Listeo Cloud Policies

This page sets out the policies that apply to Listeo Cloud together with the Listeo Cloud Terms of Service.

• Acceptable Use Policy (AUP)
• Data Processing Agreement (DPA)
• Data and security
• Report abuse and DMCA

Listeo Cloud Acceptable Use Policy (AUP)

Version 1.1. Effective from 2 October 2026.

Provider: Łukasz Girek Purethemes.net, a sole proprietorship registered in CEIDG (the Polish business register), NIP (tax ID) 6292371225, ul. Marszałka Rydza Śmigłego 5B/44, 41-219 Sosnowiec, Poland, trading as PureThemes. Abuse reports: [email protected]. General contact: [email protected].

1. Scope and terms

1.1. This policy is part of the Listeo Cloud Terms of Service (the “Terms”). It covers everything in your Instance and through our servers: content, plugins, code, traffic and email.

1.2. “You” or “Customer” means the account holder. “Instance” means your WordPress installation on Listeo Cloud. “Panel” means the customer panel at purethemes.net. “End User” means anyone who uses your Instance, including people adding listings, reviews, messages and bookings.

1.3. You are responsible for everything in your Instance, including the actions of End Users and anyone with wp-admin access.

1.4. We are a hosting service provider under Regulation (EU) 2022/2065 (the “DSA”). We do not pre-screen content; we act on notices and our own findings. Automated tools are used only to detect malware and technical abuse; decisions on measures are taken by a person.

2. Prohibited content

You may not publish or store in your Instance content that:

2.1. Breaks the law, including the law of your country and your End Users’ countries.

2.2. Infringes copyright, trademarks, trade secrets or other third-party rights, including pirated (“nulled”) themes and plugins.

2.3. Is defamatory, harassing or threatening.

2.4. Depicts sexual abuse of children in any form. We report such content to law enforcement immediately.

2.5. Shows sexual content of a person without their consent, including deepfakes.

2.6. Promotes terrorism, violence, or hatred against people because of their characteristics.

2.7. Serves fraud: phishing, fake shops, pyramid schemes, impersonation of companies or people.

2.8. Contains malware, exploits or links to them.

2.9. Offers counterfeit goods, or licensed services (medical, financial, legal, gambling) without the licence required where they are offered.

2.10. Contains fake or purchased reviews, or listings for illegal goods and services (weapons, drugs, stolen personal data, forged documents).

2.11. Is spam, mass-generated content with no value to users, or a link farm.

3. Prohibited activities

You may not:

3.1. Send spam or unsolicited bulk messages from your Instance or our servers, or harvest addresses for them.

3.2. Mine cryptocurrency or run computation unrelated to your Instance.

3.3. Use your Instance as a proxy, VPN, file storage, streaming server or botnet node.

3.4. Run load tests, port scans or penetration tests without our written consent.

3.5. Attack other systems, including unauthorised access attempts, DDoS or password cracking.

3.6. Circumvent platform protections: resource limits, isolation between Customers, authentication, licensing checks or blocks.

3.7. Store full payment card numbers, CVV codes or health data in your Instance. Use a payment gateway that keeps card data on its side; PCI DSS compliance for your shop is your responsibility.

3.8. Resell hosting, or give third parties access to your account as a separate service.

3.9. Use our trademarks (“Listeo”, “PurioChat”, “PureThemes”) in your service name, or suggest that we are a party to your contracts with End Users.

4. Resources and fair use

4.1. Fair use. Each Instance has technical limits (CPU, memory, PHP processes) that we set to protect other Customers. We tell you the values on request. Before we act because of resource use, we warn you, unless the Instance disrupts other Instances (see the resources and fair use provisions in the Terms of Service).

4.2. Servers are shared. Isolation between Instances is a technical limit, not a guarantee. If your Instance consistently exceeds its limits or disrupts other Customers, we may ask you to optimise it.

4.3. We may disable a plugin, theme, cron job or script that harms the server or other Customers. Where possible we warn you first; otherwise we inform you afterwards with the reason.

4.4. Storage is for running your Instance, not for archives, backups of other systems or unrelated files.

5. Email

5.1. Your Instance sends email through your own SMTP service (configured with a plugin). You are the sender and the data controller for that correspondence; we do not guarantee deliverability.

5.2. Transactional messages (booking confirmations, password resets, listing notifications) may be sent without separate consent to the people they concern.

5.3. Marketing messages require the recipient’s prior consent, a working unsubscribe link and your sender details. The laws of your country and the recipient’s country apply (including GDPR, ePrivacy rules and CAN-SPAM).

