This notice explains what we collect when you use 1PrimeCDN, why we collect it, where it sits and how long we keep it. It is written to be read, not filed away.
The data controller is Prime Server S.r.l., Via General Cantore 33-35, Grosseto (GR), Italy · VAT and tax code IT01794620532.
For any question about this notice, or to exercise your rights, write to us from the form on the Contact page.
Account data. Company or personal name, VAT number, email address, the name of whoever uses the panel, a password kept only in hashed form, and the date of the last sign-in. We need these to give you the service: the legal basis is performance of the contract.
Billing data. Usage, amounts, top-ups and invoices. We handle these because the law requires it.
Node request logs. Every node logs the requests it serves: the IP address of whoever opens the page, date and time, the address requested, the browser, bytes served and whether it came from cache. Without this a CDN can neither work nor defend itself: the legal basis is our legitimate interest, and the customer's, in running and protecting the service.
Security decisions (Shield). When an IP address is blocked or put through a challenge, we keep the address, the reason, the nodes involved and the expiry of the decision. Same legitimate interest.
Statistics. The figures you see in the panel are aggregated by site, node and day: bytes, requests and cache ratio. They contain no IP addresses and nothing else that identifies a visitor.
Access log (if you switch it on). For each site you can ask the nodes to send us a row for every request served — date and time, the visitor’s IP address, the address requested, the outcome, bytes, node, country, referrer and browser — and download it. It is off by default and you switch it on yourself, site by site: in that case you are the controller of that data and we keep it on your behalf. Switch it off and we delete every row already collected, at once.
Support requests. When you write from the form we handle your name, your email and the message itself, in order to reply.
The public website uses no tracking cookies and no third-party analytics: there is no banner because there is nothing to accept.
The panel uses one technical session cookie, needed to keep you signed in.
When a site is in «under attack» mode, a visitor who passes the challenge gets a technical cookie (pcdn_pass) that lasts 12 hours, purely so the challenge is not repeated on every page.
The panel, the database and the backups are in the European Union.
The nodes that serve traffic are in Italy, France, Germany, Finland and Poland; one is in London, outside the Union but in the United Kingdom, a country covered by a European Commission adequacy decision. If you need your site's traffic never to leave the Union, you can exclude whichever nodes you want from the panel, site by site.
We sell data to nobody, and we run no advertising on customer or visitor data.
Acting as processors are the infrastructure providers the service runs on: OVHcloud, Hetzner, Aruba, Akamai (Linode) and Vultr for the servers, Google for sending service email.
We may disclose data to the judicial authorities where we are required to.
Account: as long as the relationship is active, then until outstanding matters are closed.
Tax documents: ten years, as Italian law requires.
Node request logs: fourteen days, then deleted automatically.
Access log for customers who switch it on: seven days, then deleted on its own. If the customer switches it off, the rows already collected are deleted at once.
Security decisions: until they expire; the log keeps a record of the decision so it can be explained to the customer.
When a site runs through our network, we handle its visitors' data on the customer's behalf: they are the controller, we are the processor under article 28 of Regulation (EU) 2016/679.
The data processing agreement is available on request from the Contact page.
At any time you may ask us to give you access to your data, correct it, delete it, restrict its processing, hand it over in machine-readable form, or object to processing based on legitimate interest (articles 15 to 22 of the Regulation).
We answer within one month. If you think something is wrong, you can complain to the Italian data protection authority (garanteprivacy.it).
If we change this notice we change the date below too, and if the change is substantial we tell customers by email.
Last updated: October 15, 2026