Legal Documents

Terms of Service

Last updated: August 30, 2026

Wepwawet agrees to furnish services to the End User, subject to the following ("Terms of Service", "ToS"). Wepwawet, the Company, hereafter referred to as ("Wepwawet", "Wepwawet Hosting", "Us", "We") and The Client ("Customer", "Client", "You"). Use of Wepwawet Service constitutes acceptance and agreement to AUP ("Acceptable Use Policy") and ToS ("Terms of Service", "Agreement"). All provisions of this contract are subject to change from time to time at the discretion of Wepwawet. Subscriber understands that change to the ToS by Wepwawet shall not be grounds for early contract termination or non-payment.

By accepting these terms you also agree to the End User License Agreement (EULA) and Privacy Policy of the services we offer and allow Wepwawet to accept these agreements on your behalf.

These Terms of Service, our Acceptable Use Policy, our Service Level Agreement, and our Privacy Policy together form the agreement between us. Where they conflict, these Terms of Service prevail, and each of the other documents prevails within its own subject matter: the Acceptable Use Policy on permitted and prohibited use and on enforcement action, the Service Level Agreement on availability and service credits, and the Privacy Policy on the processing of personal data.

1. Eligibility

Wepwawet is prohibited by law to allow the following groups of users to purchase services:

• Users who are not able to enter into legally binding contracts;
• Users under the age of 18, unless they have the consent of a parent or legal guardian, who accepts responsibility for the account and for payment;
• Any person, entity, government, or territory subject to sanctions or restrictive measures, as set out in section "Sanctions and export controls" of our Acceptable Use Policy.

Wepwawet reserves the right to amend this list at any time. Wepwawet also reserves the right to decline to provide services to any person, whether or not a ground on this list applies.

2. Amendments

Wepwawet reserves the right to modify or replace any part of this agreement without warning or notice. We will notify you of any changes by posting the new agreement on this page. You are advised to check this agreement periodically in case of changes. Changes to this agreement are in effect from the moment they are posted on this page.

3. Refunds and Disputes

Services may be eligible for a partial or full refund, solely at our discretion, which will be processed within 14 days. We reserve the right to reject any refund request if the service was delivered as described. All refund requests must be supported by reasonable cause and submitted through official support channels. Each user may request a refund only once. Please note that certain services, including Dedicated Servers, VPS, additional IPs, licenses, domains, and account credits, remain strictly non-refundable.

4. Terminations

Termination is defined as a service terminated by Wepwawet and terminations are usually without refunds. Terminations can be done for any reason, or no reason at all. An example of a reason for termination is a chargeback on payment. Whether or not you win the case, the service will be terminated without a refund. You will also be banned from purchasing services from us in the future.

5. Cancellations

To terminate your services, cancel your service at our billing area. A cancellation can be induced at any point and executed immediately or at the end of the billing period. As Wepwawet does not have access to the client's billing accounts, we cannot and will not be responsible for unintended payments made by using an automatic payment subscription service. Accidental payments may or not be refunded, if an accidental payment has been made make sure to contact the support in a timely manner so we may be able to provide a solution for this.

6. Non-payment

If you can not pay for your service you will need to reach out to Wepwawet immediately so we can look for a solution together otherwise it might get terminated and might result into the loss of data or additional costs.

7. Overdue Services and Data Retention

If your service is overdue it will be suspended within 1 day (24 hours) and terminated within 20 days. We store your data during that period. On termination the data is deleted automatically, and this action is irreversible.

Where we terminate a service for a breach of this Agreement or of our Acceptable Use Policy, data may be deleted immediately on termination.

We do not guarantee backups. The Customer is responsible for maintaining their own. Once data has been deleted we are not able to recover or restore it.

8. Infrastructure and Hardware

We provide our services using our own equipment and that of third-party infrastructure providers, including datacenter operators, colocation and hosting providers, network carriers, and hardware vendors. These providers and their technicians install, maintain, repair, replace, and decommission the hardware your service runs on. They may do this on our instruction or on their own initiative when their monitoring or diagnostics show hardware is failing, has failed, or needs replacing.

This includes physical access to equipment holding your data. Failed storage media may be removed and returned to the manufacturer or vendor under warranty. Where a provider needs access to your server itself, that access is limited to what is necessary to diagnose and fix the fault.

You authorise us to engage infrastructure providers of the kinds described above. We use providers who are subject to confidentiality and, where they process personal data, data protection obligations. We remain responsible to you for their performance and remain your point of contact. Details of the providers we currently use are available on request.

You choose the region your service runs in, including regions outside the European Economic Area. If you move your service to another region, that is your choice and your responsibility. We do not move your data between regions unless you ask us to, or we tell you in advance and you do not object.

9. Liability

To the maximum extent permitted by law, our total liability arising out of or in connection with this Agreement is limited to the fees paid by the Customer for the affected service during the twelve months preceding the event giving rise to the claim, and will in no case exceed that amount.

We are not liable for indirect or consequential loss, loss of profit, loss of goodwill, loss of data, or the corruption, disruption, or unauthorised access to data, nor for any disruption, delay, or disconnection of services for any period of time.

We do not guarantee backups of Customer data. The Customer is responsible for maintaining their own backups of anything they cannot afford to lose.

Nothing in this Agreement excludes or limits our liability for death or personal injury caused by our negligence, for fraud, or for intent or deliberate recklessness.

This section does not affect Service Credits payable under our Service Level Agreement, which remain the sole remedy for shortfalls in availability.

10. Your Responsibility to Us

You are responsible for what you and your users do with our services. If someone brings a claim against us, or we incur costs, fines, or penalties, to the extent arising from or relating to your use of our services, your content, or your breach of this agreement or our Acceptable Use Policy, you will indemnify us for those amounts, including reasonable legal fees.