5.4. Set up SPF, DKIM and DMARC for your sending domain. Without them your email may land in spam and we may restrict sending.

5.5. We may rate-limit email from the platform and block sending that looks like spam.

6. Your directory is a platform

6.1. A Listeo Instance lets End Users add listings, reviews, messages and bookings. If you make that content public, you are an online platform under the DSA towards your End Users; the extent of your duties depends on the size of your business.

6.2. You have your own duties: End User terms, a way to report illegal content, handling of those reports, statements of reasons, a privacy policy, GDPR rights. We do not perform them for you.

6.3. If you sell through your Instance (paid listings, bookings, commissions), you are the seller: taxes, invoices, refunds and consumer rights are your responsibility.

7. Reporting and moderation (DSA Articles 14, 16 and 17)

7.1. Anyone may report content hosted on Listeo Cloud to [email protected]. A notice should include: the exact URL, why the content is illegal or breaches this policy, the reporter’s name and email (notices about child sexual abuse may be anonymous), and a good-faith statement. Notices sent to [email protected] are forwarded.

7.2. We acknowledge receipt by email without undue delay.

7.3. We review notices in a timely, diligent, non-arbitrary and objective manner. Where an End User posted the content, we first forward the notice to the Customer with time to respond under section 8, and act ourselves if the Customer does not respond or the matter is urgent.

7.4. We email our decision to the reporter and the Customer. It states: what we did (removal, restriction, suspension or refusal), the basis (a legal provision or a point of this policy), the facts considered, whether the decision followed a notice or our own findings, whether automated means were used, the scope and duration of the measure, and how to appeal.

7.5. Appeal: reply to the decision email or write to [email protected] within 14 days. A person who did not take the original decision reviews it and we respond within 14 days. You may also use out-of-court dispute settlement or the courts.

7.6. US copyright notices (DMCA) go to [email protected]. The notice and counter-notice procedure is described in Report abuse and DMCA. Repeated copyright infringement leads to termination under section 9.

7.7. Authority orders go to [email protected]. We comply as the law requires and inform the Customer where the law allows. We report threats to life or safety to the competent authorities.

7.8. We keep notices, decisions, appeals and correspondence in abuse, DSA and DMCA cases for 3 years after the case is closed. We keep technical and security logs for 30 days. Details are in the Privacy Policy.

8. Enforcement: two modes

8.1. Immediate mode. We suspend the Instance or block content without prior notice when the breach threatens the platform, other Customers or the safety of persons (for example child sexual abuse, malware, phishing, attacks, spam, payment fraud), or when the law or an authority’s order requires it. We send the statement of reasons promptly after acting.

8.2. Notice mode. In all other cases we email a description of the breach and give you 24 hours to cure it. If it continues, we suspend the Instance or block the content.

8.3. We limit measures to what is necessary: where a single item can be removed instead of taking the whole Instance offline, we do that.

8.4. A suspended Instance is unavailable to visitors. You keep access to the Panel and, where safe, to wp-admin to fix the breach. Once fixed, we restore the Instance without undue delay.

9. Consequences

9.1. For a breach we may: remove or restrict content, disable a plugin or feature, limit resources or email sending, suspend the Instance, or terminate the contract.

9.2. We may terminate the contract with immediate effect for a serious breach, or for repeated breaches after notices, including after 3 substantiated notices within 12 months (see the termination provisions in the Terms of Service).

9.3. Fees are not refunded for a suspension caused by your breach. You are liable, within the limits of the law, for damage your breach causes us or third parties.

9.4. After termination for breach, data is retained under the “Data after the contract ends” section of the Refund and Cancellation Policy, unless the law requires preservation or earlier deletion.

10. Changes and contact

10.1. We announce changes to this policy by email 30 days in advance (see the provisions on changes to the Terms and prices in the Terms of Service). Changes required by law or solely in your favour may take effect sooner.

10.2. Points of contact under DSA Articles 11 and 12: [email protected] for authorities, [email protected] for users, in Polish or English.

Data Processing Agreement (DPA) for Listeo Cloud

Version 1.1. Effective from 2 October 2026.

This agreement is part of the Listeo Cloud Terms of Service. It sets out how we process the personal data the Customer entrusts to us within the service. Legal basis: Article 28(3) of Regulation (EU) 2016/679 (GDPR).

