Privacy and Personal Data Processing Policy

1. Who Processes Personal Data

2. Categories of Personal Data

WEB IT Cloud may process the following categories of data:

• identification and contact data: full name, company name, address, email address, and telephone number;
• account credentials and account settings;
• billing information, invoices, and transaction identifiers. Full payment card details are not stored by WEB IT Cloud where such data is processed by a payment provider;
• technical logs, including IP addresses, user-agent data, login times, security events, and API access logs;
• support requests and technical correspondence;
• domain name registration data;
• resource usage information and network metadata required for the operation of the Services, security, and abuse prevention;
• marketing consents and Cookie preferences.

3. Purposes and Legal Bases for Processing

Personal data may be processed for the following purposes:

• entering into and performing a contract, activating, providing, administering, and supporting the Services;
• complying with legal, tax, accounting, registration, and other statutory obligations;
• ensuring information and network security, preventing fraud, attacks, and other abuse — on the basis of legitimate interests where permitted by applicable law, or on the basis of a legal obligation;
• marketing — on the basis of consent or another lawful basis, where permitted by applicable law;
• analytics and service improvement — depending on the type of data, on the basis of legitimate interests or consent for non-essential Cookies.

4. Recipients of Personal Data

For the proper provision of the Services, personal data may be transferred to third parties only to the extent necessary for the relevant processing purpose.

Such recipients may include:

• payment providers;
• data centres and infrastructure providers;
• domain name registrars and registries;
• email, helpdesk, and monitoring service providers;
• professional advisers;
• governmental and law enforcement authorities — only where there is a valid legal basis;
• other service providers and subprocessors engaged by WEB IT Cloud to support the operation of the Services.

5. International Data Transfers

Where personal data subject to the GDPR is transferred from the European Economic Area to a country that is not covered by an adequacy decision, WEB IT Cloud applies appropriate data transfer safeguards where such safeguards are legally required.

Depending on the circumstances, such safeguards may include, in particular, the European Commission's Standard Contractual Clauses (SCCs).

The specific transfer mechanism is determined with regard to the roles of the parties, the location of processing, and applicable law.

6. Data Retention Periods

WEB IT Cloud retains personal data for no longer than is necessary for the purposes for which it is processed, the performance of contractual and statutory obligations, security purposes, and the protection of legitimate interests.

• account data — for the duration of the contractual relationship and for a reasonable period after its termination where necessary to comply with legal obligations and protect the rights and interests of the parties;
• financial and accounting records — for the periods required by the laws of Ukraine;
• security/access logs — generally for up to 90 calendar days from the date the relevant record is created. Certain logs or portions thereof may be retained for a longer period where an information security incident, fraud, abuse, breach of the Terms of Service, or another violation has been identified, where such data is required for investigation, or where a longer retention period is required by law;
• support requests and related technical correspondence — for up to 3 years from the date the relevant support request is closed, unless a longer retention period is necessary to comply with applicable law, resolve a dispute, or protect the rights and legitimate interests of WEB IT Cloud or the Customer;
• domain registration data — in accordance with the requirements of the relevant registry, registrar, and applicable law;
• backup data — until cyclic overwriting in accordance with the applicable backup policy.

7. Rights of Data Subjects

Depending on applicable law, a data subject may have the right to:

• receive information about the processing of their personal data;
• obtain access to their personal data;
• request correction or updating of inaccurate data;
• request deletion of data where provided by law;
• request restriction of processing;
• object to certain types of processing;
• withdraw previously given consent;
• exercise the right to data portability where such right is provided by applicable law;
• lodge a complaint with the competent data protection authority.

These rights are not absolute. In certain circumstances, WEB IT Cloud may be required to continue storing or processing certain data due to statutory requirements or where necessary for the establishment, exercise, or defence of legal claims.

8. Personal Data Security

WEB IT Cloud applies risk-based technical and organisational measures designed to provide an appropriate level of protection for personal data, taking into account the nature of the information, the characteristics of the Service, and the relevant risks.

Such measures may include:

• access control and segregation of privileges;
• event logging;
• multi-factor authentication for privileged accounts;
• timely software updates;
• backup procedures;
• network security measures;
• incident monitoring and response;
• measures designed to ensure confidentiality by employees and contractors.

9. Personal Data Breaches

WEB IT Cloud assesses information security incidents in accordance with applicable law and the nature of the relevant incident.

Where WEB IT Cloud acts as a personal data processor under the GDPR, WEB IT Cloud will notify the relevant controller without undue delay after becoming aware of a personal data breach and will provide the information reasonably available to it that is required for the controller to comply with its legal obligations.

10. Children's Data

WEB IT Cloud Services are primarily intended for adults, entrepreneurs, and business users.

WEB IT Cloud does not intentionally seek to collect personal data from children for the purpose of allowing them to independently enter into contracts.

Where applicable law requires age verification, parental consent, guardian consent, or approval from another lawful representative, the relevant procedure will be applied to the applicable product or Service.

11. Cookies and Similar Technologies

WEB IT Cloud may use Cookies and similar technologies to ensure proper website operation, authentication, security, preservation of user preferences, analytics, and improvement of the Services.

Non-essential analytics or marketing Cookies are used in accordance with applicable law and, where required, on the basis of the user's consent.

12. Changes to This Policy

WEB IT Cloud may update this Policy from time to time due to changes in applicable law, Service functionality, technological processes, or personal data processing practices.

The current version of this Policy is published on the WEB IT Cloud website and indicates its version number and effective date.

Where changes are material, WEB IT Cloud may additionally notify Customers through their account, by email, or through another available communication channel.

13. Contact Information

For questions relating to the processing and protection of personal data, the exercise of data subject rights, or this Policy, please contact:

14. Applicable Law

This Policy is governed by the laws of Ukraine. Where mandatory data protection requirements of another jurisdiction apply to specific processing activities, WEB IT Cloud will comply with such requirements to the extent they are applicable.