Legal

Privacy notice

How CloudDesk collects, uses and retains personal data. Last updated the 12th of June.

Who we are

CloudDesk B.V. is the controller for account, billing and support data, and a processor for the workspace content our customers upload. Platform operations run from the European Union, with an optional United States processing region for Enterprise workspaces.

Data we process

• Account data. Name, work email address, job title, workspace role and language preference.
• Authentication data. Password hashes (never plaintext passwords), sign-in timestamps, client addresses and one-time recovery codes stored only as hashes.
• Workspace content. Projects, documents, report definitions and audit records created by your team inside the workspace.
• Support data. Correspondence, and diagnostics a workspace administrator chooses to share.

Retention

Audit records are retained for 12 months on the Business plan and 365 days on Enterprise. Directory data is deleted 30 days after an account is closed, unless a legal hold applies. Recovery codes are deleted on use or 30 minutes after they are issued.

Your rights

Workspace owners can export or delete workspace data from the workspace settings screen. Individuals may request access, rectification or erasure by writing to privacy@clouddesk.local. We answer within 30 days.

Sub-processors

A current list of sub-processors and their locations is available from the platform team on request. Customers are notified at least 30 days before a new sub-processor is engaged.