1. Parties and conclusion of the agreement

1.1. Processor (referred to as “we”, “the Provider”): Łukasz Girek Purethemes.net, a sole proprietorship (jednoosobowa działalność gospodarcza) registered in the Polish Central Register and Information on Economic Activity (CEIDG), ul. Marszałka Rydza Śmigłego 5B/44, 41-219 Sosnowiec, Poland, tax ID (NIP) 6292371225, PureThemes brand (purethemes.net). Data protection contact: [email protected].

1.2. Controller (referred to as “the Customer”): the entity that creates a Listeo Cloud account and accepts the Terms of Service.

1.3. The Customer enters into this agreement by starting a trial or placing an order, where the agreement is linked next to the trial or order button on the Listeo Cloud page. No signature is needed. On request we send a PDF copy.

1.4. This agreement applies when the Customer processes other people’s data on its site for professional, commercial or public purposes. It does not cover purely personal use (Article 2(2)(c) GDPR).

2. Definitions

2.1. “Customer Data”: personal data that the Customer or the users of the Customer’s site place in the WordPress installation hosted in Listeo Cloud, including data moved on the Customer’s instruction from its existing site (section 4.5).

2.2. “Service”: managed WordPress hosting with the Listeo theme, as described in the Terms of Service, including the trial.

2.3. “Sub-processor”: another entity to which we entrust part of the processing of Customer Data.

2.4. Other terms have the meaning given in Article 4 GDPR.

3. Subject matter, duration, nature and purpose of processing

3.1. The subject matter is storing and serving Customer Data as part of the Service and, on the Customer’s instruction, moving its existing site into Listeo Cloud. Data types and categories of data subjects are set out in Annex 1.

3.2. This agreement lasts as long as the Service agreement (including the trial), plus the deletion period in section 10.

3.3. The Customer is the controller of its users’ data and decides the purposes and means of processing. We act on the Customer’s behalf.

4. Customer’s instructions

4.1. We process Customer Data only on the Customer’s documented instructions. Instructions are: the Terms of Service, this agreement, the Customer’s settings and actions in the Panel and in wp-admin, the Customer’s support requests, and a migration order under section 4.5. Access by our administrators to the installation for support, fault diagnosis or restoring a backup is an instruction under the Terms of Service.

4.2. We do not process Customer Data for our own purposes. We do not profile the users of Customer sites. We do not sell data.

4.3. We process data without the Customer’s instruction only where Union law or Polish law requires it. In that case we inform the Customer before processing, unless the law prohibits this.

4.4. If we believe an instruction infringes the GDPR or other data protection law, we inform the Customer immediately. We may suspend that instruction until the matter is clarified.

4.5. Migration of an existing site. On the Customer’s instruction we move its existing WordPress site from its current hosting provider into Listeo Cloud. The Customer installs our migration plugin on the existing site and gives us a one-time key. Using that key, our administrators pull the database, files and media of that site and imports them into the Customer’s Listeo Cloud installation. We pull only what is needed to move the site, and only while the migration runs. The Customer is responsible for having the right to pass this data to us. Data that remains with the current provider is not covered by this agreement. Migration is free of charge, once per site, and done within a reasonable time without a guaranteed date. After completion we revoke the key on our side and the Customer removes the plugin from the existing site. We delete the migration working files after completion. We do not change the existing site; we only take a copy.

5. Confidentiality

5.1. Only people who need access to provide the Service have access to Customer Data. As at 2 October 2026 these are our two named administrators.

5.2. Each such person is bound to confidentiality by contract or by a statutory duty. The duty continues after the person stops working with us.

6. Security of processing

6.1. We implement technical and organisational measures appropriate to the risk, in line with Article 32 GDPR. They are described in Annex 2.

6.2. We may change the measures in Annex 2, provided the overall level of protection does not decrease.

6.3. The Customer is responsible for security on its side: passwords, WordPress administrator accounts, keeping the plugins and themes it installs up to date, and its own integrations (SMTP, maps, payments, AI).

7. Sub-processors

7.1. The Customer gives general written authorisation to use Sub-processors. The current list is in Annex 3 and in the Data and security section of this page.

7.2. We notify the Customer by e-mail to the account address of any intended addition or replacement of a Sub-processor at least 14 days before the change.

7.3. The Customer may raise a reasoned objection within that period at [email protected]. If we cannot find a solution, the Customer may terminate the Service agreement with effect before the change takes effect. Fees for a started billing period are not refunded (see the Refund and Cancellation Policy). No objection within the period means acceptance.

7.4. We conclude a contract with each Sub-processor that imposes data protection obligations at least equivalent to those in this agreement. We remain liable to the Customer for the Sub-processor’s performance as for our own.

