Terms and Conditions

The German text is the binding one. This translation is provided for convenience only.

These terms govern all contracts between GoodFlare IT, proprietor Arne Heidrich, Huthain 1, 09437 Börnichen, Germany ("the provider") and its customers for hosting (game servers, VPS and containers, web hosting), domains and DNS management, IT services and related work.

Sections 8 to 13 add special provisions for web hosting, domains and DNS management. The Acceptable Use Policy (goodflare.io/acceptable-use) is part of every contract. Where the customer processes personal data on the services, the Data Processing Agreement (goodflare.io/dpa, § 15) applies as well.

Deviating terms proposed by the customer do not become part of the contract unless the provider agrees to them expressly and in text form.

The presentation of services in the shop is an invitation to order, not a binding offer.

Submitting an order places a binding offer. Receipt is confirmed by email; that confirmation is not yet an acceptance. The contract is formed when the provider accepts the order or provides the service. For domains, whether the domain can be registered is decided by the registry (§ 9).

Ordering takes these steps: the customer puts the service together in the configurator and adds it to the basket, signs in to the customer area or creates an account, enters the billing address on the payment page (if it is still missing), chooses how the contract renews (automatically or paid in advance) and the payment method, ticks the box for these terms and the start of the service, and clicks “Order and pay”.

Until that click every entry can be checked and corrected: the basket shows each item with its price and term; an item can be removed and put together again in the configurator. The payment page lists all items and the total once more; the billing address can be corrected there with “Change”, and “Basket” leads back to the basket.

The provider stores the contract text: the order with its items and prices, the declarations made when ordering with date and time (acceptance of these terms, the request to start the service), and the version of these terms and of the withdrawal policy in force at the time of the order. The customer can view the order and the invoices in the customer area at any time. With the order confirmation by e-mail the customer also receives these terms and the withdrawal policy with the model withdrawal form in that version as PDF files.

The contract languages are German and English. The English version of these terms is a translation; the German version is the binding one. [For a lawyer to confirm: whether the German version can be the binding one for consumers who order in English.] The provider has not subscribed to any code of conduct.

What is owed follows from the service description shown during ordering: for game servers the game and the plan’s resources, for VPS and containers the server’s specification, for web hosting the plan and § 8, for domains the chosen domain with §§ 9 to 11, for DNS management § 12.

Services the website describes as “planned” or “in the works” are owed only once they can be and have been ordered.

The provider may use subcontractors, data-centre operators and domain registrars; responsibility towards the customer is unaffected.

The provider strives for uninterrupted operation. A specific availability is only guaranteed where expressly agreed. Planned maintenance is announced in advance in the customer area or by e-mail where possible.

The prices shown at the time of ordering apply. For domains, § 10 applies in addition.

Under § 19 UStG (small-business rule) no VAT is charged and none is shown.

Billing is in advance for the chosen term; payment is due on invoice.

When the contract renews, the provider invoices the new term at its start, at the price the service was ordered at or, if the customer has since changed the plan or the add-ons, at the price shown for the following terms at the last change. If the customer saved a payment method for future payments at ordering or in the customer area, the amount is charged to it; the method can be changed or removed in the customer area at any time.

If the customer moves to a more expensive plan or books an add-on in the customer area during a term, the provider invoices the difference pro rata for the remaining days of the current term; the change applies once that amount is paid. Amounts below €0.50 are not invoiced at once but added to later changes in the same term. A move to a cheaper plan applies from the next renewal; nothing is refunded for the current term. Before every change the customer area shows the pro rata amount and the price from the next renewal.

[For a lawyer to confirm: pro rata billing of plan changes and add-ons, adding up small amounts, and the new price applying from the next renewal (§§ 307, 309 no. 1 BGB).]

Where a contract includes a one-time setup at a separate price (for example in an individual offer), the setup is a service of its own beside the ongoing provision. It is performed in full at the start of performance, namely when the set-up server is provided, and is invoiced at its separate price together with the first term. If a consumer withdraws from the contract after the setup was performed in full at their express request before the withdrawal period ended, the compensation for value includes the full price of the setup; all other services are charged pro rata for the time (§ 357a(2) BGB). If the setup has not been performed in full when the consumer withdraws, its price is refunded in full as well.

[For a lawyer to confirm: keeping the full setup price after a withdrawal (CJEU, judgment of 8 October 2020, C-641/19, para. 29) and whether its amount is proportionate (§ 357a(2) sentence 3 BGB).]

If an invoice cannot be collected, the provider informs the customer by e-mail and announces that the service will be paused after three days if the invoice is still open. Stored data is kept; after payment the service is released again at once. A domain is not deleted for this; § 11 applies to it.

