Legal

Privacy policy

What we collect through this website and the client portal, why, who else handles it, how long we keep it, and the rights you have over it under the GDPR.

Who is responsible

The controller for the processing described here, within the meaning of Art. 4 (7) GDPR, is:

Italian Cloud – Yusuf Oezeren
Yusuf Oezeren
Burgwedeler Str. 41C
30161 Hannover
Germany

For anything to do with your data, write to hello@italiancloud.co.uk. The full legal notice is in the imprint.

In short

  • We collect what you type into our forms, and what a web server records about every request.
  • We use it to answer you, to run your account, and to keep the site secure — never for advertising.
  • We do not sell data, and we share it only with the service providers named below.
  • We currently run no analytics and set no cookies beyond the ones the site needs to work.

Hosting and server logs

This website is hosted by Hetzner Online GmbH, Germany, which processes data on our behalf. When you visit, the server records standard log data: your IP address, the page requested, the referring page, your browser and operating system, and the time of access. We need this to deliver the site and to detect and investigate attacks; the legal basis is our legitimate interest in operating a secure and stable website (Art. 6 (1) (f) GDPR).

Contact form

If you use the form on the contact page, we process the details you enter — name, email address, and optionally your company, telephone number and message — in order to answer your enquiry and, where it leads there, to prepare a quote. The legal basis is the steps you ask us to take before a contract (Art. 6 (1) (b) GDPR) and our legitimate interest in responding to enquiries (Art. 6 (1) (f) GDPR). We record the IP address the enquiry came from to protect the form against abuse.

The form is protected against automated spam by checks that run entirely on our own server — no CAPTCHA, and no third party sees your enquiry for this purpose.

Client accounts and the customer portal

If you create an account, we store your email address and a salted hash of your password — never the password itself — together with the quotes and offers assigned to you. If you sign in with a Microsoft account instead, we store the identifier your directory issues and your email address, and no password at all. When you accept an offer we record the time, your IP address and your browser, as evidence of the acceptance. This processing is necessary to perform our contract with you (Art. 6 (1) (b) GDPR), and the acceptance record to establish and defend legal claims (Art. 6 (1) (f) GDPR).

To protect your account, we also record each browser you sign in from — a random identifier stored in a cookie on that browser (we keep only a one-way hash of it), the browser type and the address of the first sign-in. When your account is signed in to from a browser we have not seen before, we email you so you can tell us if it was not you. If you ask for a password reset, we store a one-way hash of the link we email you, the time and the address the request came from, and delete it once the link is used or replaced. When you choose a password, we check it against a public list of passwords exposed in data breaches (Have I Been Pwned); only the first five characters of a one-way hash of the password leave our server, so neither the password nor anything that identifies you is disclosed. The legal basis for both is our legitimate interest, and yours, in keeping the account secure (Art. 6 (1) (f) GDPR, Art. 32 GDPR).

Payments

Payments in the portal are handled by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. When you pay an offer, PayPal receives the data needed to process that transaction and acts as an independent controller for it under its own privacy statement. We store only the PayPal order reference and the payment status — never your card or PayPal credentials, which never pass through our servers. The PayPal script is loaded only on the portal page, and only when there is an offer to pay.

Email

Outbound email — enquiry notifications, offers and account messages — is sent through Microsoft 365 using the Microsoft Graph API. Microsoft Ireland Operations Limited acts as our processor for this under a data processing agreement. Microsoft may process data in the United States; such transfers are covered by the EU–US Data Privacy Framework and Microsoft's standard contractual clauses.

Cookies

We set the following cookies:

  • Session cookie (ic_session) — keeps you signed in to the portal or admin area and carries form security tokens. Deleted when it expires.
  • Security cookie (ic_csrf) — protects forms against cross-site request forgery.
  • Device cookie (ic_device) — set only when you sign in, so we can recognise this browser and alert you to sign-ins from others. Kept for one year.
  • Cookie-choice cookie (ic_consent) — remembers that you have seen the cookie notice, so we do not ask on every page. Kept for six months.

These are strictly necessary for the site to work, so they need no consent (§ 25 (2) TDDDG); the legal basis for the processing is Art. 6 (1) (f) GDPR. None of them contains an advertising identifier, and we embed no third-party fonts, maps, videos or social media plugins.

Analytics

We do not currently use any web analytics or tracking. If that changes, this section will say which service we use, and nothing will load until you have agreed to it.

The admin area and the customer portal are never tracked.

How long we keep data

  • Enquiries — until they have been dealt with and no follow-up is expected, unless they become part of a contract.
  • Accounts — for as long as the account exists. Delete requests are handled by a person, and complete once statutory retention periods allow.
  • Offers, invoices and payment records — for the retention periods commercial and tax law require (up to ten years under § 147 AO and § 257 HGB).
  • Server logs — for the period our hosting provider keeps them for security purposes, after which they are deleted.

Your rights

You have the right to access the personal data we hold about you (Art. 15 GDPR), and to have it corrected (Art. 16), deleted (Art. 17) or its processing restricted (Art. 18). You have the right to data portability (Art. 20), and to object to processing based on our legitimate interests (Art. 21). Where processing is based on your consent, you can withdraw it at any time with effect for the future (Art. 7 (3)).

To exercise any of these rights, email hello@italiancloud.co.uk. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state where you live or work.

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

Last updated: 8 August 2026.