7.5. A provider of a service the Customer integrates into its own site with its own keys (maps, AI, SMTP, payment gateways) is not a Sub-processor. It is a recipient chosen by the Customer. The Customer’s current hosting provider, from which we pull data during a migration, is not a Sub-processor either.

8. Assistance with data subject requests

8.1. The Customer handles its own users’ requests (access, rectification, erasure, restriction, portability, objection) with the tools in wp-admin.

8.2. If a request reaches us, we forward it to the Customer without undue delay. We answer the person only by indicating who the controller is.

8.3. At the Customer’s request we assist where the Customer cannot fulfil the request in wp-admin itself (for example data held in backups). Reasonable effort is included in the Service.

9. Assistance under Articles 32 to 36 GDPR, breaches

9.1. We notify the Customer of a personal data breach affecting Customer Data without undue delay and no later than 72 hours after becoming aware of it. We send the notice to the account e-mail address.

9.2. The notice contains, as far as available, the elements of Article 33(3) GDPR: a description of the breach, the categories and approximate number of data subjects and records, likely consequences, measures taken and proposed. Missing information is provided in phases.

9.3. Notifying the supervisory authority (72 hours, Article 33 GDPR) and data subjects remains the Customer’s obligation. We do so on the Customer’s behalf only at its request.

9.4. We assist the Customer with data protection impact assessments (Article 35) and prior consultation with the authority (Article 36) by providing information about the Service and the measures in Annex 2.

10. Deletion or return of data at the end of the Service

10.1. For 30 days after the Service agreement ends, the Customer can download Customer Data. If the site was suspended for non-payment of a renewal or after a cancelled trial, the 30 days run from the date of suspension. The export is free of charge. Exportable data (exhaustive list):

• a full dump of the Instance database (SQL);
• WordPress files: plugins, themes, local uploads, configuration (without our infrastructure secrets);
• an archive of media from object storage;
• a WordPress content export in WXR (XML) format.

The formats are structured and machine-readable. We do not export platform configuration, system logs or infrastructure keys.

10.2. We prepare the export on request sent to [email protected] within 7 days of the request. The download link is valid for 14 days. If the request arrives within the period in 10.1, we do not delete data before the export is made available.

10.3. After the period in 10.1 we delete the Customer’s installation, database, files and media. Backups are deleted no later than 90 days after that period ends; until automatic backup rotation is enabled (Annex 2) we purge them manually. A suspended site is not included in backups, so no new backups of it are made during suspension. After the agreement ends we do not restore data from backups, except in the case in 10.5.

10.4. On the Customer’s request we confirm deletion in writing (e-mail).

10.5. We keep data longer only where Union law or Polish law requires it, or where a dispute is pending in which the data is evidence. In that case we restrict processing to storage.

11. Information and audits

11.1. We make available to the Customer the information necessary to demonstrate compliance with Article 28 GDPR: this agreement with its Annexes, the Data and security section of this page, and answers to reasonable written questions.

11.2. Order: documentation first. If documentation is not enough to demonstrate compliance, the Customer may conduct an on-site or remote audit.

11.3. Audit rules: no more than once per calendar year, unless a breach occurred or a supervisory authority requires it; at least 30 days’ notice; agreed scope and date; the auditor is bound to confidentiality; no access to other Customers’ data; at the Customer’s cost; results confidential. The audit does not cover Sub-processors; we provide their certificates and reports where we receive them.

12. International transfers

12.1. Site databases and files are stored on servers in Germany (Netcup), and backups in Germany (Hetzner). Site media is stored in Cloudflare R2 object storage; the storage location is determined by Cloudflare. Except as set out in 12.2, we do not move Customer Data outside the EEA on our own initiative.

12.2. Cloudflare, Inc. and Help Scout Inc. are US companies. The transfer basis is the Commission’s Standard Contractual Clauses (Decision 2021/914), and for a provider certified under the EU-US Data Privacy Framework also the Commission decision of 10 July 2023. The Cloudflare network operates globally as a traffic and cache layer.

12.3. If the Customer itself chooses an integration that sends data outside the EEA (for example an AI service on its own key), the Customer is responsible for the legal basis of that transfer.

13. Liability

13.1. Each party is liable for damage caused by processing under Article 82 GDPR.

13.2. Towards Customers who are not consumers, our liability under this agreement is subject to the cap in the Terms of Service: the fees paid by the Customer in the last 12 months. The cap does not apply to damage caused intentionally or to liability that cannot be limited by law. The cap does not limit the rights of data subjects.