This includes claims relating to your content, your users, intellectual property, data protection, or abuse originating from your service.

We will tell you about any such claim without undue delay and give you a reasonable opportunity to be involved in how it is handled. We will not settle any such claim without your consent, which you will not unreasonably withhold or delay. If you do not respond to a settlement proposal within a reasonable period, we may settle the claim on reasonable terms, provided the settlement does not impose any obligation or admission of liability on you.

This does not apply to claims to the extent caused by our own breach of this agreement or our own negligence.

11. Support

Technical and gameplay assistance is provided free of charge as an additional service. This covers help with game servers, plugins, modifications, and configuration. It is not guaranteed, and we may limit, change, or withdraw it at any time with or without notice.

Billing and account support is always available. So are abuse reports (section "Reporting abuse" of the Acceptable Use Policy), Service Credit claims (section "Claiming a Service Credit" of the Service Level Agreement), and appeals against enforcement action (section "Appeals" of the Acceptable Use Policy).

12. Unfair Usage

If Wepwawet finds your service using any type of system to bypass our set limits, you and your service are subject to Termination. This also applies to our unmetered storage on game services, you are not allowed to abuse our unmetered storage, they are only meant for files crucial to your game services.

13. Illegal Usage

Your services may not be used for illegal purposes directly or indirectly. If your services are used for these purposes, you and your services will be subject to Termination.

14. Network Disruptions/Unfriendly Activity

Use of your service to disrupt Wepwawet's network or other networks is strictly prohibited. This includes Denial of Service (DoS) attacks against another network or user on the internet. Interference with our own network as well as other networks will subject your services to Termination. Wepwawet's DDoS protection is also an additional service and is not guaranteed. If a DDoS attack gets past our filter, please inform us immediately so we can solve the issue. DoS and DDoS attacks are illegal, and your information will be forwarded to your local law enforcement authority if you are found to be taking part in one.

15. Account Inactivity

An inactive client is defined as a client with no active products, services, addons, or domains for a period of 6 months or longer. After 6 months of inactivity, we reserve the right to delete inactive clients if we choose to do so. This process is irreversible and will erase all of the customer's data.

16. Fraud

Attempts of any type of fraud at Wepwawet will subject your services and account to Termination. Also, your information will be forwarded to a fraud database, and you will not be able to purchase from Wepwawet and many other companies that use this fraud database.

17. Prices

Our service prices are updated automatically on a daily basis to adjust for the then-current exchange rate. We may disable this daily adjustment and freeze our exchange rates or modify them to how we see fit. This doesn't affect the prices for the existing services on a customer account. However, we may increase or decrease the costs of our services in the future. You will be informed in an adequate time frame if one of your existing services is affected by a price increase.

18. Programs

1. You are not allowed to communicate publicly about how much of a percentage you receive or how much money you make from the programs.
2. Percentages might vary between individuals for various reasons. These reasons remain private and are based on individual agreements.
3. You will remain in the programs for the duration of the collaboration.
4. We have the right to remove you from the programs for any reason or no reason.
5. We have the right to refuse withdrawal in case of acts of god or financial reasons.
6. We have the right to change the minimum withdrawal amount.
7. We have the right to change the commission cycle.
8. We have the right to change the commission amount.
9. Violating these terms will result in the termination of your account/agreement and removal from the programs.

Acceptable Use Policy

Last updated: August 28, 2026

This Acceptable Use Policy ("AUP") forms part of our Terms of Service and applies to everyone who uses our services. It sets out what our services may and may not be used for, and what we will do if that line is crossed.

1. Scope and Who This Applies To

This AUP governs the use of all services provided by Wepwawet B.V., trading as Wepwawet, including Minecraft server hosting, game server hosting, virtual private servers (VPS), web hosting, and any related infrastructure, storage, network, control panel, or support services (the "Services").

This AUP applies to:

• Every customer who purchases or uses the Services (the "Customer");
• Any person the Customer permits to access or use the Services, including staff, administrators, moderators, collaborators, and resellers; and
• Any end user who connects to, plays on, visits, or otherwise interacts with a server, service, or website the Customer operates on our infrastructure.

The Customer is responsible for ensuring that all of these users comply with this AUP. By purchasing or using the Services, the Customer accepts this policy.

2. Permitted Use

The Services are provided for lawful purposes, namely the hosting and operation of game servers, websites, applications, and related workloads. Customers may:

• Operate multiplayer game servers, including Minecraft and other supported titles;
• Host websites, forums, APIs, bots, databases, and similar applications;
• Install and run third-party software, plugins, and modifications, provided they are properly licensed and lawful;
• Store and process data necessary for the operation of the above; and
• Invite end users to connect to their servers, subject to the Customer's own rules and to this AUP.

3. Prohibited Use

The Customer and its users must not use the Services to host, store, transmit, distribute, link to, or facilitate any of the following.

3a. Illegal content and activity

• Content that is unlawful under Dutch law, European Union law, or the laws applicable to the Customer or their end users;
• Child sexual abuse material, or any content that sexualises minors. We report such material to the appropriate authorities and terminate the account immediately and without refund;
• Content that incites, promotes, or facilitates terrorism, violent extremism, human trafficking, or violence against any person or group;
• Content that harasses, stalks, defames, or threatens any person, or that constitutes hate speech targeting protected characteristics;
• Material infringing copyright, trademark, patent, trade secret, or other intellectual property rights, including pirated software, cracked game clients, unlicensed media, and unauthorised game server software;
• Unlicensed gambling, lotteries, or games of chance;
• Sale or distribution of controlled substances, weapons, counterfeit goods, or stolen data;
• Content that violates any person's privacy rights, including doxxing and the publication of personal data without a lawful basis.

