← Back to SnapServ

Privacy policy

How SnapServ handles information across this website, the client portal, and our services.

Last updated 2026-10-07

SnapServ Mathis (hereinafter “SnapServ”, “us”, “we”, or “our”) operates the https://snapserv.net website, the client portal, the RPKI portal, and related services (hereinafter referred to as the “Service”). This page informs you of how we collect, use and disclose personal data when you use our Service and the choices you have associated with that data. Unless otherwise defined in this Privacy Policy, the terms used in this Privacy Policy have the same meanings as in our Terms and Conditions.

SnapServ Mathis is the controller responsible for processing your personal data. We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and, where it applies to our processing, the EU General Data Protection Regulation (GDPR). Our contact details are at the end of this policy and in the imprint.

This website and our other services

The public website at snapserv.net is a static information website, currently hosted on Cloudflare Pages. It has no account registration, contact forms, payment collection, or analytics scripts, sets no cookies and loads no third-party resources. Our hosting provider processes connection information, including IP addresses, only to deliver and protect the website. See Cloudflare’s privacy policy.

If you choose an appearance setting, your browser stores only that preference locally under snapserv-theme. You can return to the system setting or clear your browser’s site data.

Ordering, customer accounts, payments, and support tickets are handled separately in the client portal at client.snapserv.net. Identity verification takes place through Stripe, agreements are signed electronically through Skribble, and PA customers manage routing authorisations in our RPKI portal. The provisions below concern those services where applicable; merely reading this static website does not start those processes.

Definitions

  • Personal Data
    Personal Data means data about a living individual who can be identified from those data (or from those and other information either in our possession or likely to come into our possession).
  • Usage Data
    Usage Data is data collected automatically either generated by the use of the Service or from the Service infrastructure itself (for example, connection and security logs).

Information Collection and Use

We collect several different types of information for various purposes to provide our Service to you.

Types of Data

Personal Data

While using our Service, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you (“Personal Data”). Depending on the services you use, Personal Data may include:

  • Email address
  • First name and last name
  • Phone number
  • Address, State, Province, ZIP/Postal code, City
  • Company name and company registration documents
  • Identity verification data, including images of your government-issued photo ID and of your face (see Identity Verification)
  • Billing and payment information, such as invoices, payment method, and transaction details
  • Signed agreements and the related signature data
  • Resource and network information, including RIPE Database objects and the routing authorisations you configure
  • Content of support tickets and other correspondence
  • Cookies and Usage Data

We use your contact details to provide the Service and to send you service-related messages, such as invoices, verification requests, and important notices about your services. We do not send newsletters or marketing emails.

Usage Data

When you use the client portal or the RPKI portal, our systems record information such as your IP address, browser type and version, the time and date of access, sign-in events, and other diagnostic data (“Usage Data”). We use Usage Data to operate the Service, keep it secure, and detect and resolve technical issues.

Tracking & Cookies Data

The public static website does not set cookies. Its appearance preference is stored locally as described above. The client portal and the RPKI portal use cookies or similar browser storage to keep you signed in, remember preferences, and provide security. Stripe, PayPal, and Skribble may also use cookies when you use their services, as described in their privacy policies. We do not use tracking or advertising cookies.

You can configure your browser to refuse cookies. Signing in and some account or payment functionality may then be unavailable.

Use of Data

SnapServ Mathis uses the collected data for the following purposes:

  • To provide and maintain our Service, including processing orders and payments
  • To verify your identity and meet our know-your-customer obligations and the obligations we have as a sponsoring LIR towards RIPE NCC
  • To prepare, sign, and manage the agreements required for our services
  • To submit requests to RIPE NCC and maintain the RIPE Database and RPKI records for your resources
  • To notify you about changes to our Service
  • To provide customer support
  • To detect, prevent and address technical issues, fraud, and abuse
  • To comply with legal obligations, such as accounting and record-keeping requirements

Where the GDPR applies, SnapServ Mathis processes your Personal Data on the following legal bases, depending on the Personal Data and the specific context in which we collect it:

  • Performance of a contract with you, or steps you request before entering into one
  • Compliance with legal obligations, such as accounting and record-keeping requirements
  • Our legitimate interests, such as securing the Service, preventing fraud, meeting our obligations towards RIPE NCC, and enforcing our agreements, where these are not overridden by your rights
  • Your consent, where we ask for it

Under the FADP, we process Personal Data for the purposes described in this policy, on the basis of these same justifications where one is required.

Retention of Data

SnapServ Mathis will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your Personal Data to the extent necessary to comply with our legal obligations (for example, accounting records that Swiss law requires us to keep), meet our obligations towards RIPE NCC, resolve disputes and enforce our legal agreements and policies.

