General Terms of Service - GTS

Last Revised: 2026-08-18 13:13

GENERAL TERMS OF SERVICE (GTS)

Article 1: Company Identity & Remote-First Operational Model

1.1. The sole proprietorship operating under the trade name "Prootzos Online" (hereinafter the "Provider"), VAT ID EL 047648274 (Tax Office of Pyrgos Ilias), legally represented by Nikolaos Prountzos (CEO), maintains its registered tax seat and mailing address at 46 Karkavitsa Street, PC 27131, Pyrgos Ilias, Greece (Website: [https://prootzos.com](https://prootzos.com) | Email: contact@prootzos.com | Phone: +30 2621 121 373).

1.2. The Provider operates strictly under a Remote-First Service Provision Model. The stated address serves solely and exclusively as the registered tax seat and postal dispatch location. There is no physical retail store, reception facility, or provision for in-person customer service on premises.

1.3. All communications, contractual transactions, technical support, and commercial operations are conducted exclusively through digital and telephonic channels (Client Area, Tickets, Email, Phone), as specified in DOC-004: Support Policy & SLA.

Article 2: Scope, Documentation Architecture & Definitions

2.1. These General Terms (DOC-001) govern the contractual relationship between the Provider and any natural or legal person (hereinafter the "Client") ordering, activating, or utilizing any service.

2.2. These Terms constitute the primary contractual document and incorporate by binding reference (Cross-Reference) Prootzos Online's specific regulatory policies:

2.3. All technical and legal terms herein shall be construed strictly in accordance with the definitions set forth in DOC-002.

Article 3: Control & Management Environments (Client Area vs Controller)

3.1. The Client's operational interaction and service management are strictly partitioned into two distinct digital environments:

Client Area: The exclusive interface for order management, billing, payment processing, domain name registration/renewal, commercial SSL certificates, Support Ticket submissions, Knowledgebase access, and Network Status monitoring.
Hosting Controller: The sole and exclusive technical control interface for provisioning and configuring hosting resources (Websites, vHosts, FTP accounts, Databases, DNS Zones, Mailboxes, Spam filtering policies).

3.2. The Client maintains sole responsibility for preserving credential confidentiality and for all actions executed through their accounts within the aforementioned systems.

Article 4: Scope of Core Managed Services & Support Boundaries

4.1. The Provider delivers managed infrastructure services, comprising:

Shared Hosting: Allocation of isolated compute resources in a multi-tenant environment with standardized configurations.
Managed Virtual Private Servers (Managed VPS): Virtualized environments (KVM on Proxmox VE) featuring pre-installed Debian OS and the Controller interface. Virtualization management capabilities accessible to the Client are strictly limited to Start, Stop, Reboot, and Usage Stats via the integrated Controller module. Proxmox Console/VNC access, custom ISO loading, and virtual network (VLAN) configurations are strictly prohibited.
Managed Dedicated Servers: Bare-metal physical hardware with full OS and Controller-level management executed by the Provider.
Email Hosting: Mail routing services (IMAP/POP3/SMTP) protected by the Rspamd filtering system. The Client may select pre-configured spam policies per domain/mailbox via the Controller UI, with no ability to inject custom regex or LUA filtering rules.
SSL Certificates: Automated issuance and renewal of Let's Encrypt SSL certificates, strictly contingent upon the Client correctly routing DNS records (A/AAAA) to the server IP and avoiding obstruction of the validation endpoint (/.well-known/acme-challenge/) via custom redirect/rewrite rules. Third-party commercial SSL certificates are issued and deployed by the Client without complimentary support.
Managed Service Boundaries: Core management covers solely hardware availability, operating system maintenance (Debian OS), network security, and the stability of core daemons and the Controller. It does not include unlimited administrative hours, nor source code debugging, CMS maintenance, third-party frameworks, plugins, or architectural redesign.

4.2. DNS Service Policy: DNS zone management is provided free of charge exclusively for domain names actively registered with the Provider or linked to an active hosting subscription (Shared, Managed VM, Managed Dedicated). In the event of a domain transfer to an external registrar or hosting cancellation/expiration, complimentary DNS zone hosting terminates automatically within ten (10) calendar days, unless the Client subscribes to a Standalone DNS Plan.

Article 5: Professional Services & Scope Creep Protection

5.1. Any technical task, customization, remediation, or consulting service not expressly defined as part of the Core Managed Service constitutes a Billable Professional Service and is delivered exclusively under a separate Statement of Work and fee structure pursuant to DOC-009.

5.2. Purely billable professional services include, without limitation:

Architectural engineering for Clusters, High Availability (HA), and Load Balancing.
Implementation of DNSSEC, Anycast routing, and advanced failover configurations.
Specialized Mail Deliverability advisory, strict DMARC enforcement (quarantine/reject), and BIMI setup.
Performance tuning, database query optimization, Redis/Memcached integration, and Nginx microcaching.
Application source code debugging and custom CMS plugin development (excluding dedicated WP Development agreements).
Malware cleanup, sanitization, and restoration of compromised CMS installations.
Website Migration Policy: Complimentary migrations are strictly limited to a maximum of three (3) websites with an aggregate size not exceeding 5 GB. Any excess in website count or data volume, as well as full server migrations from external providers (imports from ISPConfig 2/3, Plesk, cPanel, Confixx, etc.), are executed exclusively as Billable Professional Services.

