Can a company receive a payment and never provide the paid service? I was wondering a question about a situation I'm involved in. Prefacing that I live in Italy, where an European directive states that every customer in their territories must have legal rights to return any item or service in his ownership and receive complete refunds (except like shipping fees where previously specified) within 14 days; is it possible for an online service provider (specifically a VPS hosting provider), to have a "no-refund" policy AND a "You agree that we can terminate at our discreption your service for any reason without prior notice" policy in their ToS? I literally mean paying for receiving nothing because at their discreption I was "rude" asking why the setup page of the VPS I bought didn't check for an OS selection and when they asked me that selection I requested a refund because I considered and told them they were a non-serious company, and only for that, not even they deleted my order before it was even completed nor provided, but terminated my account on their site too. Can anyone give me any advice of any action (legal too if necessary) to undertake towards this company? Thanks! PS: Sorry for my english if it isn't 100% correct or well-written but as I said I live in Italy where english is not the first spoken nor written language even if I'm still learning it...
They must give you a refund By saying they don't give refunds that are required by law they are engaging in misleading and deceptive conduct which will expose them to some serious fines. Report them to the relevant Italian authority. Presumably, you paid for this service with a credit/debit card. Contact your card provider and dispute the transaction - they will put the money back in your account and that will probably the last you hear of this company.
To do so I used some images and Gifs which may be under copyright but since I don't earn money for myself and there is no company backing me I was hoping that there is some protection for private persons like me who just want to showcase the project. Sorry. If your website is public facing (i.e. not password protected and available only to family and close friends), you need to follow copyright law. There is no exception to copyright just because a project is run by an individual for non-commercial purposes. I am also insecure about the GDPR regulations since I give users the ability to create an account and try it out. Your profile says you're in the EU. Then you need to comply with the GDPR. Is there any way to protect me against greedy lawyers and companies? Could I write something like: "This website is a peace of art" and save myself with arguments like "artistic freedom" or "free speech"? Nope. A controversial website run by Peter Sunde had at one point a "free speech" disclaimer (similar to the one you propose) posted. However, Sunde did never use this defense in court: Finnish court slaps Peter Sunde with €350k fine. If he had shown up in court, I am pretty sure the court would have told him that such a disclaimer has no legal merit. The only protection that will make you completely safe is to adhere to the law.
Whether or not this would be allowed would generally call for a more fact rich situation than the one presented in the original question, that would cast light upon why a retailer might be inclined to refuse to accept payment. Hypothetical legal questions that presume that people are acting irrationally for no good reason are generally ill posed and don't have meaningful answers. Sometimes, there might be a legitimate privacy interest implicated if the invoicing party acknowledged a payment from a third party. For example, suppose that the invoice was for a paternity test and payment would confirm that the incapacitated person actually obtained a paternity test. Sometimes, there are legal rights beyond payment that are implicated and the reasonableness of a refusal might hinge on those rights. For example, suppose that the invoice was for an option to keep using an oil well. Payment of the invoice by the deadline would keep the oil well operating and the land owner sending the invoice might prefer that it not be paid so that the oil well would be shut down. Quite a few contracts are structured in this way. Maybe the invoice was for the right to purchase a first edition of a book when it was finally released, for example, and not paying it would free up a copy for someone else at a price that had increased in the meantime. Or, suppose that the invoice were for unpaid taxes and payment of the taxes would prevent property from being seized for sale by tax authorities, and the taxing authority would prefer that the invoice was not paid so that the valuable property could be liquidated. But, it is hard to imagine that there would be any reason that an ordinary retailer with an ordinary bill would ever refuse payment, although I suppose that this might trigger an interest or penalty amount owed under the contract for late payment. If that were the case, the principal of mitigation of damages, which says that a party to a contract must take all reasonable steps to mitigate their damages, might obligate the retailers to accept the payment or forfeit the penalty amounts that the retailer could have avoided as damages by accepting payment. I doubt that an undelivered tender of payment from a third party would eliminate the obligation, but, it might limit the damages that could be claimed as in the scenario above.
Being as general as possible - refund policies are governed by bank and scheme policies, and so aren't necessarily the domain of law. There may be jurisdiction-specific regulations that limit your liability as a consumer, but there's not usually a legal requirement. This is almost certainly wholly governed by your credit card terms of use.¹ You can report this to your local authorities, but without proof of a crime, it's unlikely to be actionable. The website isn't necessarily to blame, either - if your computer or your connection to the website was somehow compromised, then your details may have been obtained in that way, and the website could have had nothing to do with it. Again, this is almost certainly wholly governed by their scheme agreement.¹ 1. Some off-topic information here, which may or may not be accurate, and which you should not seek clarification for here (check Money SE instead, and first check whether it is on-topic there) - generally, bank policies will refund you for fraudulent transactions below a certain quantity or value. In this case, the bank tends to take a loss and chargeback rights are not exercised. In other cases, the bank will require the merchant to prove that the authorised cardholder did in fact authorise the transaction. The level of proof is governed by the way in which the transaction was conducted and verified at the time of purchase - whether the CVV2 code was verified, whether address verification was completed, whether 3D verification was completed. If the merchant is unable to prove, according to the scheme guidelines, the transaction will be charged back to their account.
