Legal & policies
Sanctions Policy
FIRST SERVER applies sanctions and service-eligibility checks to its hosting and infrastructure services. Provider details and the contact channel are available in our Legal Notice and Contact Us page.
1. Applicable law and our commercial policy
As a provider established in Spain, FIRST SERVER must comply with applicable EU restrictive measures and Spanish law, including UN sanctions implemented through applicable law. Other jurisdictions' restrictions are relevant only where legally applicable to the transaction and consistent with EU and Spanish law. A foreign sanctions list does not automatically create an EU-wide prohibition.
EU sanctions may target particular persons, entities, sectors, services, end uses or territories. They do not necessarily prohibit every transaction with everyone in a country. The country exclusions below are FIRST SERVER's own service-eligibility policy, which may be stricter than a specific legal prohibition, subject to mandatory law.
2. Countries and territories we do not serve
Under FIRST SERVER's commercial service-eligibility policy, subject to mandatory EU and Spanish law, we do not accept customers ordinarily resident in, incorporated in, or operating the contracting business from the following countries:
- Iran
- North Korea (Democratic People's Republic of Korea)
- Cuba
- Somalia
- Yemen
The same commercial eligibility rule applies to the following territories:
- Crimea and Sevastopol, Ukraine
- Non-government-controlled areas of the Donetsk and Luhansk regions of Ukraine, commonly referred to as “DNR” and “LNR”
- Abkhazia, Georgia
These geographic descriptions identify our service coverage and do not recognise a change in internationally recognised borders. Other territories remain subject to any applicable legal restrictions.
Services may not be procured through nominees or resellers to bypass these exclusions. Nationality, birthplace or language alone does not establish residence or ineligibility. An IP address in a listed location is not, by itself, conclusive proof of a contractual violation.
This is FIRST SERVER's commercial coverage list, not a statement that the EU universally prohibits services to every resident of these locations. In particular, Cuba and Abkhazia are not presented as territories subject to a blanket EU hosting embargo. Commercial decisions must comply with mandatory EU law, including Council Regulation (EC) No 2271/96 (the EU Blocking Statute); this policy does not require compliance with extraterritorial foreign sanctions where such compliance is prohibited. Any conflicting restriction is inapplicable to that extent.
Russia and Belarus are not subject to a blanket country exclusion under this commercial policy. This does not authorise any service, recipient, ownership arrangement or transaction prohibited by applicable sanctions; those restrictions continue to apply wherever the customer is located.
2A. EU sanctions: how we assess a service
We assess the current EU legal acts, the customer and beneficial owners, the actual beneficiary, the service and software supplied, the intended use and the payment route. A country name alone does not establish a legal prohibition.
- Russia and Belarus: applicable designated-person and sectoral restrictions remain binding even though our commercial policy does not exclude all customers from these countries. For Russia, ordinary cloud services are generally outside the IT-consultancy prohibition as explained in the Commission's Article 5n FAQ. This is not a general exemption: restricted software, IT consultancy, AI, high-performance/GPU and quantum computing services and other prohibited transactions require separate assessment under the current rules.
- Iran and North Korea: country-specific EU measures, financial restrictions, designated parties and prohibited end uses require review. Our additional commercial exclusions are stated separately above.
- Somalia, Yemen, Sudan, South Sudan, Libya and the Central African Republic: relevant EU regimes include targeted restrictions and other specific measures. They are not described here as a universal ban on ordinary hosting for every resident. Sudan, South Sudan, Libya and the Central African Republic are review jurisdictions, not additional blanket commercial exclusions under section 2.
- Ukraine: territorial measures cover Crimea and Sevastopol and the non-government-controlled areas of Donetsk, Luhansk, Kherson and Zaporizhzhia, with scope determined by the relevant legal acts. Territorial restrictions must be checked for the actual transaction and service.
- Cuba and Abkhazia: their inclusion in our commercial coverage list is not an assertion of a blanket EU hosting embargo. Mandatory EU law, including the Blocking Statute where applicable, takes precedence.
This overview is illustrative, not an exhaustive list of EU sanctions. Designated persons and prohibited transactions can occur in any country. We check the applicable legal position at the time of the transaction rather than treating this summary as authorisation.
References: European Commission guidance on service restrictions and the Council's sanctions regimes and official updates.
3. Prohibited persons, ownership and end uses
Regardless of country, FIRST SERVER will not provide services, funds or economic resources where prohibited by applicable sanctions, including to designated persons or entities and, where the relevant rules apply, entities owned or controlled by them. We must also consider prohibited recipients, end uses, payment routes and sector-specific restrictions. A name match alone requires verification; ownership and control are assessed under the applicable rules rather than a universal fixed threshold.
You must not use our services to circumvent sanctions, disguise a prohibited beneficiary, facilitate a prohibited transaction or provide onward access contrary to applicable restrictions.
4. Accurate information and verification
Customers must provide accurate, complete and current identity, residence, company-registration, ownership, billing and intended-use information where reasonably necessary to assess eligibility. You must promptly tell us about relevant changes and respond to proportionate verification requests. False documents, nominee accounts and deliberate concealment of the contracting customer or beneficiary are material breaches.
Checks may use customer-provided records, official sanctions sources and relevant account or transaction information. Personal data must be limited to what is necessary and handled under our Privacy Policy. We do not treat this policy as authorisation to collect unrelated personal information.
5. Refusal, suspension and termination
FIRST SERVER may refuse an order or suspend an affected service at any time, including immediately and without advance notice where reasonably necessary, if credible information indicates that continued provision may breach applicable sanctions or this policy, or if necessary eligibility information is withheld. A review should distinguish a possible match from a confirmed restriction.
FIRST SERVER may terminate the affected agreement upon a substantiated finding of ineligibility, prohibited use, material misrepresentation or failure to resolve necessary verification after a reasonable opportunity where practicable. Immediate termination may be required where continued service is unlawful. Where lawful and practicable, we will communicate the reasons and permit relevant evidence to correct a mistake. Notice may be restricted by legal or security requirements.
Customers may request review using our contact channel. Access to data, export, record preservation and deletion are governed by applicable law and the relevant contract or DPA; sanctions may restrict otherwise available actions. Publishing this policy alone does not retroactively alter existing contracts.
6. Payments and refunds
For business customers whose service is terminated for their material breach of this policy, including deliberate concealment of a restricted location or beneficiary, FIRST SERVER does not offer a discretionary refund or service credit, to the extent permitted by applicable law. Charges for services already supplied and legally recoverable, documented losses may remain payable. This does not create an automatic right to confiscate all prepaid amounts or an unlimited penalty.
Any statutory repayment, consumer withdrawal, conformity remedy or other mandatory entitlement takes precedence. A newly introduced company restriction, an unconfirmed suspicion or a mistaken match does not by itself justify withholding a refund otherwise owed. Where termination results from a new restriction without customer breach, unused prepaid amounts will be handled under the contract and applicable law.
If sanctions prohibit returning or transferring money, FIRST SERVER must follow applicable freezing, reporting, licensing or authority-instruction requirements. A blocked refund is not automatically forfeited or converted into company revenue. Payments may be made only when lawful and, where required, authorised by the competent authority.
7. Updates and official sources
Applicable law controls even if a website summary has not yet been updated. Changes to our additional commercial exclusions apply according to contractual notice requirements and mandatory law; they do not create retrospective forfeiture rights.
Official reference materials include the Council of the EU sanctions overview, the European Commission sanctions resources and the relevant legal acts in EUR-Lex. These documents, not a generic country list, determine the legal scope of a restriction.