Privacy Policy

1. Who is responsible for your data?

The controller is the individual or legal entity operating ZecureCloud and deciding how and why personal data is processed. Its full legal name, postal address and appropriate contact details must be inserted here before publication. ZecureCloud is a service name and does not, by itself, identify the legal controller.

Contact: use the ZecureCloud contact channel for an initial enquiry. A suitable formal privacy contact method should also be confirmed before this policy is finalised.

2. Personal data we may process

Depending on how you use the service, the following categories may be processed:

• Account data: name, email address, account identifier and authentication-related records.
• Service data: VPS name, hostname, IP address, operating system, selected plan, service status and rental dates.
• Credit and transaction records: credit balance, requested credit quantity, request status, transaction history and related administrative messages.
• Support communications: information you submit when contacting support or making a service request.
• Technical and security data: IP addresses, access timestamps, server logs and security events where these are generated and retained by the platform or its providers.
• Payment-related information: records needed to verify a payment or manage a purchase request. The exact data depends on the payment method; do not send full card details or passwords through support messages.

Passwords should be stored using secure password hashing. The operator must verify the actual data collected by the application, infrastructure and any integrated third-party services before this list is considered complete.

3. Why we use personal data

Personal data may be used for purposes such as:

• Creating and managing customer accounts and authenticating users.
• Providing, configuring, maintaining and supporting VPS and related services.
• Managing credit requests, balances, service charges, renewals and payment verification.
• Sending service notices, renewal reminders, security alerts and important account communications.
• Preventing abuse, investigating security incidents and protecting the platform and other users.
• Handling complaints, meeting applicable legal obligations and establishing or defending legal claims.

4. Legal bases for processing

Where the GDPR applies, each processing activity must have an appropriate legal basis. Depending on the purpose and circumstances, these may include performing a contract or taking steps requested before entering into one, complying with a legal obligation, pursuing legitimate interests that do not override your rights, or consent where consent is legally required.

The controller must map each actual processing activity to its legal basis before publication. Consent, where used, can be withdrawn without affecting the lawfulness of processing carried out before withdrawal.

5. Credits, orders and billing records

ZecureCloud currently uses a credit-based service model. Account records may be used to manage credit purchase requests, payment confirmation, credit allocation, VPS plan charges and renewals. Credits should only be allocated in accordance with the published purchase process and following the required payment confirmation.

Billing and transaction records may need to be retained for statutory accounting, tax, dispute-resolution or other legal purposes. The applicable retention periods must be confirmed for the operator's circumstances and jurisdiction.

6. VPS data and customer responsibilities

VPS customers may store or process information inside their own virtual servers. Such customer content may be technically accessible to infrastructure operators in limited circumstances, such as maintenance, abuse investigation or incident response, subject to applicable law and the actual service architecture.

Customers are responsible for ensuring that their own use of a VPS complies with applicable data protection and other laws. The parties' respective roles under data protection law may depend on the nature of the service and the data involved; this must be assessed where ZecureCloud processes personal data on a customer's behalf.

7. Who may receive personal data?

Where necessary and lawful, data may be disclosed to categories of recipients such as:

• Infrastructure, hosting, data-centre and network providers involved in delivering the service.
• Payment or financial service providers used to verify or process payments.
• Technical support, security and maintenance providers authorised to assist with the service.
• Professional advisers, public authorities or courts where required or legally permitted.

The actual providers, their roles, access arrangements and applicable data processing agreements must be identified and checked before this policy is finalised. Personal data is not to be sold as a product; any other disclosure must have a lawful basis and be consistent with the applicable privacy notice.

8. International transfers

Some infrastructure or service providers may process data outside the European Economic Area. Whether any such transfer occurs must be verified. Where GDPR transfer rules apply, the controller must ensure an appropriate transfer mechanism and safeguards are in place and explain them where required.

9. Data retention

Personal data should be kept only for as long as necessary for the purpose for which it was collected, including applicable legal, accounting, security and dispute-resolution requirements. Different categories may require different retention periods.

The controller must define and document actual retention periods or the criteria used to determine them for account records, VPS records, support messages, transaction records, security logs and backups. No fixed period is promised by this draft.

10. Security

Appropriate technical and organisational measures should be used to protect personal data against unauthorised access, loss, alteration or disclosure. No online service can guarantee absolute security. Access should be limited to authorised people and systems, and security incidents should be handled in accordance with applicable legal requirements.

11. Cookies and similar technologies

The website may use technologies required for functions such as authentication and session management. The actual cookies, analytics, advertising tools and other tracking technologies used by the website must be inspected and documented. Where consent is legally required for optional cookies or similar technologies, they must not be activated before valid consent is obtained.

12. Your data protection rights

Subject to the conditions and exceptions in applicable law, you may have the right to request access to your personal data, rectification, erasure, restriction of processing, data portability, or to object to certain processing. Where processing is based on consent, you may withdraw that consent.

To exercise a right, contact the controller using the contact details that must be provided in the final version of this policy. We may need to verify your identity before acting on a request. You also have the right to lodge a complaint with the competent data protection supervisory authority. For Portugal, the relevant authority is the Comissão Nacional de Proteção de Dados (CNPD), subject to its competence in the circumstances.

13. Children

ZecureCloud is intended for users legally able to enter into the relevant service agreement. The operator must confirm and publish any applicable minimum-age requirements and ensure that personal data relating to children is handled in accordance with applicable law.

14. Changes to this policy

This policy may need to be updated when the service, its providers, legal requirements or data practices change. The final policy should state its effective date and explain how material changes will be communicated where required by law.

15. Contact

For privacy enquiries, use the contact channel below as an initial point of contact. Before publication, the controller must provide a suitable formal contact method and any other information required by applicable law.

16. Related terms

This policy should be read together with the Terms of Service and any service-specific notices that apply to your order.