This privacy policy explains which personal data we process when you use our website, customer account and services, for what purposes, on which legal basis, and which rights you have.
This privacy policy applies to our website ecso.cloud, all of its subdomains (such as status.ecso.cloud, share.ecso.cloud and free.ecso.cloud) and our customer area. The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Further information about our company can be found in our Imprint.
For all questions regarding data protection and for exercising your rights, you can contact us at any time at data-privacy@ecso.cloud or by post at the address above with the addition "Data Protection".
When you visit our website, your browser automatically transmits information to our servers. The following data is processed: IP address, date and time of the request, requested URL, referrer URL, HTTP status code, transferred data volume, browser type and version, and operating system.
We process this data to deliver the website, to ensure its stability and security, and to detect and defend against attacks and misuse. Art. 6 (1) (f) GDPR
Our legitimate interest lies in the secure and error-free provision of our website. Log files are deleted after 14 days at the latest, unless they are required as evidence in connection with a specific security incident.
IP addresses from which obviously malicious requests are sent, such as automated searches for security vulnerabilities, are automatically blocked on our servers for 24 hours. Art. 6 (1) (f) GDPR
Our website and customer area run on several servers in parallel. Which server answers your request is determined automatically depending on your region and the availability of the servers. So that every server can answer your request, the data is kept synchronised between our servers.
We currently use servers of the following providers: group.one (one.com Group AB, Carlsgatan 3, 211 20 Malmö, Sweden), OVH GmbH (Christophstraße 19, 50670 Cologne, Germany) and our own servers. We deliberately distribute our infrastructure across several independent providers so that our services remain available if one provider fails. All servers are currently located in data centres in Germany. The providers process the data on our behalf exclusively for the operation of the servers; we have concluded a data processing agreement pursuant to Art. 28 GDPR with each of them. Art. 6 (1) (f) GDPR
Our legitimate interest lies in the reliable and fail-safe provision of our website and services.
The DNS records of our domain are managed by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. We also use Cloudflare's load balancing: when our domain name is looked up, Cloudflare answers with the IP address of a suitable server that is currently available. For this purpose, Cloudflare regularly checks whether our servers are reachable. Art. 6 (1) (f) GDPR
Cloudflare only receives the DNS query. It usually comes from the DNS resolver of your internet provider and not directly from your device; depending on the resolver, a shortened part of your IP address may be included. The content of our website and your requests to it are not routed through Cloudflare, so Cloudflare does not receive any data that you view or enter on our website.
Cloudflare is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). In addition, our contract with Cloudflare includes a data processing agreement with the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR).
To detect and fix technical errors quickly, our servers send error reports to the EU cloud of PostHog, which is operated on servers in Frankfurt am Main, Germany. An error report contains the error message, the affected program file and a pseudonymised identifier derived from your session, which does not allow PostHog to identify you directly. Your IP address is not transmitted. Art. 6 (1) (f) GDPR
Our legitimate interest lies in the stable and error-free operation of our services. The provider is PostHog Inc., 2261 Market St., San Francisco, CA 94114, USA, with whom we have concluded a data processing agreement. As a precaution against access from the USA, the EU Standard Contractual Clauses have been agreed (Art. 46 (2) (c) GDPR).
All fonts, scripts, icons and images on our website and in the customer area are delivered exclusively from our own servers. We do not use external content delivery networks, so no data is transmitted to third parties when pages are loaded.
When you register and use your customer account, we process the data you provide, in particular name, company, address, email address, phone number, VAT identification number and payment information, as well as contract, usage and billing data relating to the services you have booked.