13.3. The Customer is responsible for the lawfulness of its purposes and legal bases, for the content of its site, and for informing its users (Articles 13 and 14 GDPR).

14. Precedence, changes, final provisions

14.1. On data protection matters this agreement prevails over the Terms of Service. On all other matters the Terms of Service apply.

14.2. We announce changes to this agreement in the same way as changes to the Terms of Service (30 days in advance). A change resulting from law or guidance of a supervisory authority may take effect sooner. Changes to the Sub-processor list follow section 7.

14.3. Governing law: Polish. Courts: the court having jurisdiction over the Provider’s address stated in section 1.1, without prejudice to mandatory consumer rights and the powers of supervisory authorities.

14.4. This agreement is published in English. We can provide a Polish translation on request; the English version is binding.

Annex 1. Description of processing

Item	Content
Subject matter	Hosting and maintaining the Customer’s WordPress installation with the Listeo theme; on the Customer’s instruction, moving its existing site into Listeo Cloud
Duration	Term of the Service agreement (including the trial) plus 30 days; after suspension for non-payment or after a cancelled trial: 30 days from suspension; backups no later than 90 days after that
Nature	Storage, serving over the network, backup, restore, technical maintenance, migration on the Customer’s instruction (pulling the database, files and media from the current hosting provider and importing them); no content analysis
Purpose	Enabling the Customer to run a listings directory or booking site for its users, including moving its existing site
Categories of data subjects	End users of the Customer’s site: account holders, listing owners, people making bookings, authors of messages and comments, visitors (IP addresses in logs); the Customer’s staff and contractors with wp-admin accounts. For a migration: the same categories from the Customer’s existing site
Types of data	Account data (first name, last name, e-mail, username, hashed password, avatar); listing content (business name, address, phone, description, photos, location); bookings (dates, participants, amounts, payment status, notes); messages and comments; files uploaded by users; IP addresses and technical data in server logs
Special categories	The Service is not designed for data under Articles 9 and 10 GDPR; if the Customer processes such data, it is responsible for additional safeguards
Payment card data	Not stored on the platform. Payments on the Customer’s site are handled by the gateway the Customer chooses
Location	Germany (servers, backups); Cloudflare R2 (media, location as determined by Cloudflare); Cloudflare network (traffic, cache)

Annex 2. Technical and organisational measures

As at 2 October 2026. We describe what is in place. Planned measures are marked as such.

Isolation between customer sites

• Each Customer installation runs as a separate Linux user, with its own MariaDB database engine, its own Redis instance, its own PHP process and a separate filesystem volume.
• Installations cannot access the files or databases of other Customers.
• The Customer has no SSH or SFTP access.

Encryption

• TLS on every public connection: between the browser and the Cloudflare network, between Cloudflare and the server, and in the Panel and wp-admin.
• Backups are encrypted before they leave the server.

Access control

• Administrative access to servers is limited to our two named administrators, with SSH keys only.
• Accounts in provider consoles (Netcup, Cloudflare, Hetzner, Help Scout) are protected by multi-factor authentication.
• Our administrators enter a Customer installation only for support, diagnosis, restoring a backup or a migration ordered by the Customer.

Backups and restore

• Databases: off-server, encrypted backup in Hetzner Storage Box (Germany); target: four times a day.
• Files (plugins, themes, local uploads, configuration): backup in the same place; target: once a day.
• Backup frequency is a target, not a guarantee. We do not yet have external alerting for a skipped or failed backup; backup runs are checked manually.
• Media in Cloudflare R2 is not currently covered by backups.
• Suspended sites are not included in backups.
• Backup retention: target of every copy from the last 48 hours, 14 daily, 8 weekly and 6 monthly. Automatic rotation will be enabled after testing; until then backups are kept, and data of ended agreements is purged from backups manually within the period in section 10.3.
• Restore to a chosen point in time is performed by our administrators on the Customer’s request. The Customer keeps its own copies, especially of media.

Logging and monitoring

• All logs (web server, system, error, login logs including logins by our administrators, and security logs) are kept for 30 days. Longer only where needed to resolve an ongoing incident or dispute.
• Protection against malicious traffic and DDoS attacks at the Cloudflare layer.

Organisation

• System and platform component updates are made and documented by our administrators. Updates of plugins installed by the Customer are the Customer’s responsibility.
• Incident response procedure with the deadline in section 9.
• No payment card data on the platform.
• Planned measures: R2 media backup, self-service export, external alerting (including for a skipped backup). These are not commitments until announced.