To my knowledge there is no actual law requiring a provider to file anything on your behalf. Most do it as a courtesy but if you read the terms of service that you almost certainly agreed to, it will say that YOU are the responsible party. If the insurance company doesn't pay, even if the provider doesn't submit a claim, the responsibility is still yours. There is nothing stopping you from filing your own claim using whatever forms or procedures that they have established. I'll also note that many provider networks have rules that providers must adhere to in order to remain in that network. Some may include language about timely filing of claims but that is in no way universal. These days many providers have taken to billing the patient the full amount immediately and then will issue a refund to you if/when the insurance pays.
You're probably making an “international transfer” here, but that doesn't mean it is illegal. The GDPR has a very broad concept of “personal data” and of “processing”. Per Art 4(2), ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction Which I would summarize as: pretty much anything you do with the personal data counts as “processing”. So yes, your non-EU servers would be processing the personal data in HTTP requests, even when those servers aren't directly storing the personal data. Chapter V of the GDPR applies to Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country […] Per this definition, the question whether an international transfer occurred is inextricably linked with the question whether the data is being processed in the destination country. The generally accepted interpretation here is that mere transfer through a country does not constitute processing. For example, if your requests happen to take a network route through other countries, that wasn't an international transfer. But your HTTP server is definitely doing processing, even if it doesn't store the data persistently. If the HTTP server is in a non-EU country, then you have to consider how this transfer of data is protected. You're supposed to uphold the high GDPR data protection standards regardless of where the processing occurs. Some countries have been granted an EU adequacy decision, meaning that their data protection laws are sufficiently similar to EU laws and no extra bureaucracy is needed for that transfer. The transfer still needs to be noted in your privacy notice (compare Art 13(1)(f)). In other cases, you may be able to rely on “standard contractual clauses” (SCCs), which are pre-formulated contracts provided by the EU that translate relevant GDPR aspects into a private contract between the data exporter and data importer. However, you as a data controller must make sure that the data importer is legally able to enter into that contract. For example, the terms of these SCCs are incompatible with US national security laws, meaning that US companies might not be able to enter into the SCCs. There are a couple of other ways to authorize international transfers, but they are mostly relevant for multinational groups of companies, or in exceptional situations. In any case, other GPDR requirements like the need to have a suitable contract with your data processors remain unaffected. Also unaffected is the obligation to implement appropriate technical and organizational measures to ensure the compliance and security of your processing activities (e.g. see Art 24 and Art 32 of the GDPR). For example, this may imply the need to implement suitable encryption. In the wake of the Schrems II ruling that struck down the EU–US “Privacy Shield” adequacy decision, the EDPB published recommendations on extra compliance measures that could allow SCCs to remain valid for EU–US data transfers. But it's not easy to defend data processing activities when potential adversaries include literally the NSA, and measures such as end-to-end encryption (E2EE) are incompatible with cloud services that are more interesting than backup storage. Practically speaking, I would reconsider an architecture that would allow failover of EU data processing operations to non-EU locations, unless those target countries are covered by an adequacy decision. If you need a high availability setup for EU activities, it may be more appropriate to maintain multiple deployments within the EU.
Not going to hold up. Dutch Supreme Court confirmed 2012-09-21 in LJN BW6135 that arbitration is still covered by the the right to an independent judge, as established in Golder v UK, ECHR 1975-02-21, nr. 4451/70. Stack Exchange can't decide the rules themselves. (The Dutch case confirms that sector-wide arbitration is in fact legal, with regard to a standard arbitration clause commonly used in the Dutch building sector. The arbiter was found to be independent in that case precisely because they weren't picked by the builder involved.) The GDPR is only indirectly relevant, but the fact that it's mentioned does mean that there is an indisputable intent to provide services to EU consumers. (See section 23 of the GDPR, or its national equivalents). As such, you can't hide behind a US business address. If you intend to do business in the EU, it's under EU laws - all of them. You can't say that only the GDPR applies, and not other rules. I'm having a bit of a problem finding a source, but I'm fairly confident that consumers have the right to sue at their own, local court, overruling the default of suing in the court where the counterparty is located. Finally, I have the right under national law (Dutch: BW 6:236 start and sub-n) to strike the arbitration clause up to 30 days after the conflict arises, and demand a court decision. That's not 30 days after I accept the "Public Network Terms", that's 30 days after the arbitration is invoked. Dutch law explicitly allows arbitration abroad, and arbiters may apply foreign law, but as written the arbitration clause has no legal basis in the Netherlands, and any arbitration resolution would therefore not be considered valid. You may wonder if it matters to Stack Exchange that the arbitration decision would not hold in the EU. Well, consider a clause like Indemnification, which demands the user indemnifies Stack Exchange. That's a pretty empty demand if it's not enforceable.
Warranty is company policy. It could be considered part of the contract of sale, but it would still be what the company stated it - at time of purchase - to be. Unless the warranty lists accidental damage as being covered, it looks like the company are following their policy and fulfilling the contract. If you were looking for legal redress since accidental damage resulted from using the product as intended, you'd have more chance of success looking at unsatisfactory quality or the product being unsuitable for the intended purpose under Part 1 chapter 2 sections 9 and 10 of the Consumer Rights Act 2015. It's worth sticking to objective details (for example that the port broke, and that you had used the device as intended). The company are not assuming you broke it (anyone or anything could have caused the accidental damage), and they are not refusing a warranty repair as it appears that accidental damage is not covered by their warranty policy, so this is not one.