3b. Fraud, financial crime, and payment misuse

• Fraud of any kind, including phishing pages, fake login portals, scam storefronts, advance-fee schemes, and fraudulent charity appeals;
• Money laundering, terrorist financing, or concealment of the origin of funds;
• Carding, trafficking in stolen payment credentials, or testing stolen cards;
• Ponzi schemes, pyramid schemes, matrix schemes, high-yield investment programmes, or similar structures;
• Deceptive practices toward the Customer's own end users, including misrepresenting what an in-game purchase provides, refusing lawful refunds, or charging without clear disclosure;
• Use of a chargeback or payment dispute as a substitute for our support and refund process.

3c. Network abuse and security violations

• Unsolicited bulk email (spam), including sending, relaying, or hosting resources referenced in spam sent elsewhere;
• Denial-of-service (DoS/DDoS) attacks, stress-testing services, "booters", "IP pullers", or amplification tooling, whether aimed at our network or any third party;
• Port scanning, vulnerability scanning, brute-force attempts, or penetration testing against systems the Customer does not own or lacks written authorisation to test;
• Malware, ransomware, spyware, keyloggers, remote access trojans, botnet command-and-control infrastructure, exploit kits, or malicious scripts;
• Circumventing or attempting to circumvent any authentication, resource limit, billing control, or security measure of ours or of any third party;
• IP address spoofing, forged packet headers, or falsified email headers;
• Proxy, VPN, or Tor exit node operation intended to conceal abusive activity or evade bans.

3d. Resource abuse

• Cryptocurrency mining, distributed computing for token rewards, or similar workloads on shared or game hosting plans, unless expressly agreed in writing;
• Sustained resource consumption that degrades service for other customers on shared infrastructure;
• Use of a plan for a purpose it was not sold for, including reselling shared resources beyond the terms of the plan;
• Operating open relays, open proxies, or open DNS resolvers.

3e. High-risk and restricted activities

The following require our prior written approval and may be refused or made subject to additional conditions:

• Adult content of any kind, even where lawful;
• Financial services, payment processing, or cryptocurrency exchange or custody services;
• File-sharing, file-locker, or link-shortening services open to public upload;
• Bulk or transactional email sending at scale;
• Any service directed at, or likely to attract, users under the age of 16 without appropriate parental consent mechanisms.

4. Legal and Regulatory Compliance

The Customer must comply with all laws and regulations applicable to their use of the Services, including those of the Netherlands and the European Union, and those of any jurisdiction in which the Customer or their end users are located.

The Customer is responsible for their own compliance with data protection law, including the General Data Protection Regulation (GDPR), in respect of any personal data they process using the Services, and for obtaining any licence, registration, or consent their activities require.

4a. Sanctions and export controls

The Services may not be used by, for the benefit of, or in support of any person, entity, government, or territory subject to sanctions or restrictive measures administered by the Netherlands, the European Union, the United Kingdom, the United Nations, or the United States (including OFAC). The Customer represents and warrants that they are not a sanctioned party, are not owned or controlled by one, are not acting on behalf of one, and will not make the Services available to one.

Customers must not use the Services in breach of any export control or dual-use goods regulations applicable to them.

We may screen accounts, payment details, and connection data against applicable sanctions lists, and we rely on the screening carried out by our payment providers. Where we identify or reasonably suspect a breach of this section, we may suspend or terminate the account immediately and without notice, and we are not obliged to provide a refund. We may also be required to freeze funds or report the matter to the competent authorities, and where that is the case we may be prohibited from telling you why.

5. Platform Rules and Prevention of Misuse

The Customer must:

• Provide accurate, current, and complete account and billing information, and keep it up to date;
• Keep account credentials, API keys, and server access confidential, and use strong authentication where offered;
• Keep all software, plugins, mods, and content management systems they install patched and reasonably secure;
• Publish and enforce clear rules for their own end users where they operate a multi-user server or community;
• Respond promptly to abuse reports and security notifications we forward to them;
• Take reasonable steps to prevent their servers from being used to attack, defraud, or harm others;
• Not impersonate Wepwawet, another customer, or any third party.

Customers must not create multiple accounts to evade suspension, payment obligations, resource limits, or a prior termination.

6. Responsibility for Third Parties and Sub-Users

The Customer is fully responsible for all activity conducted through their account and services, whether by themselves, their staff, their end users, or any third party who gains access, including through the Customer's failure to secure their credentials or software.

Where the Customer allows others to use the Services, including by operating a public game server, hosting a community, or acting as a reseller, the Customer must:

• Impose terms on those users that are no less restrictive than this AUP;
• Maintain the ability to investigate, suspend, and remove offending users and content;
• Act on abuse promptly once notified or otherwise aware of it; and
• Remain the single point of contact and responsibility toward us for that activity.

A violation by a Customer's end user or sub-user is treated as a violation by the Customer for the purposes of this policy. Resellers are additionally responsible for passing on the substance of this AUP to their own customers, for making our abuse reporting route under 7b known to them, and for handling abuse complaints relating to them.

7. Monitoring, Investigation, and Enforcement

7a. Monitoring

We do not routinely monitor the content of customer servers, and we are not obliged to do so. We do operate automated systems that monitor network traffic, resource usage, and abuse signals in order to maintain service availability, security, and integrity. Some of these systems can apply protective measures automatically, including rate limiting, traffic filtering, and null-routing an IP address. We may investigate suspected violations, including by inspecting logs, network flows, and, where necessary and lawful, stored content.