Annex 3. Sub-processor list

As at 2 October 2026. Current list: Data and security section of this page. Changes follow section 7.

Sub-processor	Purpose	Data location	Transfer basis
Netcup GmbH, Germany	Site servers: WordPress, MariaDB databases, Redis, PHP	Germany	No transfer outside the EEA
Cloudflare, Inc., USA	R2 media storage (photos, user files)	As determined by Cloudflare	SCCs, DPF
Cloudflare, Inc., USA	Network, DNS, TLS, CDN and cache, attack protection	Global network (edge cache)	SCCs, DPF
Hetzner Online GmbH, Germany	Backups (Storage Box)	Germany (Falkenstein)	No transfer outside the EEA
Help Scout Inc., USA	Support ticket handling, where the Customer may share data from its site	USA	SCCs

There are no Sub-processors beyond this list. The Merchant of Record is not a Sub-processor: it processes the Customer’s payment data as an independent controller and has no access to Customer Data. The current Merchant of Record is Dodo Payments. Paddle and Polar are planned as possible additional Merchants of Record and are not used today.

Data and security in Listeo Cloud

Version 1.1. Effective from 2 October 2026.

Where we store your site’s data, how we protect it, and how you can take it and leave. Published under Articles 26 and 28 of the EU Data Act (2023/2854). Provider: Łukasz Girek Purethemes.net (PureThemes brand).

1. Where your data is

The table lists every provider that touches your site’s data. There are no others.

Component	Provider	Location and jurisdiction	GDPR role
Site servers (WordPress, MariaDB databases, Redis, PHP)	Netcup GmbH	Germany, German law	Sub-processor
Media (images, user files)	Cloudflare, Inc. (R2)	Location as determined by Cloudflare; contract with a US entity, Standard Contractual Clauses and Data Privacy Framework	Sub-processor
Network, DNS, TLS, CDN and cache, protection	Cloudflare, Inc.	Global network, edge cache	Sub-processor
Backups	Hetzner Online GmbH (Storage Box)	Germany (Falkenstein), German law	Sub-processor
Customer panel, licensing	Łukasz Girek Purethemes.net (own servers)	Germany	Controller
Support (tickets)	Help Scout Inc.	USA, Standard Contractual Clauses	Sub-processor
Payments	Dodo Payments; Paddle and Polar planned, not used today	Per provider	Independent controller

Cloudflare’s edge cache temporarily holds public pages at locations worldwide. Databases, site files and backups stay in Germany.

2. Protection against access by third-country governments

Measures against unlawful access by non-EU governments (Data Act Article 28(1)(b)):

1. Servers, databases and backups are hosted by German providers (Netcup, Hetzner) in Germany, under German and EU law.
2. Media is stored in Cloudflare R2 under our contract with Cloudflare (Standard Contractual Clauses, Data Privacy Framework). Its storage location is determined by Cloudflare. Until we have confirmed the EU jurisdiction setting for our storage, we do not claim that media stays in the EU.
3. Backups are encrypted before upload. The storage provider does not hold the key.
4. Traffic between visitors and your site, and between us and our providers, is TLS encrypted.
5. Only our staff and the providers in section 1 have access to the data. There are no sub-processors outside that list and no third-country partners with access to the infrastructure.
6. We disclose data only under a valid order from a court or authority that binds us in Poland or the EU, and only the minimum required. A request from a non-EU authority is reviewed under Article 32 of the Data Act and Article 48 of the GDPR. Where the law allows, we inform you before disclosure. We keep a log of requests.

3. Isolation of your site from other customers

Every site has its own WordPress installation, MariaDB engine, Redis instance, PHP process pool, system user and file volumes. Customers cannot see each other’s databases or files. Isolation limits the effect one site can have on another; it does not guarantee unlimited resources. If a site threatens the stability of the server, we may limit its resources or disable a harmful plugin as described in the Terms of Service and the Acceptable Use Policy.

4. Backups

This describes the current state. Targets and work in preparation are marked as such.

What	How often (target)	Where and how
Database	Four times a day (every 6 hours)	Off-server, encrypted, Hetzner Storage Box in Germany
Files (plugins, themes, local uploads, configuration)	Once a day	As above
Media in Cloudflare R2 (images)	No backup. A media backup is in preparation and is not a commitment until announced	None
Suspended sites	No backup while suspended	None
Retention	Target: every copy from the last 48 hours, 14 daily, 8 weekly, 6 monthly. Automatic rotation will be enabled after testing; until then copies are kept

Backup frequency is a target, not a guarantee. We do not yet have external alerting that warns us of a skipped or failed backup; backup runs are checked manually.

