KYC Customer Verification Policy

KYC Customer Verification Policy for "WIN-VPS.COM"
dated March 07, 2019

Last updated on December 01, 2025

This KYC Customer Verification Policy (the "KYC Policy") is an annex to, and forms an integral part of, the Paid Services Agreement (the "Agreement") concluded between VMachines & Servers OÜ (the "Contractor" or "Operator") and the Customer. VMachines & Servers OÜ acts as the Contractor under the Agreement and as the Operator of the "WIN-VPS.COM" website (the "Website").

This KYC Policy sets out the conditions and procedures for identity verification of Customers in connection with the Services provided by the Contractor through the Website. It applies to all Customers, including Consumers and Business Customers within the meaning of the Agreement.

For Customers who qualify as Consumers under applicable law, this KYC Policy is subject to mandatory consumer protection provisions of the European Union and Estonia, including the Consumer Rights Directive 2011/83/EU and the Unfair Contract Terms Directive 93/13/EEC. Nothing in this KYC Policy shall be construed as limiting or excluding any mandatory statutory rights of Consumers.

Capitalised terms used in this KYC Policy have the meanings given to them in the Agreement and the Terms and Conditions, unless otherwise defined herein.

For information on how the Contractor processes personal data collected during KYC verification, please refer to the Privacy Policy.

1. General Principles

   1. The Contractor applies Know Your Customer (KYC) verification procedures to maintain a secure and lawful hosting environment and to protect its business, infrastructure and other Customers against fraud and abuse. In most cases, the Contractor uses automated systems and trusted third-party verification providers to verify the Customer's details quickly and efficiently.

   2. KYC verification is carried out on a risk-based approach. Not all Customers will be required to undergo manual verification; the level and intensity of verification depend on factors such as the nature of the Services ordered, the payment method used, the Customer's jurisdiction and the results of automated risk assessment.

2. Purposes of KYC Verification

   The Contractor carries out KYC verification for the following purposes:

   • to comply with applicable tax, accounting and other regulatory requirements of Estonia and the European Union, and, where and to the extent applicable, other countries;

   • to prevent and detect fraud, including payment fraud, identity theft and chargeback abuse, in accordance with the Contractor's legitimate interest in protecting its business, infrastructure and other Customers;

   • to fulfil the requirements of payment service providers, financial institutions and other service providers with whom the Contractor maintains business relationships;

   • to prevent the use of the Services for illegal activities, including but not limited to cybercrime, hacking, carding, phishing, spam and other abusive or harmful activities;

   • to prevent the dissemination of terrorist content and to comply with Regulation (EU) 2021/784 on addressing the dissemination of terrorist content online and other applicable rules on illegal content;

   • to protect the Contractor's infrastructure and other Customers from security threats, abusive activities and unfair use of shared resources;

   • to maintain the reputation and technical deliverability of the Contractor's IP address ranges, including by reducing the risk of blacklisting due to abusive or criminal activity;

   • to enable the Contractor's Customers to restore lost passwords and access to the Services where this cannot be done safely without prior verification of the Customer's identity; and

   • to enforce the Agreement, the Terms and Conditions, this KYC Policy and other applicable policies of the Contractor, and to protect the Contractor's legitimate interests in maintaining a reliable and secure hosting environment.

3. Customer Obligations

   1. The Customer shall provide accurate, complete and up-to-date information when registering an account and placing an Order, in accordance with Clause 4.2 of the Agreement.

   2. The Customer shall ensure that the email address provided is active and regularly monitored, as this is one of the primary channels for KYC-related communications in addition to the Client Area.

   3. The Customer shall notify the Contractor without undue delay of any changes to registration or billing information, in accordance with Clause 4.2(g) of the Agreement.

4. Verification Procedure

   1. Automatic verification. Upon registration or placing an Order, the Customer's details may be verified automatically using third-party verification services and the Contractor's internal systems. If automatic verification is successful, no further action is normally required from the Customer.

   2. Manual verification. If automatic verification is not successful or if the Contractor's risk assessment indicates a need for additional verification, the Contractor will contact the Customer via the Ticket System in the Client Area and may also send notifications to the Customer's registered email address and/or phone number.

   3. Information that may be requested. During manual verification, the Customer may be asked to provide some or all of the following information and documents, depending on the circumstances:

      • full name (for individuals) or registered business name and registration details (for legal entities);

      • billing address and, where applicable, business registration or VAT details;

      • proof of identity (such as a copy or photograph of a government-issued identification document, with non-essential numbers or codes redacted where reasonably possible);

      • proof of address (such as a utility bill or bank statement dated within the last three (3) months);

      • information and/or documents to verify that the Customer or its representative is authorised to use the selected payment method or account; and

      • for legal entities: documents confirming the authority of the person placing the Order to act on behalf of the entity.

   4. The Contractor will only request information and documents that are reasonably necessary for the purposes described in Section 2 of this KYC Policy. The Contractor will allow sensitive numbers (such as full document or card numbers) to be redacted where reasonably possible and will not request more data than is necessary for the relevant verification.

   5. Identity verification photographs. Where the Contractor requests photographs for identity verification purposes, the Customer may be asked to provide:

      • a photograph of the Customer holding a handwritten statement confirming the Customer's identity, agreement with the terms of the Agreement and the relevant Order or invoice number, together with the Customer's identification document placed on the same sheet of paper; and/or

      • photographs taken at different angles to enable verification.

      1. The Customer may redact non-essential numbers and codes on the identification document (such as the document number) while ensuring that the Customer's name and photograph on the document remain visible.

      2. Such photographs are used solely for the purpose of manual visual comparison by the Contractor's staff to verify that the Customer matches the identification document provided. The Contractor does not use automated facial recognition technology or create biometric templates from such photographs.