7b. Reporting abuse

Anyone may notify us of content or activity on our infrastructure that they consider unlawful or in breach of this AUP, by writing to [email protected]. To allow us to assess a report without a detailed legal examination, please include:

• An explanation of why you consider the content or activity to be unlawful or in breach of this AUP;
• The exact location of the content or activity, such as the IP address, hostname, URL, or server identifier, together with any further detail needed to identify it;
• Timestamps with time zone, and any logs or evidence you can provide;
• Your name and email address, so that we can acknowledge the report and inform you of the outcome; and
• A statement confirming that you believe, in good faith, that the information in the report is accurate and complete.

Your name and email address are not required where the report concerns child sexual abuse material or another sexual offence against a child. We accept anonymous reports of such material and act on them.

We will confirm receipt of a report without undue delay, and we aim to acknowledge abuse reports within one business day. We process reports in a timely, diligent, non-arbitrary, and objective manner, and we will inform the reporter of the decision we reach and of the means of challenging it. Where we use automated means to receive, triage, or decide on reports, we will say so in our response.

7c. Enforcement actions

Where we determine, at our reasonable discretion, that a violation has occurred or is occurring, we may take any of the following actions, with or without prior notice depending on the severity and urgency:

• Issue a warning and request remediation within a stated period;
• Request proof of identity, address, or authority to operate the service, and suspend the service until we receive a satisfactory response, where we reasonably suspect fraud, impersonation, evasion of a prior suspension, or a sanctions match;
• Remove, disable, or restrict access to specific content or services;
• Apply rate limits, null-route an IP address, or filter traffic;
• Suspend the affected service or the entire account;
• Terminate the account and all associated services;
• Retain data as required for legal or evidentiary purposes; and
• Report the matter to law enforcement or other competent authorities.

We are not required to give a reason for an enforcement action, and section "Terminations"" of our Terms of Service applies. We apply and enforce this AUP diligently, objectively, and proportionately, and we will generally provide notice and an opportunity to remediate for minor or unintentional violations. We may act immediately and without notice where there is a risk of harm to others, to our network, or to our other customers, where the activity is manifestly unlawful, or where we are legally required to do so.

Where we become aware of any information giving rise to a suspicion that a criminal offence involving a threat to the life or safety of a person has taken place, is taking place, or is likely to take place, we will inform the relevant law enforcement or judicial authorities and provide the information available to us.

7d. Fees on suspension or termination

Where a service is suspended or terminated for a breach of this AUP, prepaid fees are not refunded. The Customer remains liable for outstanding amounts and for any reasonable costs, fines, penalties, or third-party claims we incur as a result of the breach. Section "Refunds and Disputes" of our Terms of Service governs refunds.

7e. Appeals

A Customer who believes an enforcement action was taken in error may appeal within 30 days of the action, by opening a ticket or writing to [email protected]. An appeal should explain why the Customer considers the decision to be wrong and include any evidence they wish us to consider.

Appeals are reviewed by a member of our staff, not by automated means alone. We will respond in writing, and where we find that the action was taken in error we will reverse it without delay. We are not able to restore data, and content or services that have been removed, deleted, or terminated cannot be recovered. Our appeals process does not affect the Customer's right to bring the matter before a competent court.

7f. Points of contact

Customers, end users, and anyone reporting abuse may contact us at [email protected] for matters relating to this AUP, and at [email protected] for all other matters. These channels are monitored by our staff and are not operated solely by automated means.

Member State authorities, the European Commission, and the European Board for Digital Services may contact us directly at [email protected]. We accept communications in Dutch and English. Our Digital Services Coordinator of establishment is the Netherlands Authority for Consumers and Markets (ACM).

7g. Data on suspension and termination

While a service is suspended, server files and data are retained but are not accessible to the Customer. Access is restored if the suspension is lifted.

On termination, server files and data are deleted and cannot be recovered. Retention periods and backups are governed by section "Overdue Services and Data Retention" of our Terms of Service.

8. Amendments

Wepwawet reserves the right to modify or replace any part of this policy without warning or notice. We will notify you of any changes by posting the new policy on this page. You are advised to check this policy periodically in case of changes. Changes to this policy are in effect from the moment they are posted on this page.

9. Contact

This AUP forms part of our Terms of Service. Where the two conflict, the Terms of Service prevail, and this AUP prevails within its own subject matter, being permitted and prohibited use and enforcement action.

• Wepwawet B.V., Kazerneweg 8, 9883 RP Oldehove, Netherlands
• General enquiries: [email protected]
• Abuse reports: [email protected]
• Chamber of Commerce (KVK): 42115775 · VAT: NL869800772B01

Privacy Policy

Last updated: September 23, 2026

At Wepwawet, accessible from wepwawet.net and our other TLDs, one of our main priorities is the privacy of our visitors. This Privacy Policy document contains types of information that is collected and recorded by Wepwawet and how we use it.

If you have additional questions or require more information about our Privacy Policy, do not hesitate to contact us.

This Privacy Policy applies only to our online activities and is valid for visitors to our website with regards to the information that they shared and/or collect in Wepwawet. This policy is not applicable to any information collected offline or via channels other than this website.

1. Consent

By using our website, you hereby consent to our Privacy Policy and agree to its Terms.

2. Amendments

Wepwawet reserves the right to modify or replace any part of this policy without warning or notice. We will notify you of any changes by posting the new policy on this page. You are advised to check this policy periodically in case of changes. Changes to this policy are in effect from the moment they are posted on this page.

3. Information we collect

The personal information that you are asked to provide, and the reasons why you are asked to provide it, will be made clear to you at the point we ask you to provide your personal information.

If you contact us directly, we may receive additional information about you such as your name, email address, phone number, the contents of the message and/or attachments you may send us, and any other information you may choose to provide.