Restore on request: write to [email protected] with the date and time you want to return to. Our administrators restore your database and files to that point. There is no self-service restore yet. We give no guarantee against data loss. Keep your own copy outside the platform, especially of images and other media.

5. How to export your data and leave

You can cancel your subscription at any time; cancellation takes effect at the end of the paid year. You can order an export and a move to another provider at any time, including during the year. There are no fees for export, switching provider or outgoing traffic. The notice period for switching provider never exceeds 2 months (Data Act Article 25). When you move to another provider, at your request we provide a transition period of up to 30 days during which the site keeps running and the data remains available for download; where technically necessary we may extend this period once, informing you before it ends.

5.1. What you can take

Exportable data (exhaustive list):

• a full dump of the Instance database (SQL);
• WordPress files: plugins, themes, local uploads, configuration (without our infrastructure secrets);
• an archive of media from object storage;
• a WordPress content export in WXR (XML) format.

The formats are structured and machine-readable. We do not export platform configuration, system logs or infrastructure keys. Any WordPress host can import the SQL dump (Data Act, Articles 25 and 30).

5.2. How to request it

1. Write to [email protected] from the email address on your account. State the site address.
2. We prepare the package and send a download link within 7 days of the request. The link is valid for 14 days. Our administrators prepare the export manually.
3. Verify the archive after download.

5.3. After the contract ends or after suspension

Your data stays available for download for 30 days after the contract ends. If the site was suspended for non-payment of a renewal (7 days after the failed payment) or after a cancelled trial, the 30 days run from the date of suspension. A suspended site is not included in backups. After that period we delete the database, files and media; backups are deleted no later than 90 days after the data retrieval period ends; until automatic rotation is enabled we purge them manually. On request we confirm deletion in writing.

5.4. Domain

The domain is yours. We are never its registrant. To leave, change the DNS records at your registrar to the new host. After the contract ends we remove your hostname and TLS certificate. The temporary *.listeo.pro address belongs to us and does not move to the new host.

5.5. Software licence

The PHP code (WordPress, Listeo, plugins) is GPLv2 or later and stays with you. The licence for proprietary assets (CSS, JavaScript, graphics) ends with the subscription. Details are in the Terms of Service.

6. Security breach notification

If we detect a personal data breach affecting your site, we notify you as the controller within 72 hours of becoming aware of it. The notification includes the description, categories of data, approximate number of persons, likely consequences and measures taken, which is what you need for your own 72-hour notification to the supervisory authority (GDPR Article 33).

7. Responsible disclosure

Found a vulnerability? Write to [email protected] with a description and steps to reproduce, and give us time to fix it before publishing. We do not take legal action against good-faith researchers who do not access customer data or disrupt the service.

8. Contact

General matters: [email protected]. GDPR matters: [email protected]. Abuse and security: [email protected]. Łukasz Girek Purethemes.net, ul. Marszałka Rydza Śmigłego 5B/44, 41-219 Sosnowiec, Poland.

Report abuse and DMCA

Version 1.1. Effective from 2 October 2026.

Listeo Cloud hosts websites that belong to our customers. We do not create or control their content. This section explains how to report illegal content (Digital Services Act, DSA, Article 16), what happens to your report, and how the DMCA procedure works for claims from the United States. The service is provided by Łukasz Girek Purethemes.net, a sole proprietorship registered in CEIDG (the Polish business register), NIP (tax ID) 6292371225, ul. Marszałka Rydza Śmigłego 5B/44, 41-219 Sosnowiec, Poland.

1. Who your report concerns

Every site in Listeo Cloud is a listing directory run by our customer. The customer is a separate service provider towards its own users and is responsible for the listings, reviews and bookings published there. If a directory user added the content, contacting the site owner (footer or contact page of the directory) is usually fastest. You can still report the content directly to us. We will handle it as the hosting provider.

2. What a report must contain

A report is valid if it contains (DSA Article 16(2)):

1. An explanation of why you consider the content illegal. Name the law or right being infringed if you know it.
2. The exact URLs of the content. The site’s home page address is not enough.
3. Your name and email address. Exception: reports of child sexual abuse material may be anonymous.
4. A statement that you are reporting in good faith and that the information in the report is accurate and complete.

A report without these elements may be rejected. We will ask you to complete it if we have your email.