Credentials must be kept confidential. Suspected misuse must be reported without delay.

Use is governed by the Acceptable Use Policy. In particular, unlawful content, interference with third-party systems, unsolicited bulk mail, and any use that degrades the infrastructure or other customers are prohibited.

The customer is responsible for the content and software they store and run on the systems, including content of their own users, players and sub-users.

The customer keeps their contact details in the customer area up to date, so that notices about the contract, security and domains arrive.

The contract runs for the term chosen at ordering (one, three or twelve months). It can be terminated at any time up to the last day of the current term and then ends when that term ends. If it is not terminated, it renews for the same period for business customers.

For consumers the following applies instead: after the first term, the contract continues for an indefinite period, whether a term of one, three or twelve months was chosen. It can then be terminated at any time with one month’s notice; if the current billing period, already paid for, ends sooner, the contract ends with it. Billing continues in advance for the chosen billing period (§ 4). Time already paid for after the end of the contract is refunded pro rata, the way it was paid (to the means of payment or as balance).

[For a lawyer to confirm: whether, after the first term, billing may continue in advance in periods of three or twelve months when the contract can be terminated at any time with one month’s notice and a pro rata refund (§ 309 no. 9 BGB).]

Add-ons can be cancelled one by one in the customer area, with the same notice as the contract they belong to: to the end of the current term, or for consumers after the first term with one month’s notice. Nothing is refunded for the time up to the end; time already paid for after the end is refunded pro rata. Until the end the cancellation can be withdrawn. The contract itself continues.

[For a lawyer to confirm: cancelling single add-ons and their notice period towards consumers (§ 309 no. 9 BGB).]

Contracts can be terminated in the customer area on the server itself and, without signing in, through the “Cancel contracts here” button linked at the bottom of every page (§ 312k BGB). The customer receives a confirmation of receipt by e-mail at once.

Either party may terminate for cause.

When the contract ends the service is paused; 30 days later the server and its data, including the backups stored by the provider, are deleted. Until then the termination can be withdrawn in the customer area, and the data can be downloaded under § 6a.

For domains, §§ 10 and 11 apply.

The customer can export their data at any time, including to switch to another provider or to their own systems. For this the following are available: for game servers “Export everything” on the server’s page (the server directory as a .tar.gz file, each database as a .sql file and the server’s setup as goodflare-export.json with an explanation), as well as SFTP, the file manager and downloading backups; for VPS and containers full access to the system (for example over SSH or SFTP), with which all data can be transferred; for web hosting SFTP, the file manager and downloading the databases. The data is provided in common, machine-readable formats: files as they are stored, databases as SQL, the setup as JSON.

Data that cannot be downloaded this way by the customer is provided by the provider as an export on request, and on request the provider supports the switch with information on formats and setup.

After the end of the contract the provider keeps the data available for retrieval for 30 days (§ 6): for game servers through the export on the ended server’s page, for VPS, containers and websites on request. After that it is deleted completely, including the backups stored by the provider.

The provider charges nothing for the export and the switch. The notice periods of § 6 are unaffected.

[For a lawyer to confirm: which services fall under the switching rules of the EU Data Act (Regulation (EU) 2023/2854, Art. 23 to 31), which of its information (Art. 25, 26) must be in these terms, and whether the notice period on a switching request may be at most two months.]

Where the plan includes backups (game servers, web hosting), the customer can create and restore them in the panel, manually and on a schedule. These backups are currently stored on the same server node as the service. They help with operating mistakes and failed updates but do not protect against a failure or loss of that node or the site. For VPS and containers the provider currently makes no backups.

The provider takes reasonable care that backups are made as configured. It does not warrant that every backup is complete and restorable.

The customer is responsible for regularly keeping their own copies of important data outside the provider’s systems, for example by downloading the backups. This applies until the provider offers copies at a second location and these are part of the contract.

If data is lost, the provider is liable within § 16 only for the effort that restoring it from such an own copy would have required. This does not apply to intent or gross negligence, to injury to life, body or health, or where the provider expressly took over the backup. [For a lawyer to confirm: whether this limit holds towards consumers (§ 307 BGB) while backups stay on the same node.]

For web hosting the provider gives each website its own runtime environment, separated from other websites, with the plan’s resources. The customer chooses the web server and PHP version in the panel from the variants offered. Which further features are included (such as databases, staging, SSH access) follows from the plan’s description.

A website can use the customer’s own domain or a free preview address of the provider. The preview address is tied to the contract and ends with it; there is no claim to a particular preview address.