When you register for an Account, we may ask for your contact information, including items such as name, company name, address, email address, IP address, and telephone number.

Some, not all, of the third-party services we use include:

• Plausible
• FontAwesome
• WHMCS
• TrustPilot
• Cloudflare
• Discord
• fraudrecord

Because of any data shared with third party services – we may be unable to regulate erasure requests with the listed companies/services above, and you may be required to submit erasure requests to the specific company, as listed above.

4. How we use your information

We use the information we collect in various ways, including to:

• Provide, operate, and maintain our website and services.
• Improve, personalize, and expand our website and services.
• Understand and analyze how you use our website and services.
• Develop new products, services, features, and functionality and services.
• Communicate with you, either directly or through one of our partners or tools, including for customer service, to provide you with updates and other information relating to the website service, and for marketing and promotional purposes.
• Send you emails.
• Find and prevent fraud.
• Enforce our Terms of Service, including keeping a record of excluded customers.

4a. Excluded customers

Where we terminate a customer relationship, or decline to provide services under our Terms of Service, we may keep a limited record to prevent the person from creating a new account or placing new orders. This record may include identifiers associated with your account and payment methods, such as your email address, IP address, and a payment method identifier provided by our payment processors, along with a short internal note describing the reason for the exclusion. Where relevant, we may also add these identifiers to the fraud prevention tools of our payment processors.

We process this data based on our legitimate interest in protecting our staff, services, and business. We keep this record for up to 2 years from the date of exclusion, after which it is deleted. You may object to this processing or request access to this record as described in section 10.

5. Log Files

Wepwawet follows a standard procedure of using log files. These files log visitors when they visit websites. All hosting companies do this and a part of hosting services' analytics.

The information collected by log files includes internet protocol (IP) addresses, browser type, browser version, Internet Service Provider (ISP), date and time stamp, referring/exit pages, time spent on those pages, the number of clicks and other statistics.

These are not linked to any information that is personally identifiable except for the IP address if you have an account registered with us. The purpose of the information is for analyzing trends, administering the site, tracking users' movement on the website, and gathering demographic information.

6. Cookies and Web Beacons

Like any other website, Wepwawet uses 'cookies'. These cookies are used to store information including visitors' preferences, and the pages on the website that the visitor accessed or visited. The information is used to optimize the users' experience by customizing our web page content based on visitors' browser type and/or other information.

For more general information on cookies, please read "What Are Cookies".

7. Advertising Partners Privacy Policies

You may consult this list to find the Privacy Policy for each of the advertising partners of Wepwawet.

Third-party ad servers or ad networks use technologies like cookies, JavaScript, or Web Beacons that are used in their respective advertisements and links that appear on Wepwawet, which are sent directly to users' browser. They automatically receive your IP address when this occurs. These technologies are used to measure the effectiveness of their advertising campaigns and/or to personalize the advertising content that you see on websites that you visit.

Note that Wepwawet has no access to or control over these cookies that are used by third-party advertisers.

8. Third-Party Privacy Policies

Wepwawet's Privacy Policy does not apply to other advertisers or websites. Thus, we are advising you to consult the respective Privacy Policies of these third-party ad servers for more detailed information. It may include their practices and instructions about how to opt-out of certain options.

You can choose to disable cookies through your individual browser options. To know more detailed information about cookie management with specific web browsers, it can be found at the browsers' respective websites.

8a. PayPal

If you use PayPal to pay for your service you agree with PayPal's Privacy Policy.

8b. Stripe

If you use Stripe to pay for your service you agree with Stripe's Privacy Policy.

8c. Mollie

If you use Mollie (iDeal, Bancontact, Giropay, EPS, Przelewy24) to pay for your service you agree with Mollie's Privacy Policy.

9. CCPA Privacy Rights (Do Not Sell My Personal Information)

Under the CCPA, among other rights, California consumers have the right to:

• Request that a business that collects a consumer's personal data disclose the categories and specific pieces of personal data that a business has collected about consumers.
• Request that a business deletes any personal data about the consumer that a business has collected.
• Request that a business that sells a consumer's personal data, not sell the consumer's personal data.
• If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us.

10. GDPR Data Protection Rights

We would like to make sure you are fully aware of all of your data protection rights. Every user is entitled to the following:

• The right to access – You have the right to request copies of your personal data.
• The right to rectification – You have the right to request that we correct any information you believe is inaccurate.
• The right to request that we complete the information you believe is incomplete.
• The right to erasure – You have the right to request that we erase your personal data, under certain conditions.
• The right to restrict processing – You have the right to request that we restrict the processing of your personal data, under certain conditions.
• The right to object to processing – You have the right to object to our processing of your personal data, under certain conditions.
• The right to data portability – You have the right to request that we transfer the data that we have collected to another organization, or directly to you, under certain conditions.

If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us.

11. Children's Information

Another part of our priority is adding protection for children while using the internet. We encourage parents and guardians to observe, participate in, and/or monitor and guide their online activity.
Wepwawet does not knowingly collect personal data from children under the age of 16, which is the age of digital consent in the Netherlands.

If you think that your child provided this kind of information on our website, we strongly encourage you to contact us immediately and we will do our best efforts to promptly remove such information from our records.

12. Trackers on our website

• Plausible - to track and report our traffic.

13. Business Information

Where this Privacy Policy conflicts with our Terms of Service, the Terms of Service prevail, and this policy prevails within its own subject matter, being the processing of personal data.

• Address: Kazerneweg 8, 9883 RP Oldehove
• Legal Entity: Besloten Vennootschap (B.V.)
• Data controller: Wepwawet B.V.
• KVK: 42115775
• VAT: NL869800772B01

Service Level Agreement

Last updated: August 30, 2026

1. Service Commitment

We commit to a Monthly Uptime Percentage of at least 99.9% for each service ("Service Commitment"). If we do not meet the Service Commitment, you are entitled to a Service Credit as set out below.