3. Where to send it

Email [email protected]. This address is also our point of contact for Member State authorities, the European Commission and the European Board for Digital Services (DSA Article 11). Point of contact for users (DSA Article 12): [email protected]. We accept reports in English and Polish.

4. What happens after you report

1. We send an acknowledgement of receipt to your email without undue delay.
2. We review the report diligently, objectively and within a reasonable time. We do not use automated tools to make the decision.
3. If the content is illegal, we remove it or disable access. In most cases we first forward the report to the customer with 24 hours to remove the content. In case of serious risk we act immediately.
4. We inform you of the decision and whether you can contest it.
5. The customer receives a statement of reasons (DSA Article 17): facts, URLs, legal or contractual basis, the scope and duration of the measure, confirmation that the decision was not automated, and how to appeal.

We may, after a prior warning, stop processing reports that are manifestly unfounded or submitted repeatedly in bad faith.

5. How to contest a decision

Both the notifier and the customer can appeal our decision within 14 days of receiving it by replying to the decision email or writing to [email protected]. The appeal is reviewed by a person who did not take the original decision. We respond within 14 days. The appeal does not exclude court action or a complaint to an authority.

6. Threat to life or safety

If we become aware of content indicating a criminal offence involving a threat to the life or safety of persons, we notify law enforcement (DSA Article 18). If you see such a threat, call the emergency number in your country first, then write to us.

7. Requests from authorities and police

We disclose customer or user data and remove content at an authority’s request only under a valid order that binds us (DSA Articles 9 and 10, GDPR Article 48). The order must state the legal basis, the issuing authority, the URL of the content and the scope of the data. Informal requests are referred to the official channel. Address: [email protected], correspondence: Łukasz Girek Purethemes.net, ul. Marszałka Rydza Śmigłego 5B/44, 41-219 Sosnowiec, Poland.

8. Copyright infringement: DMCA procedure (USA)

This section applies to claims under the US Digital Millennium Copyright Act, 17 U.S.C. 512. EU claims should follow sections 2 e 3. You may use both routes.

8.1. Where to send DMCA notices

Send DMCA notices and counter-notices by email to [email protected]. Postal correspondence: Łukasz Girek Purethemes.net, ul. Marszałka Rydza Śmigłego 5B/44, 41-219 Sosnowiec, Poland.

8.2. Elements of a notice (17 U.S.C. 512(c)(3))

1. A physical or electronic signature of a person authorised to act on behalf of the copyright owner.
2. Identification of the copyrighted work claimed to be infringed. For multiple works, a representative list is sufficient.
3. Identification of the infringing material, with exact URLs.
4. Your contact information: address, telephone number and email.
5. A statement that you have a good-faith belief that use of the material is not authorised by the copyright owner, its agent or the law.
6. A statement, under penalty of perjury, that the information is accurate and that you are the copyright owner or authorised to act on the owner’s behalf.

On receipt of a complete notice we remove or disable access to the material and inform the customer, providing a copy of the notice.

8.3. Counter-notice

If you are a customer or user and believe the material was removed by mistake or misidentification, send a counter-notice to [email protected] containing (17 U.S.C. 512(g)(3)):

1. Your physical or electronic signature.
2. Identification of the removed material and the location where it appeared.
3. A statement, under penalty of perjury, that you have a good-faith belief that the material was removed by mistake or misidentification.
4. Your name, address and telephone number, and consent to the jurisdiction of the federal district court for your address (or, if you are outside the USA, any federal district court in which we may be found) and that you will accept service of process from the person who filed the notice.

We forward the counter-notice to the notifier. Unless the notifier tells us within 10 business days that it has filed a court action, we restore the material between 10 and 14 business days after receiving the counter-notice.

8.4. Repeat infringers

We terminate the account of a customer who repeatedly infringes copyright. Rule: 3 substantiated notices within 12 months, not answered by an effective counter-notice, lead to termination of the service. The customer receives a statement of reasons and may appeal under section 5.

8.5. False notices

A person who knowingly submits a false notice or counter-notice is liable for damages under 17 U.S.C. 512(f).

9. Retention of report data

We keep notices, decisions, appeals, DMCA notices and counter-notices, and the correspondence in these cases for 3 years after the case is closed. We keep technical and security logs for 30 days. Details are in the Privacy Policy.

10. Contact

Abuse and authorities: [email protected]. DMCA: [email protected]. General matters: [email protected]. Łukasz Girek Purethemes.net, ul. Marszałka Rydza Śmigłego 5B/44, 41-219 Sosnowiec, Poland.