Petabox™ Privacy Policy

1. Who this Policy covers

This Policy covers:

• visitors to the Website;
• people who contact us through the contact form, by email, or through messaging services;
• representatives of customers, prospective customers, partners, and suppliers with whom we do business.

It does not cover personal data stored in Petabox software installed on a customer's own infrastructure. That data is explained in Section 2.

2. Data stored in Petabox installations

Petabox Object Storage and the data services we operate run on infrastructure owned or controlled by our customers. The data stored there ("Customer Data") belongs to the customer and stays on the customer's infrastructure.

• Where a customer runs Petabox software itself, Petabox has no access to Customer Data and is neither a controller nor a processor of it.
• Where Petabox operates the software or data services for a customer under a managed services agreement, Petabox may have limited technical access to the customer's environment to perform those services. In that case Petabox acts as a processor on the customer's instructions, under a Data Processing Agreement that forms part of the customer contract. Petabox does not copy Customer Data outside the customer's infrastructure and does not use it for any purpose other than providing the contracted services.

If you have questions about personal data stored by one of our customers, please contact that customer, who is the controller of it.

3. What personal data we collect

4. Why we use personal data and on what legal basis

We do not use personal data for automated decision-making or profiling that produces legal or similarly significant effects.

5. Who we share personal data with

We share personal data only as needed for the purposes above, with:

• Google LLC (Google Analytics), for Website analytics, subject to your cookie consent. Google may process this data in the United States under the EU–US Data Privacy Framework and standard contractual clauses.
• Our email and hosting providers, who process data on our behalf as processors under written agreements.
• Professional advisers (lawyers, accountants, auditors) where necessary.
• Public authorities, where required by law.
• A successor to our business, in the event of a merger, acquisition, or sale of assets, in which case this Policy continues to apply.

We do not sell personal data and do not share it with third parties for their own marketing.

6. International transfers

We are established in Cyprus (EU). Where personal data is transferred outside the European Economic Area — in practice, to Google in the United States for analytics — we rely on an adequacy decision of the European Commission or on standard contractual clauses, as applicable. You may request a copy of the relevant safeguards by contacting us. Customer Data in Petabox installations is not transferred by Petabox; its location is determined by the customer.

7. How long we keep personal data

• Contact form submissions and enquiry correspondence: up to 24 months after our last contact, unless a business relationship follows.
• Business contact details and contract documents: for the duration of the relationship and 7 years afterwards, as required by Cypriot accounting and tax law.
• Product-update subscriptions: until you unsubscribe.
• Analytics data: as set by Google Analytics retention settings, 14 months.
• Server logs: 90 days.

When data is no longer needed, we delete or anonymise it.

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have it corrected if it is inaccurate or incomplete;
• have it erased where there is no longer a lawful reason to keep it;
• restrict or object to processing based on legitimate interest;
• receive the data you gave us in a portable format (data portability);
• withdraw consent at any time where processing is based on consent — for product updates, by using the unsubscribe link in any email or by writing to us; for analytics cookies, through the cookie settings on the Website;
• lodge a complaint with a supervisory authority. In Cyprus, this is the Office of the Commissioner for Personal Data Protection (https://www.dataprotection.gov.cy). You may also complain to the authority in your own EU member state.

To exercise any of these rights, write to [email protected] or to the postal address below. We will respond within one month, extendable by two further months for complex requests, and may ask you to verify your identity.

9. Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or alteration, including access controls, encryption in transit, and limiting access to those who need it. No method of transmission or storage is completely secure; if you believe your data has been compromised, please contact us immediately.

10. Cookies

The Website uses cookies as described in our Cookie Policy. Analytics cookies are set only with your consent.

11. Changes to this Policy

We may update this Policy. The current version is always published on the Website with its effective date. Where a change materially affects how we use your personal data, we will notify you where we have your contact details.

12. Contact

Lendeco Ltd (Petabox) Aiolou & Panagioti Diomidous 9, Katholiki, 3020 Limassol, Cyprus [email protected] · [email protected] We have not appointed a Data Protection Officer, as we are not required to do so under the GDPR.