Privacy Policy

When you create an account, we collect:

• Name and email address
• Company name (for business accounts)
• Billing address and payment information
• Account credentials (encrypted passwords)
• Phone number (optional)

Nomadesk file sharing:

• File metadata (names, sizes, types, modification dates)
• Folder structure and organization
• Sharing settings and permissions
• Sync activity and device information
• Collaboration activity logs

EUDataVault S3 Storage:

• Bucket names and configurations
• Object metadata (keys, sizes, checksums)
• API access patterns and request logs
• Access credentials (access keys — hashed)
• Storage usage metrics

• IP addresses and geolocation data
• Browser type and version
• Device identifiers and operating system
• Referring URLs and page views
• Session duration and interaction data

• Support ticket content and correspondence
• Email communications with our team
• Feedback and survey responses

Processing is necessary to provide the services you have subscribed to, including account management, file storage and synchronisation, API access, billing, and customer support.

Processing required to comply with legal obligations such as tax laws, financial reporting requirements, and law enforcement requests.

Processing based on our legitimate interests in:

• Preventing fraud and ensuring service security
• Improving and optimising our services
• Network and information security
• Direct marketing to existing customers (with opt-out option)

For optional features such as marketing communications, analytics cookies, and optional data processing activities. You may withdraw consent at any time.

• Creating and managing your account
• Storing, synchronising, and retrieving your files and data
• Providing API access for S3-compatible storage
• Enabling collaboration and file sharing features
• Processing payments and managing subscriptions

• Detecting and preventing unauthorised access
• Monitoring for suspicious activity and abuse
• Enforcing our Terms of Service
• Protecting against malware and security threats

• Responding to your inquiries and support requests
• Troubleshooting technical issues
• Providing service updates and notifications

• Analysing usage patterns to improve features
• Conducting quality assurance and testing
• Developing new features and services
• Optimising performance and reliability

• Sending service-related notifications (mandatory)
• Sending marketing communications (with consent/opt-out option)
• Requesting feedback and conducting surveys

We may share data with trusted third-party service providers who assist us in operating our services:

• Payment processors — to process billing and payments (PCI-DSS compliant)
• Infrastructure providers — European data centres for hosting and storage
• Email service providers — for transactional and marketing emails
• Customer support tools — for managing support tickets
• Analytics providers — for service improvement (anonymised where possible)

All service providers are contractually bound to GDPR-compliant data processing agreements and are only permitted to process data as instructed by us.

For EUDataVault S3 Storage, we distribute storage services provided by our technology partner. Your storage data is processed by our partner under strict data processing agreements that ensure GDPR compliance and European data residency.

We may disclose your data when required by law, including:

• Compliance with legal obligations and valid legal processes
• Responding to lawful requests from public authorities
• Protecting our rights, property, and safety
• Enforcing our Terms of Service

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity, subject to the same privacy protections outlined in this policy.

Our services use data centres located in:

• Germany
• Netherlands
• Belgium

All data centres are ISO 27001 certified and comply with European data protection standards.

In rare cases where international data transfer is necessary, we ensure:

• Standard Contractual Clauses (SCCs) are in place
• Adequacy decisions by the European Commission are respected
• Additional safeguards are implemented as required

• AES-256 encryption for data at rest
• TLS 1.3 encryption for data in transit
• Regular security audits and penetration testing
• Multi-factor authentication options
• Intrusion detection and prevention systems

• Employee training on data protection
• Access controls and least privilege principles
• Regular security assessments
• Incident response procedures
• Data protection impact assessments

In the event of a data breach affecting your personal data, we will:

• Notify the relevant supervisory authority within 72 hours
• Notify affected individuals without undue delay when required
• Document the breach and remediation measures
• Take steps to mitigate harm and prevent future incidents

Retained for the duration of your account and up to 30 days after account deletion to allow for account recovery.

Retained for the duration of your subscription. Upon account termination, files are deleted within 30 days unless legally required to retain.

Retained for 7 years as required by Belgian tax law.

Retained for 12 months for security and fraud prevention purposes.

Retained for 3 years after ticket resolution for quality assurance and legal purposes.

When you first visit our website, you will be presented with a cookie consent banner allowing you to accept or reject non-essential cookies. You can change your preferences at any time through our cookie settings.

We may use third-party analytics services such as Google Analytics. These services may set their own cookies. We configure these services to anonymise IP addresses where possible.

• Email notification for significant changes
• Notice on our website and within the application
• Updated "Last modified" date at the top of this policy