclose only the data that is necessary and, where the law allows, we inform you. When you process third-party data through one of our e-commerce or managed websites, we in turn act as your processor and follow your instructions.
Your rights
You have rights over your data, recognised both by the FADP and, where applicable, by the GDPR, and you can exercise them by writing to us. Specifically, you can ask to:
- Access the data we process and find out how we use it.
- Rectify inaccurate or incomplete data.
- Obtain and take away your data in a readable format, to reuse it elsewhere.
- Erase the data, when it is no longer needed and no legal obligation requires us to keep it.
- Object to processing, request its restriction or withdraw consent you had given, without affecting the lawfulness of processing carried out before.
To exercise a right, write to [email protected]. To protect your data, we may need to ask you to confirm your identity. We reply free of charge and within the time limits set by law.
If you believe we are processing your data improperly, you can contact the supervisory authority. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC). If you are in the European Union, you can contact the supervisory authority of your country.
Security
We take reasonable technical and organisational measures to protect data: encryption in transit (TLS), access control, nightly VPS backups on separate storage in the same data centre, separation of environments, default blocking of the ports most exposed to abuse and filters against malicious networks. The infrastructure is hosted in a data centre in France (EU) with recognised security standards.
No system is 100% invulnerable, and we will not tell you otherwise. If a breach affecting you occurs, we will inform you as required by law.
How to contact us about privacy
To exercise your rights or for any question about this policy, write to [email protected] or use the contact form.
Updates to this policy
We may update this policy when our services or legal obligations change. The version in force is always the one published here, with the date of the last update at the top. If the changes are significant, we will point them out clearly.
Last updated: 21 October 2026