The provider sets up TLS certificates for connected domains automatically once the domain points to the website. The customer is responsible for correct DNS records unless they are managed through the provider.

The provider offers no mailboxes and no e-mail sending. Websites send e-mail through an external provider of the customer’s choice. Outgoing connections on port 25 may be blocked.

The customer is responsible for content and software, in particular for updating applications, plugins and themes. If the provider offers automatic updates (for example for the WordPress core) and the customer switches them off, the customer bears the risk of outdated software.

The provider processes the website’s access logs on the customer’s behalf (§ 15). Raw logs are kept for seven days and then deleted.

If there are signs that a website is compromised (for example malicious code or a phishing page), the provider may temporarily block the website (§ 14). Files and databases stay as they are; the customer can keep working on the website in the customer area and clean it up. Once the reason is resolved, or if it turns out to be a false alarm, the provider lifts the block without delay.

The provider offers domains once they can be ordered in the shop. It registers and manages them through a registrar, currently INWX GmbH, Berlin, with the responsible registry, for example DENIC eG for .de.

The contract for the domain itself is between the customer as registrant and the registry, for generic domains (such as .com, .net, .org) also with the registrar. The provider applies for the registration in the customer’s name and on the customer’s behalf. It never becomes the holder of a customer’s domain itself. Towards the customer it owes applying for, managing and renewing the domain under these terms.

Each domain is also subject to the terms of the registry and the registrar, shown before ordering and accepted by the customer, such as DENIC’s domain terms and guidelines for .de, EURid’s rules for .eu and, for generic domains, ICANN’s requirements. The provider is not accredited by ICANN. ICANN explains registrants’ rights and responsibilities at icann.org/resources/pages/benefits-2013-09-16-en.

Domains are allocated first come, first served. Until the registry confirms the registration, the provider cannot promise that the domain will be registered; “available” in the shop is a snapshot. If the domain cannot be registered, the provider refunds any amount paid in full.

The customer warrants that, to their knowledge, the domain does not infringe third-party rights (such as trade mark or name rights) and will not be used for unlawful purposes.

Registrant data must be complete and correct and be updated in the customer area within seven days of any change. For generic domains, wilfully false data or failing to answer the registrar’s enquiries within fifteen days can lead to suspension or deletion. If a registry asks for proof of the registrant data (for example DENIC under § 49 BSIG), the provider forwards the request at once; the customer must answer within the registry’s deadline, otherwise the domain may be taken out of the zone and later deleted.

In disputes over a domain (such as a DENIC dispute entry or a UDRP proceeding for generic domains) the provider carries out the decisions of the registry, the registrar or the dispute resolution provider. During proceedings, changes to and transfers of the domain may be locked.

Domains are billed yearly in advance. The price for registration and for every renewal is shown in the shop before ordering, as is the price for restoring a deleted domain where the registry allows it.

The first term is twelve months from registration. Before every expiry the provider sends reminders by e-mail, about one month and one week before, and for generic domains also within five days after expiry.

For businesses the contract renews for twelve months each time unless terminated no later than [fourteen] days before the end of the term. The provider may adjust the price for future renewals if the registry or the registrar change their prices; it gives notice of the new price in text form at least six weeks before the renewal, and the business may terminate until the renewal.

[Owner’s decision: one of the two following variants applies to consumers. Both comply with § 309 no. 9 BGB. The variant not chosen is deleted before launch.]

[Variant A · indefinite after the first term] After the first term the contract continues for an indefinite period and can then be terminated at any time with one month’s notice. The provider renews the domain at the registry for one year at a time and invoices that year in advance. If the contract ends before the paid year is over, the provider refunds the pro rata price for paid time after the end of the contract. [For a lawyer to confirm: price adjustments at renewal towards consumers (§ 307 BGB); without a valid clause the agreed price stays.]

[Variant B · no automatic renewal] The contract ends when the term expires, without notice of termination. If the customer renews the domain in the customer area before expiry, a new twelve-month contract is formed at the price then shown. Without renewal the domain is deleted after expiry (§ 11). [For a lawyer to confirm: whether an automatic renewal that the customer switches on per domain may be offered in addition.]

Contracts can be terminated in the customer area on the domain itself and, without signing in, through “Cancel contracts here” (§ 312k BGB).

The customer can transfer a domain to another provider at any time. The provider hands out the code needed for this (AuthInfo, the transfer code for .eu) on request in the customer area without undue delay, at the latest within five days. It does not make this depend on payment of open invoices; its claims remain unaffected.