Usage Data is generally retained for a shorter period of time, except when this data is used to strengthen the security of our Service, or we are legally obligated to retain this data for longer periods.

Transfer of Data

We operate from Switzerland. Our client portal is hosted on our own server in the Netherlands, and our RPKI portal is hosted in Germany. Some of our Service Providers, including Cloudflare, Amazon Web Services, Stripe, PayPal and Wise, are based in or may process data in other countries, including the United States, where the data protection laws may differ from those of your jurisdiction.

We transfer Personal Data abroad only where an adequate level of data protection is ensured, for example to countries recognised as adequate by Switzerland or the European Commission, to providers certified under the Swiss-U.S. or EU-U.S. Data Privacy Framework, or on the basis of standard contractual clauses. SnapServ Mathis will take all the steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy.

Disclosure of Data

RIPE NCC and the RIPE Database

To provide sponsored and PA resources, we pass the required information about you or your company to RIPE NCC, the regional internet registry. Some of this information, such as the names and contact details in the network, organisation, person, and role objects in the RIPE Database, is published in the public RIPE Database as required by RIPE policies. RPKI objects, such as route origin authorisations, are published in public RPKI repositories by design. RIPE NCC processes this information under its own privacy statement.

Abuse reports

When you report abuse of resources we manage, we process your contact details and the content of your report to investigate it. We forward the report to the customer responsible for the resources so that they can resolve the issue. If you ask us to, we remove your contact details before forwarding the report, unless the law requires otherwise. Abuse reports about our customers’ resources can contain Personal Data about them, which we use to handle the report and enforce our Terms.

Business transfer

If we transfer our business or our contracts with customers to a successor that continues our services, for example because our business changes its legal form, we transfer the related Personal Data to that successor. We will notify affected customers of such a transfer.

Disclosure for Law Enforcement

Under certain circumstances, SnapServ Mathis may be required to disclose your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

SnapServ Mathis may disclose your Personal Data in the good faith belief that such action is necessary to:

  • To comply with a legal obligation
  • To protect and defend the rights or property of SnapServ Mathis
  • To prevent or investigate possible wrongdoing in connection with the Service
  • To protect the personal safety of users of the Service or the public
  • To protect against legal liability

Security of Data

The security of your data is important to us but remember that no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

Your Data Protection Rights

Under the FADP and, where it applies, the GDPR, you have certain data protection rights. SnapServ Mathis aims to take reasonable steps to allow you to correct, amend, delete or limit the use of your Personal Data. If you wish to be informed about what Personal Data we hold about you and if you want it to be removed from our systems, please contact us. In certain circumstances, you have the following data protection rights:

  • The right to access, update or delete the information we have on you. Whenever made possible, you can access, update or request deletion of your Personal Data directly within your account settings section. If you are unable to perform these actions yourself, please contact us to assist you.
  • The right of rectification. You have the right to have your information rectified if that information is inaccurate or incomplete.
  • The right to object. You have the right to object to our processing of your Personal Data.
  • The right of restriction. You have the right to request that we restrict the processing of your personal information.
  • The right to data portability. You have the right to be provided with a copy of the information we have on you in a structured, machine-readable and commonly used format.
  • The right to withdraw consent. You also have the right to withdraw your consent at any time where SnapServ Mathis relied on your consent to process your personal information.

We may need to keep certain data despite a deletion request where the law or our obligations towards RIPE NCC require it, or while you still have active services with us. Please note that we may ask you to verify your identity before responding to such requests. You have the right to complain to a data protection authority about our collection and use of your Personal Data. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC); in the European Economic Area (EEA), please contact your local data protection authority.

Service Providers

We may employ third party companies and individuals to facilitate our Service (“Service Providers”), provide the Service on our behalf, or perform Service-related services. These third parties have access to your Personal Data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose. Payment providers, Skribble’s trust service providers, and RIPE NCC may also process data as independent controllers under their own privacy policies.

Website hosting

The public static website is currently hosted on Cloudflare Pages and does not load analytics scripts. Cloudflare processes connection information, including IP addresses, to deliver the website and protect it against attacks. If we change our hosting provider, we will update this section.

Client portal

The client portal at client.snapserv.net, used for ordering, customer accounts, billing, and support tickets, runs on a virtual server operated by SnapServ in Amsterdam, the Netherlands, rented from Onidel Cloud. The hosting provider supplies the infrastructure only; we administer the server and the data stored on it.

RPKI portal

PA customers manage route origin authorisations for their subnets in our RPKI portal. It runs on Amazon Web Services (AWS) in the Frankfurt, Germany region, and Amazon Cognito handles sign-in. The portal processes your account email address, sign-in and multi-factor authentication data, IP addresses and security logs, and the routing authorisations you configure. Passwords are managed by Amazon Cognito and are not visible to us. You can learn more in the AWS privacy notice.

