- 1. Controller
- 2. Purposes and legal bases for the processing
- 3. Categories of personal data concerned
- 4. Recipients of personal data
- 5. Transfers to third countries
- 6. Storage periods
- 7. Basic rights of data subjects
- 8. Withdrawal of consent
- 9. Right to lodge a complaint with a supervisory authority
- 10. Necessity to provide personal data
- 11. Sources of personal data
Personal data means any information relating to an identified or identifiable natural person ("data subject").
Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Data controller with regard to personal data processed under this Policy is DoubleCloud GmbH (Kurfürstendamm 11, 10719 Berlin, Germany) or DoubleCloud Inc. (10 State street, Newburyport, MA 01950, United States, FN 6204565) ("DoubleCloud"), depending on which legal entity provides you services under the DoubleCloud Customer Agreement set forth at https://double.cloud/legal/customer_agreement/
Depending on the specific purpose and other circumstances of data processing, DoubleCloud may act as a controller or a processor. When acting as a controller, DoubleCloud independently determines the purposes and means of the processing of personal data. At the same time, being a processor, DoubleCloud processes personal data on behalf of the user and under its instructions.
When DoubleCloud is a data controller, the data subjects can contact DoubleCloud on any questions relating to the processing of their personal data by either of the following methods:
Postal address: Kurfürstendamm 11, 10719 Berlin, Germany (for DoubleCloud GmbH); 10 State Street Newburyport, MA 01950 (for DoubleCloud Inc.)
Phone number: +49 30 233 22 4700 (for DoubleCloud GmbH); +1 617 398-78-70 (for DoubleCloud Inc.)
2. Purposes and legal bases for the processing
As a controller, DoubleCloud processes personal data to manage provision of the services to its users (customer registration/authentication, provision of access to the service, support and troubleshooting, billing, etc.), to comply with applicable laws, to market the DoubleCloud services and other products, to improve the DoubleCloud services, to provide security of the DoubleCloud services, to protect its legal rights.
When doing so, DoubleCloud relies on (1) the necessity of the processing for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (2) the necessity of the processing of personal data to comply with its legal obligations; (3) the necessity of the processing of personal data for the purposes of the legitimate interests pursued by DoubleCloud. In some cases, DoubleCloud relies on (4) a consent of a data subject to process his or her personal data. Please note that direct marketing communications with you shall be made only upon your prior opt-in consent, and you will have an opportunity to opt-out at any time using the "unsubscribe" button in messages you receive from us.
At the same time, DoubleCloud processes personal data shared by users (e.g. uploaded into the cloud) for the purpose of providing its services. In this case, DoubleCloud generally acts as a processor on behalf and under the instructions of the user.
3. Categories of personal data concerned
As a controller, DoubleCloud processes personal data related to its potential and current customers (individuals or representatives of legal entities), individuals who actually use the DoubleCloud services (users), users of the website. Categories of processed personal data include:
1. Personal data collected directly from the data subject:
information about choices regarding marketing communications;
2. Automatically collected personal data related to the usage of the service:
information about usage of the service;
type and device ID;
browser type and version;
geographical location based on the IP address;
service access times;
statistics on page views and time spent on pages;
log files generated during usage of the service;
information about usage of the website obtained through Google Analytics or similar technologies.
3. Personal data received from third parties:
personal data specified above if obtained from authorized third parties on an appropriate legal basis;
standard claims from Google or SSO provider (email, name, surname, middle name, picture, gender, address, birthdate);
data from EDM (name and surnames of signatories, contact details of signatories, power of attorney data).
4. Recipients of personal data
DoubleCloud discloses certain personal data to the following recipients to the extent required or permitted by applicable law and/or based on their legitimate and reasonable requests:
affiliate entities which are a part of DoubleCloud group of companies;
third-party providers of cloud services (e.g. AWS);
Google LLC providing Google Analytics and Google workspace services;
Appcues, Inc. (https://www.appcues.com/) for enhancing your user experience when using the service;
payment service providers (e.g. Stripe);
partners providing sales and marketing services;
providers of CRM, ERP, billing and other systems required for administrating DoubleCloud business processes;
various state and municipal authorities if strictly required to respond to their legitimate formal inquiries;
other third parties when it is required for compliance with applicable laws.
5. Transfers to third countries
DoubleCloud transfers personal data of the data subjects to the countries that do not provide for a sufficient level of protection of data subjects' rights under the European Union law. When doing so, DoubleCloud employs the standard contractual clauses issued by the European Commission.
6. Storage periods
7. Basic rights of data subjects
The data subjects, in respect of their personal data, have rights to:
(The data subject can ask DoubleCloud to confirm whether or not DoubleCloud processes their personal data. If so, the data subject can access these personal data and can ask DoubleCloud to explain certain details of the processing.)
(The data subject can ask DoubleCloud to correct inaccurate personal data concerning him or her. If it complies with the purposes of the processing, the data subject can ask DoubleCloud to complete incomplete personal data.)
erasure ('right to be forgotten');
(The data subject can ask DoubleCloud to erase personal data concerning him or her under applicable law. For example, this applies if (1) the personal data are no longer necessary in relation to the purposes for which they were processed; (2) the data subject withdraws consent to the processing and there is no other legal ground for the processing; (3) the personal data have been unlawfully processed.)
restriction on processing;
(The data subject can ask DoubleCloud to mark the stored personal data with the aim to limit their processing in the future under applicable law. This applies if (1) the data subject contests the accuracy of the personal data; (2) the data subject asks to restrict the use of the personal data when their processing is unlawful; (3) the data subject needs personal data to protect their rights when DoubleCloud no longer needs the personal data; (4) the data subject has objected the processing based on the legitimate interests pursued by DoubleCloud or by a third party.)
objection to processing;
(The data subject can object, on grounds relating to their particular situation, at any time to processing of personal data concerning him or her which is based on the legitimate interests pursued by DoubleCloud or by a third party. DoubleCloud shall no longer process the personal data unless DoubleCloud demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims.)
(When the processing is based on consent of the data subject or on a contract with the data subject, and is carried out by automated means, the data subject can receive the personal data concerning him or her, which he or she has provided to DoubleCloud, in a structured, commonly used and machine-readable format and can freely transmit those data to another controller. Where technically feasible, the data subject can also ask DoubleCloud to transmit the personal data directly to another controller.)
8. Withdrawal of consent
9. Right to lodge a complaint with a supervisory authority
When Article 77 of the GDPR (or the relevant provision of other applicable laws) applies, a data subject has the right to lodge a complaint with a supervisory authority in the area of data protection in the country of his/her residence.
10. Necessity to provide personal data
11. Sources of personal data
DoubleCloud collects personal data from the data subjects themselves. However, in certain cases and for specific purposes it may also acquire some data from external providers of sales and marketing services.
Date of publication: 27 June 2022
Effective date: 27 June 2022