Cloudpepper privacy & data

The data controller for the personal data described in this Privacy Policy is: Cloudpepper BV

we collect your name, business email address, postal address, phone number, company name, VAT number, and payment details

payment details (card data is collected directly by our payment processor and we do not store full card numbers)

When you contact us by email, chat, contact form or phone, we collect the contents of those communications and any contact information you provide.

your IP address, device and browser characteristics, pages visited, referring URL, timestamps, campaign parameters and ad click identifiers where applicable

Providing the Services to our customers (provisioning servers, deploying Odoo, monitoring, support).

Billing and payment processing. Account and billing data.

Sending marketing emails to prospective customers and newsletter subscribers.

Website analytics and marketing performance measurement.

Account and billing data: for the duration of the customer relationship and for seven (7) years after termination, in line with Belgian tax and accounting obligations.

Communication and support data: up to three (3) years after the last interaction, unless a longer period is required for legal or contractual reasons.

Technical and usage data (logs, security events): typically up to twelve (12) months, subject to longer retention where needed for security investigations.

We store and process personal data within the European Economic Area (EEA) wherever possible, including on infrastructure located in Belgium and elsewhere in the EU.

we rely on the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914)

The current sub-processor list is maintained in Annex A of our Data Processing Agreement .

The terms of that processing are set out in our Data Processing Agreement

If you believe a child’s data has reached us, email privacy@cloudpepper.io and we will delete it.

Right of access — to obtain confirmation of whether we process your personal data and a copy of that data.

Right to erasure (“right to be forgotten”) — to have your personal data deleted in certain circumstances.

Right to data portability — to receive your personal data in a structured, commonly used and machine-readable format and to transmit it to another controller.

Right to object — to object to processing based on legitimate interests, including direct marketing.

Right to lodge a complaint. If you believe that our processing of your personal data infringes Data Protection Laws, you have the right to lodge a complaint with a supervisory authority.

We do not sell your personal data.