We process this data to set up and manage your account, to conclude and perform contracts, to provide our services and to issue invoices. Art. 6 (1) (b) GDPR
For each login, we store the IP address, the browser and device type, and the approximate location (city and country) derived from the IP address. You can view and end your active sessions at any time in your account settings. The location is determined locally on our servers using the IP geolocation database of DB-IP (IP Geolocation by DB-IP, licensed under CC BY 4.0); your IP address is not transmitted to third parties for this purpose. We process this data to protect your account against unauthorised access. Art. 6 (1) (f) GDPR
If you provide a VAT identification number, we check its validity via the VAT Information Exchange System (VIES) of the European Commission. For this purpose, the VAT identification number and the country are transmitted to the European Commission. Art. 6 (1) (c) GDPR
When you place an order, we store your declaration regarding the immediate start of the service together with the time, IP address and browser information. We need this record to be able to prove the declaration in the event of a withdrawal. It is stored for the duration of the contract and three years thereafter. Art. 6 (1) (c) and (f) GDPR
We send you emails that are necessary for the contractual relationship, such as login codes, invoices, maintenance notices and security notifications. These cannot be deactivated as long as the contract exists. Art. 6 (1) (b) GDPR
Our emails are sent from our own mail server and delivered via the relay service Brevo (Sendinblue SAS, Paris, France). Brevo processes the recipient address, the content of the email and technical delivery data exclusively on servers in the European Union on our behalf. We have concluded a data processing agreement with Brevo pursuant to Art. 28 GDPR. This applies to all emails we send, including replies to support requests and confirmations of terminations and withdrawals. Art. 6 (1) (b) and (f) GDPR
If you store or process personal data of third parties on servers or services you have booked with us, you are the controller for this data. We process it solely on your behalf on the basis of a data processing agreement pursuant to Art. 28 GDPR, which you can conclude in your Customer account.
Payments are processed by Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands. You enter your payment details, such as credit card information, directly with Mollie; we do not receive or store full card data. Mollie transmits to us only the information required to process the payment, such as a pseudonymised card reference that allows future payments. Further information: www.mollie.com/legal/privacy Art. 6 (1) (b) GDPR
If outstanding claims remain unpaid despite reminders, we may transfer the data required for collection to a debt collection agency or a law firm. Art. 6 (1) (f) GDPR
To prevent fraud and misuse of our infrastructure (e.g. for attacks, spam or payment default), we check new registrations on the basis of general risk factors. For this purpose, the data you provide and technical characteristics such as IP address and device information are evaluated and compared with our previous experience. Art. 6 (1) (f) GDPR
To activate your account, we may ask you to verify your identity. The verification is carried out by our service provider Didit (didit.me), which processes on our behalf the data from your identity document (in particular name, date of birth, address, document number and expiry date) and, depending on the procedure, a photo or short video of your face to confirm that you are the holder of the document. You may black out information on the document that is not required.
Comparing your face with the photo on the document involves the processing of biometric data. This only takes place with your explicit consent, which you give at the beginning of the verification and can withdraw at any time with effect for the future. Art. 9 (2) (a) GDPR
We only receive the result of the verification (approved or declined) and a reference to the verification process; we do not store copies of your identity document. Art. 6 (1) (b) and (f) GDPR
If the identity verification fails, your account is automatically declined. This automated decision is necessary for the conclusion of the contract, as we only provide our infrastructure to verified customers (Art. 22 (2) (a) GDPR). You have the right to obtain human intervention, to express your point of view and to contest the decision. To do so, simply contact our support; an employee will then review your case individually.
If you contact us by email, phone, contact form, termination or withdrawal form or via the support ticket system, we process the data you provide (e.g. name, contact details, content of your request) in order to answer your request.
If your request relates to an existing contract or to the conclusion of a contract, the legal basis is Art. 6 (1) (b) GDPR. Otherwise, the legal basis is our legitimate interest in answering requests addressed to us, Art. 6 (1) (f) GDPR.
To enable communication across languages, support messages may be machine-translated using a translation service operated on our own servers.
Emails to addresses of our domain are received by the email forwarding service of Cloudflare, Inc. and forwarded directly to our own servers, where they are processed, for example as a support ticket. Cloudflare processes the email only for forwarding and does not store its content. For delivery logs, Cloudflare keeps the sender and recipient address, the subject, the time of receipt and the delivery status for a limited period. We use this information to check that all emails have reached us. The information on data transfers to Cloudflare in the section "Visiting our website" applies accordingly. Art. 6 (1) (b) and (f) GDPR
Our replies and all other emails continue to be sent via Brevo as described in the section "Customer account".
