GDPR Data Map for Hosting Resellers: Where Personal Data Lives

You sell hosting, domains, and VPS. Your customers trust you with their personal data. When a customer asks for a copy of everything you hold on them, or asks you to delete it, you need to know exactly where that data lives and how to get it out. This guide maps the personal data in a typical reseller stack and shows you how to build a one-click export for subject access requests (SARs) and data portability.

What personal data do you actually hold as a hosting reseller?

As a reseller, you hold personal data in three main systems: your billing platform, your control panel, and your provisioning layer. Each stores different types of data, and you need to know what is where before you can respond to a GDPR request.

Billing system (e.g., WHMCS, Clientexec, Upmind, WISECP, FOSSBilling, BillingServ)

• Account data: name, email address, postal address, phone number, company name, VAT number.
• Authentication data: hashed passwords, security question answers, two-factor authentication secrets, login history (IP addresses, timestamps).
• Billing data: invoices, payment transactions, credit card tokens (if you store them), PayPal or Stripe customer IDs, tax records.
• Support data: tickets, live chat transcripts, email correspondence.
• Marketing data: newsletter subscriptions, consent records, opt-in/opt-out timestamps.

Control panel (e.g., cPanel, Plesk, Virtualmin)

• User accounts: usernames, email addresses, hashed passwords, SSH keys, FTP accounts.
• Usage logs: access logs, error logs, IP addresses, timestamps.
• Email data: email addresses, forwarders, autoresponders, mailbox contents (if you host email).
• File data: customer files, databases, backups (which may contain personal data).

Provisioning and automation (e.g., WHMCS modules, Virtualizor, VirtFusion, Proxmox, custom API)

• Service metadata: service IDs, server assignments, IP addresses, hostnames, resource usage.
• Configuration data: API keys, SSH credentials, template settings.
• Audit logs: provisioning actions, who did what and when.

Additionally, your domain reseller API may hold registrant data (name, address, email, phone) for each domain. If you use a hosting automation platform like Teculiar, which provides a unified storefront, billing, and provisioning layer, you may have all this data in one place, which simplifies mapping.

How do you build a GDPR data map for your hosting business?

A data map is a simple inventory: for each system, list what personal data you store, why you store it, where it came from, who you share it with, and how long you keep it. Start with a spreadsheet and involve your team.

Step 1: List all systems that touch personal data

Include your billing platform, control panels, provisioning tools, support desk, email marketing tool, analytics, and any third-party services (payment gateways, domain registrars, fraud checks). Do not forget spreadsheets and local files.

Step 2: For each system, document data categories

Use the categories above as a starting point. Note the lawful basis for processing (contract, consent, legal obligation) and retention period. For example, invoices are kept for tax purposes (legal obligation), while marketing consent is kept until withdrawn.

Step 3: Identify data flows

Map how data moves between systems. When a customer signs up, their data flows from your order form to billing, then to provisioning, then to the control panel. When they pay, data goes to your payment gateway. When you send a newsletter, data goes to your email tool. Document these flows to understand where data is stored and who can access it.

Step 4: Assign responsibility

Decide who is responsible for each system and each data category. This person will handle requests and ensure compliance.

How do you handle a subject access request (SAR) and portability request?

A SAR requires you to provide a copy of all personal data you hold on an individual, plus information about how you use it. Portability requires you to provide that data in a structured, commonly used, machine-readable format (e.g., JSON, CSV) and, where feasible, transmit it directly to another controller.

Manual process vs. automated export

Manually gathering data from each system is error-prone and slow. You might miss data in logs, backups, or support tickets. Automating the export reduces risk and saves time.

Building a one-click export

Your goal: a button in your admin area that, when clicked for a given customer, compiles all personal data into a ZIP file containing JSON and CSV files, plus a README explaining the contents.

• Billing system: Use its API to fetch customer profile, invoices, transactions, tickets, and consent records.
• Control panel: Use its API to fetch user accounts, email addresses, FTP accounts, and access logs (filtered by customer).
• Provisioning layer: Use its API to fetch service metadata and audit logs related to the customer.
• Domain registrar: Use the domain reseller API to fetch registrant data for domains owned by the customer.
• Support desk: Export tickets and replies.
• Marketing tool: Export subscription status and consent history.

If you use a platform like Teculiar, you can build this export using its public API. The platform's unified data model means you can query all customer data from one place, rather than integrating multiple systems.

Format and delivery

Provide the export as a ZIP file containing:

• customer_profile.json – name, contact details, account settings.
• invoices.csv – all invoices with line items.
• transactions.csv – payment history.
• tickets.json – support tickets and replies.
• services.json – services, IPs, hostnames.
• domains.json – domain registrant data.
• consent_log.csv – marketing consent history.
• README.txt – explanation of each file and data categories.

Deliver the ZIP via a secure download link that expires after a short time, or upload it to the customer's client area.

What about deletion and rectification requests?

Your data map also helps with erasure and rectification. When a customer asks you to delete their data, you know which systems to purge. Remember that some data must be retained for legal reasons (e.g., invoices). Document your retention policy and inform the customer.

What to do next

• Start your data map today: create a spreadsheet and list all systems and data categories.
• Check if your billing and control panels have APIs that allow you to automate data export.
• If you use a unified platform like Teculiar, explore its API documentation to build a one-click export. See our pricing page for details.
• Test your export process with a dummy customer to ensure it captures all data.

Ready to simplify GDPR compliance? Contact us to learn how Teculiar can help you manage customer data responsibly.