Privacy Policy

1. Data Controller

VirtCloud ("we," "us," "our") is the data controller responsible for processing your personal data in accordance with the General Data Protection Regulation (GDPR) and applicable data protection laws. This Privacy Policy explains how we collect, use, and protect your personal information when you use our hosting services. VirtCloud is established in the Netherlands and registered with the Dutch Chamber of Commerce (KVK) under number 94477353. You can reach us at [email protected].

This Privacy Policy does not cover personal data that customers themselves store or process on the services they host with us. For that data the customer is the data controller and VirtCloud acts as a data processor; a Data Processing Agreement (DPA) is available on request, as described in our Terms of Service.

2. Information We Collect

2.1 Personal Data

We collect the following categories of personal data:

• Identity data: Full name
• Contact data: Email address, postal address
• Financial data: Billing information, payment history
• Technical data: IP address, browser type, device information
• Usage data: Service usage, account activity
• Support and communication data: Messages and information you send us through the contact form, email, support tickets, or Discord

Identity, contact, and billing data are required to enter into and perform an agreement with us. Without this data we cannot provide our services. If you contact us through Discord, Discord's own privacy policy also applies to its processing of your data.

2.2 Cookies

Our website (virtcloud.net) does not set any cookies of its own and does not use local storage. Our client area (billing.virtcloud.net) uses cookies that are needed for it to function and for security. These include:

• A session cookie that is required to sign in, place orders, and use the client area. It is deleted when you close your browser.
• An affiliate cookie that is set when you arrive through an affiliate link, so that the referral can be credited. It is stored for 90 days.
• A Google reCAPTCHA cookie on forms that are protected by reCAPTCHA (see 2.4).

This overview describes the cookies we have identified; it is not necessarily a complete list of every cookie the client area software can set. Team profile images on our About Us page are loaded from Discord's content delivery network, which may set its own security cookie. We do not use cookies for advertising or tracking purposes.

2.3 Payment Information

Payments for our services are handled by the third-party payment processors PayPal and Stripe. We do not store or process your payment card details. Stripe also carries out fraud prevention and verification checks on payments made through it, which may involve an automated assessment of the payment. For details on how these processors handle your data, refer to their respective privacy policies.

2.4 Google reCAPTCHA

We use Google reCAPTCHA (a Google Ireland Limited service) on forms in our client area, such as the login, registration, and support ticket forms, to prevent automated abuse. This service processes your IP address and browser data and sets a cookie that is stored for about six months, based on our legitimate interest in service security. Google's Privacy Policy applies to their processing.

2.5 Cloudflare

Our website and client area are delivered through the network of Cloudflare, Inc., which processes your IP address and technical request data to deliver and secure our services. We also use Cloudflare Turnstile to protect the contact form on our website against automated abuse, and Cloudflare Web Analytics, which works without cookies, to measure the traffic and performance of our website and client area. This processing is based on our legitimate interest in a secure and well-functioning website. Cloudflare's Privacy Policy applies to their processing.

2.6 External Resources in the Client Area

Our client area currently loads fonts from Google Fonts (a Google Ireland Limited service) and a styling library from the Tailwind CSS content delivery network (cdn.tailwindcss.com). When your browser loads these resources, their providers receive your IP address and technical request data. No other personal data is shared with them. This processing is based on our legitimate interest in a correctly displayed and functioning client area.

3. Processing Purposes and Lawful Bases

We process your personal data for the following purposes and lawful bases:

• Service provision: Account management and hosting services (performance of contract)
• Payment processing: Billing and payment collection (performance of contract)
• Communications: Service-related notifications (performance of contract)
• Legal compliance: Tax, accounting, and regulatory requirements (legal obligation)
• Security: Fraud prevention and system security (legitimate interest)
• Customer support: Handling inquiries, support tickets, and contact form messages (performance of contract or legitimate interest)
• Abuse handling and legal claims: Investigating abuse reports, enforcing our Terms of Service, and establishing or defending legal claims (legitimate interest)
• Website performance: Measuring website traffic and performance (legitimate interest)

3.1 Cookies

Cookies are used only for the purposes described in 2.2 and 2.4: operating the client area, crediting affiliate referrals, and security. They are not used for analytics, advertising, or profiling.

4. Data Retention

We retain personal data only as long as necessary for the purposes outlined in this policy, or as required by law. We apply the following maximum retention periods:

• Invoices, payment records, and other business records we are legally required to keep: 7 years, in line with the statutory retention obligation under Dutch tax law.
• Account data: For the duration of your service agreement and no longer than 2 years after it has ended.
• Support tickets: No longer than 2 years after the ticket has been closed.
• Contact form messages and other correspondence from non-customers: No longer than 1 year after the inquiry has been handled.
• Regular technical and access logs: No longer than 90 days.
• Security, fraud, and abuse records: No longer than 2 years after the matter has been closed, unless longer retention is necessary in a specific case for an investigation, a dispute, a legal claim, or a legal obligation.

These are maximum periods. Data may be deleted earlier when it is no longer necessary for the purpose for which it was collected. You may request earlier deletion; we will honor such requests unless a legal obligation or the establishment, exercise, or defense of legal claims requires us to keep the data. Data that customers store on their hosted services is deleted when the service is terminated, as described in our Terms of Service.

5. Data Security

We take appropriate measures to protect your personal information from unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption
• Access controls
• Regular security assessments

While we implement robust security measures, no method of electronic transmission or storage is completely secure.

6. Data Sharing and International Data Transfers

We share personal data only where necessary for the purposes described in this policy, with the following categories of recipients: payment processors (see 2.3), providers of security, anti-abuse, network, and analytics services (see 2.4 and 2.5), the providers of the external resources described in 2.6, other service providers that support the operation of our website and services, and public authorities where we are legally required to do so.

Some of our service providers may process data outside the European Economic Area (EEA), for example in the United States. Where this occurs, we ensure adequate protection through an adequacy decision of the European Commission, Standard Contractual Clauses, or other appropriate safeguards approved by the European Commission. You may contact us for more information about these safeguards.

7. Your Rights

Under GDPR, you have the following rights:

• Access: Request copies of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion where legally permissible
• Restriction: Limit processing in certain circumstances
• Data portability: Receive data in machine-readable format
• Objection: Object to processing based on legitimate interests

To exercise your rights, contact us at [email protected]. You also have the right to lodge a complaint with your local data protection supervisory authority. In the Netherlands, this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

8. Automated Decision-Making

We do not make automated decisions that produce legal effects or significantly affect you without human review. Payments made through Stripe are subject to Stripe's automated fraud prevention checks (see 2.3), which may result in a payment being declined. If you believe a payment was declined incorrectly, you can contact us at [email protected].

9. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be notified through our website. The most recent version is always available on this page.

10. Contact Information

For questions about this Privacy Policy or to exercise your data protection rights, contact us at:

Email: [email protected]

You may also contact your local data protection supervisory authority if you have concerns about our data processing practices.