Article 6: Technical Constraints, cgroups, Security Tiers & vHost Options Directives

6.1. Access, Resource & Security Constraints: Full root shell access is strictly withheld. Remote file management is restricted to chrooted FTP or jailed sFTP within the designated web root. Compute resource distribution (CPU, RAM, Disk I/O) is enforced at the Linux kernel level via cgroups v2 (as documented in DOC-012). The Client has visibility via the Controller strictly over Storage Quota and Traffic Quota metrics. Infrastructure defense is maintained via a 4-tier security architecture (L1 Datacenter Perimeter, L2 Proxmox Firewall, L3 fail2ban dynamic filtering, L4 host ufw).

6.2. vHost Options Tab & Liability Partitioning:

In Shared Hosting plans, the "Options" tab (Apache Directives, Nginx Directives, PHP Directives) within the Controller is disabled and locked.
In Managed VM and Managed Dedicated Server plans, the "Options" tab is active, granting the Client capability to insert custom web server directives and php.ini snippets.
Sole Client Responsibility: The Client assumes sole legal, technical, and operational responsibility for the syntax, compatibility, and execution of custom directives.
Crash Recovery: In the event of web daemon (Apache/Nginx/PHP-FPM) crash, startup failure, or service disruption resulting from syntactical or logical errors in the Client's custom directives, service remediation is excluded from the Core Managed Service and will be performed by the Provider exclusively as a Billable Professional Service with a minimum charge of one (1) technical support hour.
Indemnification Clause: The Client agrees to fully indemnify, defend, and hold harmless the Provider against any third-party claims, administrative penalties, damages, or operational losses arising from malicious, defective, or unauthorized directives entered into the Options tab.

Article 7: Acceptable Use Policy, Suspension Types & NIS2 Incident Handling

7.1. The Client shall strictly adhere to the provisions of DOC-003 (AUP).

7.2. Security Abuse Quarantine Protocol: The Provider reserves the absolute right to place into immediate quarantine (Quarantine / Null-route / Suspension), without prior notice and without liability for compensation, any account, website, virtual machine, or dedicated server exhibiting:

Outbound malicious activity (Outbound Abuse, DDoS attacks, port scanning, brute-force exploits).
Mass outbound spam or email bursts jeopardizing server IP reputation.
Phishing site hosting, malware payloads, or Command & Control (C2) operations.
Execution of cryptocurrency mining binaries or scripts (Crypto Mining).
Sustained resource exhaustion violating Noisy Neighbor thresholds.

7.3. Security Incident Governance (NIS2 Baseline): The Provider maintains an incident notification protocol pursuant to DOC-012, executing a three-stage reporting lifecycle to competent CSIRT/regulatory authorities and impacted Clients:

a) Early Warning within 24 hours of initial detection,
b) Incident Notification within 72 hours including initial severity assessment, and
c) Final Comprehensive Report within one (1) month following remediation.

7.4. Suspension Type Partitioning (Billing vs Security):

a) Billing Suspension: Triggered automatically by the Client Area due to overdue invoices and lifted automatically upon successful settlement.
b) Security Abuse Quarantine: Enforced at the network, Firewall (L1-L4), or Controller level due to security violations (outbound attacks, spam, malware). Quarantine removal requires manual technical review, threat eradication, and explicit sysadmin authorization; it is entirely decoupled from and cannot be resolved by invoice payment.

Article 8: Domain Name Governance

8.1. Registration, renewal, and transfer of domain names (.gr, .eu, gTLDs, etc.) are executed via accredited registrars (EETT, Openprovider) and governed by DOC-008 and applicable Registry Policies.

8.2. The Provider acts as an intermediary. Successful registration is contingent upon Registry approval.

8.3. The Client is the sole registrant and beneficial owner of the domain name and remains responsible for WHOIS data accuracy. The Provider enables immediate retrieval of the authorization code (Auth-Code) and transfer lock management directly via the Client Area in compliance with EETT and ICANN regulations.

Article 9: Financial Terms, Upgrades & Account Credit Policy

9.1. Financial transactions, billing cycles, and payment schedules are governed comprehensively by DOC-011.

9.2. Setup Fees: All Managed Server offerings (Managed VPS, Managed Dedicated) incur a one-time Setup Fee, which is strictly non-refundable.

9.3. Promotional Offers: Any discount or special pricing applies strictly to the initial billing cycle. If the Client upgrades during a promotional period, prorated difference fees are computed based on regular, non-discounted catalog rates.

9.4. Credit-Only Refund Policy: In B2B transactions, and for services fully rendered or provisioned following explicit consumer consent and statutory waiver of the right of withdrawal (pursuant to Article 3ib of Greek Law 2251/1994), the Provider issues no cash, bank, or card refunds. Any approved rebate, cancellation, or SLA compensation is credited exclusively as Account Credit within the Client Area, redeemable solely against future service purchases or renewals.