Identity Verification

We request you to verify your identity for certain services we offer, such as RIPE resource sponsorship and PA subnets. This is required to comply with legal and/or contractual obligations, including our obligations towards RIPE NCC, and to prevent fraud. We use Stripe Identity for identity verification and other business services. Stripe collects identifying information about you and the devices that connect to its services, which includes the use of cookies. Stripe uses this information to operate and improve the services it provides to us, including for fraud detection, authentication, and analytics. You can learn more about Stripe, Stripe Identity, and read its privacy policy at https://stripe.com/privacy.

How does identity verification work?

SnapServ Mathis works with Stripe to conduct identity verification online. Stripe builds technology that’s used by millions of companies around the world such as Amazon, Google, and Zoom. Stripe helps with everything from accepting payments to managing subscriptions to verifying identities. Stripe helps SnapServ Mathis confirm your identity by conducting the following checks:

  • Stripe captures images of the front and back of your government-issued photo ID and reviews it to make sure that the document is authentic. They’ve built an automated identity verification technology that looks for patterns to help determine if an ID document is real or fake. This process is like a bank teller checking your ID document to confirm that it’s real.
  • Stripe captures photos of your face and reviews them to confirm that the photo ID belongs to you. They’ve built automated identity verification technology that uses distinctive physiological characteristics of your face (known as biometric identifiers) to match the photos of your face with the photo on the ID document. This process is similar to a bank teller confirming that the photo on your ID document is you based on your appearance - but it’s a higher-tech and more accurate way to identify you as a unique person.

Stripe asks for your consent before collecting and using your biometric information. They’ll only use your verification data in accordance with the permissions you grant before starting the verification process, and based on their Privacy Policy. Learn more about how Stripe handles and stores your data.

Is the decision automated?

Stripe checks your ID document and photos automatically. We review every result ourselves and do not refuse a service based solely on an automated result. If a verification does not pass, we check what Stripe flagged and decide on the next steps, which may include contacting you.

Who has access to my verification data?

Both SnapServ Mathis and Stripe have access to the information that you submit through the verification flow. We rely on Stripe to help store your verification data. Stripe uses access controls and security standards that are at least as stringent as those used to handle their own KYC and payments compliance data. Learn more about how Stripe handles and stores your data.

How long is my verification data kept?

We keep your verification data for as long as you have active services with us, and afterwards for as long as we need it to meet our know-your-customer obligations and the documentation requirements of RIPE NCC for the resources we sponsor or provide. Stripe stores this data on our behalf.

How can I access or delete my verification data?

You can ask us for access to your verification data at any time. If you request deletion and no longer have any active services with us, we request Stripe to redact your verification data, unless we are legally required to keep it. Redaction removes all PII (personally identifiable information) from the verification data, such as your name, date of birth, and ID number. Stripe only retains the redacted verification data for the purposes of compliance and record-keeping.

Electronic Signatures

We use Skribble (Skribble AG, Switzerland) to sign the agreements required for our services, such as the end-user assignment agreement, with an advanced electronic signature (AES). Skribble processes your name, email address, the documents you sign, and the signature and audit information. An advanced electronic signature requires your identity to be verified; depending on your situation, this is done through Skribble or a trust service provider it works with, for example by video identification or eID. You can learn more in Skribble’s privacy policy.

Payments

We provide paid products and services within the Service and use third-party services for payment processing. We will not store or collect your payment card details. That information is provided directly to our third-party payment processors whose use of your personal information is governed by their Privacy Policy. Card processors adhere to the standards set by PCI-DSS as managed by the PCI Security Standards Council, which is a joint effort of brands like Visa, MasterCard, American Express and Discover. PCI-DSS requirements help ensure the secure handling of payment information. We receive the payment information needed to match and record your payment, such as your name, the amount, and the transaction reference, and keep invoices and payment records as long as Swiss accounting law requires. The payment providers we work with are:

Children’s Privacy

Our Service does not address anyone under the age of 18 (“Children”). Children may only use our services with the written consent of their legal representative, as described in our Terms and Conditions. We do not knowingly collect Personal Data from Children without that consent. If you are a parent or guardian and you are aware that your Child has provided us with Personal Data without your consent, please contact us, and we will take steps to remove that information.

Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will post the new Privacy Policy on this page and update the “updated” date at the top. For material changes, we will also notify customers by email. Changes to this Privacy Policy are effective when they are posted on this page. You are advised to review this Privacy Policy periodically for any changes.

Contact Us

If you have any questions about this Privacy Policy or want to exercise your rights, please contact us by email: support@snapserv.net. Our current business address and registration details are in the imprint.