For .de domains the customer can instead request an AuthInfo2 code from DENIC, which DENIC sends by post to the registrant’s address.

For generic domains a transfer may be locked for 60 days after registration, after a transfer or after a change of registrant. The provider has no influence on this.

A change of registrant is possible where the registry allows it; any price for it is shown in the shop.

If the contract ends without the domain having been transferred, the provider deletes the domain at the registry when the contract ends. Depending on the registry, the last registrant can still have it restored for a while, for .de within 30 days, at the price shown in the shop. After that anyone can register it.

If the provider terminates the contract, for example for non-payment, it does not delete .de domains but hands them to DENIC’s TRANSIT procedure. The domain then initially remains and must be continued with DENIC or a new provider; DENIC informs the registrant. Before such a termination the provider points this out to the customer in text form.

In the customer area the customer can manage DNS records of their own domains. If the domain is on Cloudflare, the provider writes the records with an access token that the customer creates in their own Cloudflare account and saves in the customer area. The token is stored encrypted and can be removed at any time. For other DNS providers, the provider shows the records to copy and checks whether they are publicly visible.

The DNS zone stays with the customer’s DNS provider, whose terms apply. The provider is not responsible for that provider’s availability or for changes made there outside the customer area.

The customer is responsible for the correctness of the records, also where they were created with one of the provider’s templates (for example for an e-mail service or a game server). Templates reflect what the respective service published when the template was made.

Consumers have the statutory right of withdrawal for domain contracts too (see goodflare.io/withdrawal-policy). Registering a domain is a service; the exception for goods made to the customer’s specifications (§ 312g (2) no. 1 BGB) does not apply.

By ordering, the customer expressly requests that the provider begin the service before the withdrawal period ends; an order is not possible without this declaration. The provider therefore applies for the domain as soon as the contract is concluded.

At the same time the customer confirms knowing that the right of withdrawal expires once the provider has fully performed the contract; it expires once the provider has fully performed (§ 356 (5) no. 2 BGB). Both statements are part of the wording of the confirmation asked for before payment, without a pre-ticked box, and are stored with the order.

Until then withdrawal remains possible. A domain contract is not fully performed by the registration alone, because it also covers holding and managing the domain for the term. If the customer withdraws after the requested start, they owe compensation for the service provided up to the withdrawal, based on the agreed total price (§ 357a (2) BGB). [For a lawyer to confirm: how the registration, which cannot be undone, is valued in that compensation.]

After a withdrawal the domain stays registered if the customer wishes and can be transferred to another provider (§ 11); otherwise it is deleted.

If the customer violates the law, third-party rights or the Acceptable Use Policy, the provider may act under that policy: a notice with a deadline, blocking individual content, pausing the affected service and, for serious or repeated violations, termination for cause. It chooses the mildest measure that works and acts without prior notice only where serious harm would otherwise occur.

If the provider restricts a service or content, the customer receives a statement of reasons under Art. 17 of Regulation (EU) 2022/2065 (Digital Services Act, DSA), including the ways to challenge it. Third-party notices of illegal content are handled under Art. 16 DSA (goodflare.io/report-content).

Payment remains due for the duration of a justified suspension. If a suspension was unjustified, the provider credits the time.

How the provider processes the customer’s personal data is described in the privacy policy.

Where the customer processes personal data on the services as a controller (for example data of players or website visitors), the provider processes it on the customer’s behalf under the Data Processing Agreement (Art. 28 GDPR, goodflare.io/dpa).

The provider is liable without limitation for intent and gross negligence, and for injury to life, body or health.

For ordinary negligence the provider is liable only for breach of an essential contractual duty, and then limited to the foreseeable damage typical for this kind of contract.

For data loss, § 7 applies in addition. The provider is not liable for decisions of registries or for third-party services the customer commissions themselves (such as their own Cloudflare account); its liability for its own fault in applying for, managing and renewing remains.

Liability under the Product Liability Act is unaffected.

Changes are notified in text form at least six weeks before they take effect. If the customer does not object before they take effect, the changes are deemed accepted; the notice will say so explicitly. On objection, the customer may terminate as of the date the changes take effect.

Changes that substantially affect the main services or the balance between service and price take effect only with the customer’s express consent.

German law applies, excluding the UN Convention on Contracts for the International Sale of Goods. For consumers this choice applies only where it does not remove the protection of mandatory rules of their country of habitual residence.

Where the customer is a merchant or a legal entity under public law, the place of jurisdiction is the provider’s place of business.

We are neither willing nor obliged to participate in dispute resolution proceedings before a consumer arbitration board.

Should any provision be invalid, the remaining provisions stay in force.