9.5. Service Upgrades & Prorated Billing: The Client may upgrade hosting tiers or allocate additional resources at any time via the Client Area. Upgrades are billed on a prorated (pro-rata) basis for the remainder of the current billing cycle. Downgrades take effect at the inception of the subsequent billing cycle with no refund of unearned balances.

Article 10: Backup Governance & Data Recovery

10.1. Backup generation, retention, and disaster recovery terms are established in DOC-010.

10.2. Quota Allocation & Recovery Mechanics: Local backups (files, databases, mail) generated via the Controller consume storage space from the Client's allocated Storage Quota. No automated 1-click restore functionality is supported from the Client Area. Restores are managed within the Controller UI or via specialized technical ticket requests.

10.3. Shared Responsibility & Managed Backups Add-on: The Provider maintains disaster recovery infrastructure snapshots for Shared Hosting. For Managed VPS and Managed Dedicated Servers, external offsite backups (Proxmox VM Snapshots on dedicated offsite storage nodes) are provided exclusively as an optional, paid add-on service (Paid Storage Add-on). The Client retains primary legal and operational responsibility for generating, verifying, and locally downloading independent backups of critical data and applications.

Article 11: Data Protection, Residency, Cookies & Privacy

11.1. GDPR & Automated Data Retention: Personal data processing complies with Regulation (EU) 2016/679 (GDPR), Greek Law 4624/2019, and DOC-005 (Privacy Policy). Personal records are retained for the duration of the active contractual term and subsequently for the statutory period mandated by Hellenic tax authorities (IAPR/AADE). Following expiration of the statutory retention term, the Client Area executes automated data retention routines (Data Retention Automation) to permanently delete or anonymize inactive customer accounts, audit logs, and closed support tickets.

11.2. Data Processing Agreement (DPA): For the processing of third-party data hosted on Provider infrastructure on behalf of the Client (wherein the Client acts as Data Controller and Provider as Data Processor), the provisions of DOC-007 (DPA) apply pursuant to Article 28 of the GDPR.

11.3. Cookie Governance & GTM (ePrivacy Compliance): The Provider website utilizes Google Tag Manager (GTM) deployed strictly with Consent Mode v2 under an enforced Prior Consent (Opt-in) mechanism. No non-essential tracking cookies or tags are executed prior to affirmative user consent. Visitors maintain the unconditional right to modify or revoke consent at any time via the accessible Cookie Settings Panel / Floating Widget present across the website, pursuant to DOC-006.

11.4. EU Data Residency: All compute infrastructure, primary storage arrays, operational processing systems, and offsite Disaster Recovery storage nodes are hosted strictly within certified Datacenters located inside the European Union (EU/EEA), ensuring rigorous compliance with European data sovereignty standards without third-country data transfers.

Article 12: Service Level Agreement (SLA) & Limitation of Liability

12.1. Infrastructure availability benchmarks and support response times are governed strictly by DOC-004 (SLA).

12.2. The Provider assumes no liability for service interruptions or data corruption resulting from:

Force Majeure events, natural disasters, armed conflicts, or upstream tier-1 telecommunications carrier failures.
Client acts, omissions, defective CMS code, application vulnerabilities, or malformed vHost Options Directives.
DDoS attacks exceeding provisioned network mitigation capacities.
Service quarantine or suspension enforced due to AUP violations (DOC-003).

12.3. Consequential Damages Exclusion & Liability Cap: Except in cases of proven intentional misconduct (willful deceit) or gross negligence pursuant to Article 332 of the Greek Civil Code, and to the maximum extent permitted by applicable law, the Provider shall not be liable for any lost profits, loss of revenue, data loss, business interruption, or indirect, consequential, or punitive damages. The Provider's total aggregate contractual liability is strictly capped at the total amount paid by the Client for the specific affected service during the three (3) months immediately preceding the event giving rise to liability.

Article 13: Amendments & Notice

13.1. The Provider reserves the right to amend these Terms and associated policy documents in accordance with the governance framework established in DOC-001/DOC-002.

13.2. Major material amendments shall be communicated to Clients via email or Client Area notification at least thirty (30) days prior to their effective date. If the Client objects to the modified terms, they maintain the right to terminate the agreement without penalty prior to the effective date. Continued service utilization following the 30-day notice period constitutes full and unreserved acceptance of the amended terms.

Article 14: Governing Law, Jurisdiction & Language Supremacy

14.1. These Terms and all related contractual relationships shall be governed by and construed exclusively in accordance with the laws of Greece and applicable European Union law.

14.2. Any dispute, claim, or controversy arising out of or in connection with these Terms shall be subject to the exclusive jurisdiction of the competent Courts of Pyrgos Ilias, Greece.

14.3. Language Supremacy Clause: The Greek language version of this document constitutes the sole original, official, and legally binding master text (Master Version). Any English translation (or translation into other languages) is provided strictly for administrative convenience. In the event of any discrepancy, contradiction, ambiguity, or interpretive conflict between the Greek text and any translation, the Greek version shall prevail unconditionally.