2. Definitions

• "Unavailable" means your service cannot be reached over the network, or has sustained packet loss above 50%, for five or more consecutive minutes, as measured by our monitoring.
• "Downtime" means a period during which your service is Unavailable for reasons within our control and which is not excluded under section "Exclusions".
• "Monthly Uptime Percentage" means 100% minus the percentage of minutes in the calendar month during which your service was Unavailable.
• "Service Credit" means an amount credited to your account, calculated as set out in section "Service Credits".

We provide our services using third-party infrastructure providers, as described in section "Infrastructure and Hardware" of our Terms of Service. Where those providers act as our subcontractors, a failure of their equipment, network, or facilities is treated as being within our control for the purposes of this agreement and is not excluded as a third-party service under section "Exclusions".

3. Service Credits

Service Credits are calculated as a percentage of the charges for the affected service for the month in which the Downtime occurred:

• Below 99.9% and at least 99.0%: 10% Service Credit
• Below 99.0% and at least 95.0%: 25% Service Credit
• Below 95.0%: 50% Service Credit

Service Credits are applied to your account and set against future invoices for that service. They have no cash value and are not refundable. The maximum Service Credit for any service in any month is 50% of the charges for that service for that month. To claim a Service Credit, your account must be in good standing and free of overdue amounts. Unused Service Credits lapse when the account is closed.

4. Claiming a Service Credit

To claim a Service Credit, open a support ticket within 30 days of the incident with "SLA Credit Request" in the subject line, the dates and times of each period you are claiming, and the affected service IDs. You may include your own logs or monitoring data, and we will take them into account, but our monitoring records are what we use to determine whether a service was Unavailable and for how long.

We will respond to a claim within 14 days.

5. Exclusions

The Service Commitment does not apply to unavailability caused by:

• Scheduled maintenance announced at least 24 hours in advance;
• Reasonable emergency maintenance, which we will tell you about as soon as we can;
• Factors outside our reasonable control, including natural disasters, war, civil unrest, government action, strikes, and failures of public internet infrastructure that we do not operate or procure;
• Denial of service attacks against your service or our network. DDoS protection is an additional service and is not guaranteed;
• Your acts or omissions, including misconfiguration, resource exhaustion, or software you install;
• Your own equipment, software, network, or connectivity;
• Third-party software, plugins, mods, or licences you install or choose to run;
• Suspension or termination in accordance with our Terms of Service or Acceptable Use Policy.

6. Sole Remedy

Service Credits are your sole and exclusive remedy for any shortfall in availability or performance of the services covered by this agreement. This does not affect any rights you have as a consumer that cannot be excluded by law.

7. Amendments

Wepwawet may modify or replace this agreement from time to time. We will post the updated agreement on this page and update the "Last updated" date above. Unless we state otherwise, changes take effect when posted.

8. Contact

If you have any questions about this agreement, please contact us at [email protected].

Data Processing Agreement

Last updated: October 23, 2026

This Data Processing Agreement ("DPA") forms part of our Terms of Service. It applies where Wepwawet B.V. ("Wepwawet", "We", "Us") processes personal data on behalf of the Customer in providing the Services, and it sets out the terms required by Article 28 of the General Data Protection Regulation ("GDPR").

By accepting our Terms of Service, the Customer also enters into this DPA. No signature is needed. Customers who need a countersigned copy for their records may request one at [email protected].

1. Definitions and Scope

"Controller", "processor", "personal data", "processing", "data subject", "personal data breach", and "supervisory authority" have the meanings given to them in the GDPR. "Services" has the meaning given to it in section "Scope and Who This Applies To" of our Acceptable Use Policy. In addition:

• "Customer Personal Data" means personal data that the Customer, or anyone using the Services through the Customer's account, stores on or transmits through the Services, and which we process on the Customer's behalf;
• "Sub-processor" means a third party we engage that processes Customer Personal Data.

For Customer Personal Data, the Customer is the controller and Wepwawet is the processor. Where the Customer itself acts as a processor for a third party, such as a reseller hosting services for its own customers, Wepwawet is the Customer's sub-processor and the Customer warrants that its instructions to us are authorised by that third party.

This DPA applies to the extent the GDPR applies to the processing of Customer Personal Data. It does not cover personal data we process as a controller, such as account and billing details, support communications, website visits, network and security logs, fraud prevention records, and the handling of abuse reports and legal obligations under our Acceptable Use Policy. That processing is governed by our Privacy Policy.

2. Details of the Processing

The subject matter, duration, nature, and purpose of the processing, and the types of personal data and categories of data subjects, are set out in Annex 1.

3. Customer's Obligations

The Customer is responsible for:

• Having a lawful basis for the processing of Customer Personal Data, and giving data subjects the information the GDPR requires, for example through a privacy notice for the players, visitors, or users of the Customer's servers and websites;
• Obtaining any consent its processing requires, including parental consent for data subjects under the age of 16 where that applies;
• Ensuring its instructions to us comply with the law;
• Assessing whether the security measures in Annex 2 are appropriate for the Customer Personal Data it chooses to store with us; and
• The security measures within its own control, including securing its credentials, keeping the software it installs patched, encrypting data where its sensitivity requires it, and keeping its own backups, as set out in section "Overdue Services and Data Retention" of our Terms of Service.

4. Processing on Instructions

We process Customer Personal Data only on the Customer's documented instructions, including with regard to transfers to a third country, unless we are required to do otherwise by European Union or Member State law. In that case we will inform the Customer of that legal requirement before processing, unless the law prohibits this on important grounds of public interest.