      3. If the Contractor has reasonable grounds to request additional verification after reviewing the initial photographs, the Contractor may request a separate copy or scan of the Customer's identification document. Such requests are made only where necessary and are subject to the data minimisation principle.

      4. The processing of verification photographs and documents is carried out on the legal bases set out in Section 8 of this KYC Policy and in accordance with the Privacy Policy.

   6. Timeframes for response. Upon determining that manual verification is required, the Contractor will normally send a verification request to the Customer within three (3) hours during Working hours (as defined in the Agreement). The Customer shall provide the requested information or documents within forty-eight (48) hours of the Contractor's request, or within such longer period as the Contractor may reasonably allow in the circumstances.

      1. For Customers who qualify as Consumers, the Contractor shall take into account any objective circumstances that may prevent the Consumer from responding within the standard timeframe and shall grant a reasonable extension upon the Consumer's justified request.

   7. Financial data. The Contractor does not request photographs, copies or scans of payment cards, bank account details (other than for refund purposes where necessary) or other sensitive financial instruments as part of the KYC verification procedure. Customers should not send such documents to the Contractor unless specifically requested for a legitimate purpose (such as processing a refund to a bank account).

5. Re-verification of Existing Customers

   1. The Contractor may request re-verification of an existing Customer's identity or account details where:

      • there are indications that the Customer's information is materially inaccurate, incomplete or outdated (for example, returned mail, undeliverable emails, or changes in payment patterns);

      • the Contractor's risk assessment indicates an increased risk of fraud, abuse or other violation of the Agreement, the Terms and Conditions or this KYC Policy;

      • such re-verification is required by applicable law, a competent authority, or a payment service provider or financial institution; or

      • the Customer requests certain changes to their account (for example, change of legal entity, transfer of account, or change of country of residence or establishment).

   2. In such cases, the Contractor will provide the Customer with reasonable notice and an opportunity to provide the required information. The notice period shall be not less than seven (7) calendar days, unless immediate action is required to prevent fraud or abuse, to protect the security of the Services, or to comply with a binding order from a competent authority.

6. Consequences of Non-Compliance

   1. If the Customer fails to provide the requested verification information within the applicable timeframe, or if the verification is unsuccessful, the Contractor may, depending on the circumstances and in accordance with the Agreement and the Terms and Conditions:

      • withhold access credentials for newly ordered Services until verification is completed;

      • suspend the provision of one or more active Services;

      • restrict certain functionalities of the Services (for example, outgoing email, new Orders, or changes to contact details); and/or

      • terminate the affected Services and/or the Agreement.

   2. Where the Contractor intends to suspend or terminate Services due to non-compliance with verification requirements, the Contractor shall notify the Customer via the Client Area and, where reasonably practicable, by email, stating the reason and the steps the Customer may take to resolve the issue.

   3. For Customers who qualify as Consumers, the Contractor shall provide a reasonable opportunity to complete verification before termination takes effect, which shall be not less than seven (7) calendar days from the notification of intended termination, unless immediate action is required to prevent fraud or abuse, to protect the security of the Services, or to comply with applicable law or a binding order from a competent authority.

   4. Nothing in this KYC Policy limits the Customer's rights under the Refund Policy, including the statutory right of withdrawal for Consumers. However, the Contractor may, in accordance with the Refund Policy, withhold executing a refund until it has reasonably verified the identity of the recipient of the refund and their entitlement to receive such refund. For Customers who qualify as Consumers, the Contractor will not refuse a refund solely because the Consumer has not completed verification if the Consumer has not been given at least fourteen (14) calendar days to complete such verification, as set out in Clause 10.2(c) of the Refund Policy.

7. Automatic Activation of Services

   1. The Contractor may activate a Service for a new Customer automatically upon confirmation of payment, but may withhold or limit access credentials until the Customer has completed any required verification procedures in accordance with this KYC Policy.

   2. For the purposes of the statutory right of withdrawal and the calculation of any refunds under applicable consumer protection law, the Services shall be deemed to have commenced only upon the provision of access credentials to the Customer, unless the Customer has accessed and used the Services prior to receiving such credentials through other means.

   3. Any credits or adjustments in connection with delayed access due to KYC verification shall be determined in accordance with the Agreement, the Terms and Conditions, the Refund Policy and applicable mandatory law.

8. Legal Basis for Processing

   1. The processing of personal data for KYC verification purposes is carried out on the following legal bases under the GDPR:

      • Article 6(1)(b) (contract performance): processing is necessary to take steps at the request of the Customer prior to entering into the Agreement and to perform the Agreement with the Customer, including verifying identity where reasonably required to provide the Services safely;

      • Article 6(1)(c) (legal obligation): where verification is required to comply with tax, accounting or other legal requirements applicable to the Contractor; and

      • Article 6(1)(f) (legitimate interests): the Contractor has a legitimate interest in preventing fraud and abuse, protecting the security and integrity of its infrastructure and the Services, and complying with the reasonable requirements of payment service providers, financial institutions and other partners.

   2. The Contractor does not use automated facial recognition technology or other biometric processing for KYC verification. Photographs provided by Customers are reviewed manually by the Contractor's staff and are not processed through technical means that would qualify them as biometric data within the meaning of Article 9 GDPR.

   3. The Contractor does not rely on the Customer's consent as the legal basis for mandatory KYC verification required for the use of the Services.

   4. For further information on the processing of personal data, retention periods and data subject rights, the Customer should refer to the Privacy Policy.

9. Amendments

   1. The Contractor may amend this KYC Policy from time to time in accordance with Clause 2.11 of the Agreement.

   2. Material changes to this KYC Policy shall be notified to Customers in advance in accordance with Clause 2.11.1 of the Agreement.