If you report abuse or illegal content via our abuse form or by email, we process the information you provide, including your name and email address, to review and handle the report. As a hosting provider, we are obliged to provide a notice and action mechanism under Art. 16 of the Digital Services Act. Art. 6 (1) (c) GDPR
To remedy the matter, we may forward the content of the report to the customer concerned. We only disclose your identity if this is necessary to handle the report or if we are legally obliged to do so. Art. 6 (1) (f) GDPR
If you apply for a position with us, we process the data you provide (e.g. contact details, CV, certificates, cover letter) in order to carry out the application process. Art. 6 (1) (b) GDPR
Some job advertisements are processed via the recruiting platform JOIN of JOIN Solutions AG, Switzerland. The European Commission has recognised that Switzerland provides an adequate level of data protection (Art. 45 GDPR).
If you are hired, your data will be transferred to your personnel file. If you are not hired, we delete your application documents six months after the end of the application process, unless you have consented to a longer storage period for future vacancies. Art. 6 (1) (a) GDPR
If you apply for our Creator Program, we process the information you provide (name, email address, platform, channel link and reach) in order to review your application. If you are accepted, we process your data to manage the creator code, calculate and pay out your credit and fulfil our tax obligations. Art. 6 (1) (b) and (c) GDPR
If a customer uses a creator code, we store the code with the invoice. The creator only receives aggregated statistics (number of uses and credit earned) and no personal data of the customer. Applications that are not accepted are deleted after six months.
We only disclose your personal data to third parties if this is necessary for the purposes described in this privacy policy. In addition to the service providers named above, recipients may include tax advisors and auditors, banks, debt collection agencies, lawyers and courts as well as authorities, if we are legally obliged to disclose data.
Service providers who process data on our behalf are carefully selected and contractually bound pursuant to Art. 28 GDPR. Unless stated otherwise in this privacy policy, your data is processed exclusively within the European Union or the European Economic Area.
If you book a server at a location outside the European Union, the data you store on it is processed in the country of the selected location on your instructions. The choice of location is yours; the location of each product is shown before you place your order.
We store personal data only for as long as is necessary for the respective purpose or as required by statutory retention obligations. Specifically, the following periods apply:
The retention periods begin at the end of the calendar year in which the data was last required. After the periods expire, the data is deleted or anonymised.
Under the GDPR, you have the following rights with regard to your personal data:
Access
Art. 15 GDPRYou can request information about whether and which personal data we process about you.
Rectification
Art. 16 GDPRYou can request the correction of incorrect or the completion of incomplete data.
Erasure
Art. 17 GDPRYou can request the deletion of your data, unless statutory retention obligations prevent this.
Restriction of processing
Art. 18 GDPRYou can request that we restrict the processing of your data, for example while its accuracy is being checked.
Data portability
Art. 20 GDPRYou can receive the data you have provided in a structured, commonly used and machine-readable format.
Withdrawal of consent
Art. 7 (3) GDPRYou can withdraw consent at any time with effect for the future. The lawfulness of processing carried out until then remains unaffected.
Right to object (Art. 21 GDPR)
If we process your data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
To exercise your rights, simply contact us at data-privacy@ecso.cloud. You can also request a copy of your data directly in your Customer account.
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:
The State Commissioner for Data Protection and Freedom of Information Rhineland-Palatinate
Hintere Bleiche 34
55116 Mainz
www.datenschutz.rlp.de
We would be grateful if you contacted us first so that we can resolve your concern directly.
You are not legally obliged to provide us with personal data. However, the data marked as mandatory is required for the conclusion and performance of a contract. Without this data, we cannot create a customer account or provide our services.
We use appropriate technical and organisational measures to protect your data against loss, manipulation and unauthorised access. All connections to our website and customer area are encrypted using TLS.
To protect your data against loss, we back up our databases and files daily. The backups are kept on our servers for 7 days and for 30 days with group.one (one.com Group AB, Carlsgatan 3, 211 20 Malmö, Sweden) in a data centre in Germany. They are transmitted in encrypted form, and group.one processes them on our behalf on the basis of a data processing agreement pursuant to Art. 28 GDPR. Art. 6 (1) (f) and Art. 32 GDPR
We adapt this privacy policy when our services or the legal requirements change. The version published on this page at the time of your visit applies.