The Customer's documented instructions are our Terms of Service, our Acceptable Use Policy, and this DPA; the Customer's use and configuration of the Services, including the region it chooses and the actions it takes through our control panel; and any further written instructions the Customer gives us through a support ticket or by email that are consistent with the nature of the Services. We may decline a further instruction that we cannot reasonably carry out, in which case the Customer may cancel the affected services.

We will inform the Customer immediately if, in our opinion, an instruction infringes the GDPR or other data protection law, and we may suspend carrying out that instruction until it is confirmed or changed.

We do not routinely access the content of the Customer's services. We access Customer Personal Data only where that is needed to provide the Services and the support the Customer has asked for; to maintain the security, integrity, and availability of the Services, including the investigation of abuse under section "Monitoring, Investigation, and Enforcement" of our Acceptable Use Policy; to carry out hardware maintenance as described in section "Infrastructure and Hardware" of our Terms of Service; or to comply with the law.

5. Confidentiality

We ensure that everyone we authorise to process Customer Personal Data, including our staff, has committed themselves to confidentiality or is under an appropriate statutory obligation of confidentiality, and that their access is limited to what their role requires.

6. Security

We implement the technical and organisational measures set out in Annex 2 to ensure a level of security appropriate to the risk, as required by Article 32 of the GDPR. We may change these measures over time, provided the overall level of protection is not reduced.

Security is shared. We are responsible for the infrastructure we operate and procure; the Customer is responsible for everything it installs, configures, and stores on its services, and for how it gives others access to them.

7. Sub-processors

The Customer gives us general written authorisation to engage sub-processors of the kinds described in section "Infrastructure and Hardware" of our Terms of Service: datacenter operators, colocation and hosting providers, network carriers, and hardware vendors. Details of the sub-processors we currently use are available on request.

We engage sub-processors under a written contract that imposes data protection obligations no less protective than those in this DPA, in particular sufficient guarantees that they will implement appropriate technical and organisational measures. We remain fully responsible to the Customer for the performance of our sub-processors' obligations.

We will inform the Customer of any intended addition or replacement of a sub-processor at least 14 days in advance, by email to the address on the Customer's account. The Customer may object in writing within that period on reasonable data protection grounds. We will discuss the objection in good faith and, where we can, offer an alternative such as another region. If we cannot resolve the objection, the Customer may cancel the affected services before the change takes effect. Where a change is needed urgently to keep the Services secure or available, such as the failure of a provider, we may make it immediately and will inform the Customer as soon as we can, with the same right to object.

7a. Storage media

Where reasonably possible, storage media is securely wiped or destroyed before it leaves our control or that of our infrastructure providers. Failed media cannot always be wiped and may be returned to the manufacturer or vendor under warranty, as described in section "Infrastructure and Hardware" of our Terms of Service. Customers who need assurance against this should encrypt their data at rest.

8. International Transfers

The Customer chooses the region its services run in, including regions outside the European Economic Area ("EEA"). Choosing a region is an instruction to process Customer Personal Data in that region. We do not move Customer Personal Data between regions unless the Customer asks us to, or we tell the Customer in advance and it does not object.

Where processing in the chosen region involves a transfer of Customer Personal Data to a sub-processor in a country outside the EEA that is not covered by an adequacy decision of the European Commission, we ensure the transfer is subject to the Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914, or to another appropriate safeguard under Article 46 of the GDPR.

The Customer remains responsible for assessing whether a region is suitable for the Customer Personal Data it chooses to store there, and for informing data subjects of the transfer.

9. Data Subject Requests

Most Customer Personal Data is directly accessible to the Customer through the Services, so the Customer can usually respond to requests from data subjects to exercise their rights itself. Taking into account the nature of the processing, we will assist the Customer by appropriate technical and organisational measures, insofar as this is possible, in responding to such requests.

If we receive a request directly from a data subject relating to Customer Personal Data, we will forward it to the Customer without undue delay and will not respond to it ourselves, other than to refer the data subject to the Customer, unless we are legally required to.

10. Personal Data Breaches

We will notify the Customer without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. Because we do not routinely access the content of the Customer's services, we will notify the Customer of any security incident affecting its services that we reasonably believe may involve Customer Personal Data.

We will send the notification to the email address on the Customer's account. It will describe, as far as we know at the time, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, the measures we have taken or propose to take, and a point of contact for further information. Where we cannot provide all of this at once, we will provide it in phases without further undue delay.

We will take reasonable steps to contain the breach and mitigate its effects. The Customer, as controller, is responsible for any notification to the supervisory authority and to data subjects. Notifying a breach is not an admission of fault or liability.

11. Other Assistance

Taking into account the nature of the processing and the information available to us, we will assist the Customer in meeting its obligations under Articles 32 to 36 of the GDPR, including data protection impact assessments and prior consultation with a supervisory authority. Where the assistance goes beyond the information we make available in this DPA, we may charge a reasonable fee for it, unless it is needed because of our own breach of this DPA.

12. Return and Deletion

The Customer can retrieve its data at any time while its services are active, using the means the Services provide. The Customer should retrieve any data it wishes to keep before cancelling a service.

When a service ends, we delete the Customer Personal Data held on it as set out in section "Overdue Services and Data Retention" of our Terms of Service and section "Data on suspension and termination" of our Acceptable Use Policy. Deletion is automatic and cannot be reversed. Copies in any backups we hold are deleted in the normal course of their rotation.

This does not apply where European Union or Member State law requires us to keep the data, or where we retain it for legal or evidentiary purposes under section "Enforcement actions" of our Acceptable Use Policy. In those cases we keep the data confidential and process it only for that purpose. On written request we will confirm to the Customer that deletion has taken place.

13. Information and Audits

We make available to the Customer the information necessary to demonstrate compliance with Article 28 of the GDPR, through this DPA, Annex 2, and written answers to reasonable security questionnaires, which the Customer may send us once in any 12-month period.

Where that information is not sufficient, or where a supervisory authority requires it, the Customer may carry out an audit, including an inspection, either itself or through an independent auditor bound by confidentiality who is not our competitor. The Customer must give us at least 30 days' written notice, and audits take place during business hours, no more than once in any 12-month period unless they follow a personal data breach or are required by a supervisory authority. An audit must not disrupt the Services or give access to the data of our other customers. The Customer bears its own costs of the audit.

Datacenters operated by our infrastructure providers are subject to those providers' own audit arrangements. Where we hold certifications or audit reports from them and are allowed to share them, we will provide them on request.

14. Requests from Authorities

If we receive a legally binding request from a public authority for the disclosure of Customer Personal Data, we will inform the Customer before disclosing it, unless the law prohibits us from doing so. We disclose only what we are legally required to, or what section "Enforcement actions" of our Acceptable Use Policy provides for.

15. Liability

Each party's liability under this DPA is subject to section "Liability" of our Terms of Service. This does not limit either party's liability to data subjects under Article 82 of the GDPR, nor any fine imposed by a supervisory authority.

16. Duration

This DPA remains in force for as long as we process Customer Personal Data on the Customer's behalf, including after the Services end until the data has been deleted under section "Return and Deletion".

17. Amendments

We may update this DPA to reflect changes in the law, in guidance from supervisory authorities, or in our Services. We will post the updated DPA on this page and update the "Last updated" date above. Where a change materially reduces the protection given to Customer Personal Data, we will notify the Customer by email at least 30 days before it takes effect, and the Customer may cancel the affected services before then.

18. Precedence and Governing Law

This DPA forms part of our Terms of Service. Where it conflicts with our Terms of Service, Acceptable Use Policy, Service Level Agreement, or Privacy Policy, this DPA prevails within its own subject matter, being the processing of Customer Personal Data on the Customer's behalf.

This DPA is governed by the laws of the Netherlands. Our lead supervisory authority is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

19. Contact

• Wepwawet B.V., Kazerneweg 8, 9883 RP Oldehove, Netherlands
• Data protection and general enquiries: [email protected]
• Chamber of Commerce (KVK): 42115775 · VAT: NL869800772B01

Annex 1. Details of the Processing

• Subject matter: the provision of the Services to the Customer under our Terms of Service.
• Duration: the term of the Services, and after that until the Customer Personal Data has been deleted under section "Return and Deletion".
• Nature: hosting, storage, computing, and network transmission of the Customer's data, and, where needed, access by our staff and infrastructure providers as described in section "Processing on Instructions".
• Purpose: providing the Services as described in our Terms of Service and as configured by the Customer.
• Frequency: continuous, for the duration of the Services.

Categories of data subjects

These are determined by the Customer, and typically include:

• Players and other end users of the Customer's game servers;
• Visitors to and registered users of the Customer's websites, applications, and bots;
• Members of the Customer's communities, and its staff, administrators, and moderators;
• Where the Customer is a reseller, its own customers and their end users.

Game communities often include children. The Customer is responsible for the additional care this requires.

Types of personal data

These are determined by the Customer, and typically include:

• Usernames, in-game names, and account identifiers, such as player UUIDs;
• IP addresses and connection logs;
• Chat messages, server logs, and in-game activity;
• Account details for the Customer's websites and applications, such as email addresses and password hashes;
• Any other personal data contained in content the Customer stores on the Services.

The Services are not designed specifically for special categories of personal data or data relating to criminal convictions. The Customer should not store such data on the Services unless it has assessed that the measures in Annex 2, together with its own, are appropriate.

Annex 2. Security Measures

Physical security

• Servers are housed in datacenters operated by our infrastructure providers, with physical access restricted to authorised personnel.
• Physical access to equipment holding Customer data is limited to what is needed to install, maintain, repair, replace, and decommission it.
• Storage media is handled as described in section "Storage media".

Access control

• Access to our infrastructure and to Customer services is limited to staff who need it for their role, using individual accounts.
• Administrative access is protected by strong authentication, including multi-factor authentication where the system supports it.
• Access is withdrawn promptly when it is no longer needed.

Isolation and network security

• Customer services on shared infrastructure are logically separated from one another.
• Management interfaces are not exposed to the public internet without access controls.
• We monitor network traffic, resource usage, and abuse signals, and can apply rate limiting, traffic filtering, and null-routing, as described in section "Monitoring" of our Acceptable Use Policy.
• DDoS protection is provided as an additional service and is not guaranteed.

Encryption

• Our website, billing area, and control panel are served over encrypted connections (TLS).
• Encryption of data at rest on a service is the Customer's responsibility.

Maintenance and availability

• We keep the systems we operate, including host operating systems, virtualisation software, and our control panel, up to date with security patches.
• Availability is covered by our Service Level Agreement.
• We do not guarantee backups of Customer data, as set out in section "Overdue Services and Data Retention" of our Terms of Service.

Organisational measures

• Staff with access to Customer data are bound by confidentiality, as described in section "Confidentiality".
• We follow a procedure for detecting, containing, and notifying security incidents, as described in section "Personal Data Breaches".
• Sub-processors are bound by written data protection obligations, as described in section "Sub-processors".

Customer responsibilities

• Securing its account credentials, API keys, and server access, and using strong authentication where offered;
• Securing and patching the operating systems, software, plugins, and mods it installs;
• Controlling who it gives access to its services, and on what terms;
• Encrypting data where its sensitivity requires it; and
• Keeping its own backups.