Privacy notice

Summary

You can change your choice at any time.
We process personal data when you use our contact form,email us, book a call with us, or become a customer, and only to answer you, provide our services and support, and meet our legal obligations.
We do not sell personal data or use it for advertising.
Cloud Certainty Secure Browser runs in the customer's own AWS account and sends no customer data to us.

Who we are

The controller of the personal data described here is Cloud Certainty OÜ, a company registered in Estonia, Sepapaja tn 6, 15551 Tallinn, Harju maakond, Estonia (“Cloud Certainty”, “we”). For anything about this notice or your data, email [email protected].

Visiting this website

cloudcertainty.com is a static website with no user accounts. What it measures, and the cookies it sets with your consent, are described under Cookies and analytics.

Server logs. Like any web server, ours records technical data about each request: IP address, date and time, the page requested, the response, the referring page and your browser's user-agent string. We use these logs only to operate and secure the site, for example to investigate errors and abuse, and delete them on a rolling basis.
Fonts. The site loads its typefaces from Google Fonts. Your browser therefore connects to Google's servers (fonts.googleapis.com and fonts.gstatic.com), which receive your IP address and browser details. Google describes its handling in the Google Fonts privacy FAQ(opens in a new tab).
Links to other sites. Links to AWS Marketplace and other sites take you to services with their own privacy policies.

Cookies and analytics

Your consent choice. The consent banner is provided by Cookiebot (Usercentrics). It stores your choice in a cookie so we don't ask again, and records the consent so we can show it was given. .

Contact form

When you send our contact form, we receive what you enter: your name, email address and message and, if you fill them in, your company, role, website and the details of your project brief. The form is delivered to our mailbox as an email through Amazon Simple Email Service (AWS, EU (Frankfurt) Region), and we handle it like any other email: to reply and to deal with your request. We also send you one short email confirming that your message arrived; it does not repeat what you wrote. To stop automated spam, the server also briefly keeps your IP address in memory to limit how many messages one address can send; it is not stored. The form is protected by Cloudflare Turnstile, which checks that a person is sending it. Turnstile processes your IP address and browser signals for that purpose, under Cloudflare's Turnstile privacy policy(opens in a new tab).

Emailing us

When you email us, we receive your name, email address, the content of your message and anything you attach. We use it to reply and to handle your request. Our email is hosted by Microsoft (Microsoft 365).

Booking a call

If you book a meeting with us through our scheduling page (cal.cloudcertainty.com), we receive the name, email address, time and any notes you enter. The scheduling system is operated by us; booking confirmations and reminders are sent through Amazon Simple Email Service (AWS, EU (Frankfurt) Region). Video calls take place on the service named in the invitation, under its own privacy terms.

Customers and support

When you buy from us or ask for support, we process:

Contact details of the people we work with: names, business email addresses, phone numbers and job roles;
Support communications: the content of support cases, emails and calls, including technical information you choose to share, such as AWS account IDs, AWS Regions, product versions, error messages and logs. Please don't send us personal data of your users unless we need it to solve the problem;
AWS Marketplace information. When you subscribe to one of our products on AWS Marketplace, AWS provides us, as the seller, with information about the subscription: for example the subscribing AWS account ID, the offer and usage quantities, and billing and payment status, and in some reports company and contact details;
Contract and billing records for consulting and support engagements.

We use this information to provide and invoice our services and support, to tell you about security issues and important changes that affect products you use, and to meet legal obligations such as accounting.

Cloud Certainty Secure Browser

Cloud Certainty Secure Browser is deployed by the customer into the customer's own AWS account and runs entirely there. Users, sign-in, browsing sessions, settings, audit records and logs stay in that account. The product sends no customer data to Cloud Certainty, and we have no access to customer deployments.

Billing. Usage is metered by AWS Marketplace. AWS tells us how many session-hours each subscribing AWS account used; it does not tell us who used them or what they browsed.
Update check. If the customer leaves update checks on, the deployment downloads a public file listing the latest release from our download location once a day. The request contains no account, stack or user information. Like any web request, it reveals only a source IP address from AWS's own address ranges and the installed product version. Customers can turn this off.

The customer is the controller of any personal data its deployment processes. Because the product runs in the customer's account and we have no access to it, we are not a processor of that data. If a customer shares data with us in a support case, the section above applies.

Legal bases

Under the EU General Data Protection Regulation (GDPR), we rely on:

Contract (Art. 6(1)(b)) to provide services, support and billing to customers, and to take steps you ask for before a contract;
Legal obligation (Art. 6(1)(c)) to keep accounting and tax records;
Legitimate interests (Art. 6(1)(f)) to answer enquiries, keep the website and our systems secure, and tell customers about security issues in products they use. You can object to processing based on legitimate interests at any time.

We share personal data only with service providers that help us run our business, under contracts that require them to protect it and use it only on our instructions where they act as our processors:

Amazon Web Services: email delivery for bookingsand the contact form, AWS Marketplace and infrastructure;
Microsoft: email (Microsoft 365);
Google: web fonts loaded by this site;
Usercentrics (Cookiebot): the consent banner and consent records;
Cloudflare: domain name (DNS) services, and spam protection on the contact form;
our hosting, accounting and banking providers, to the extent needed.

We may also disclose data where the law requires it, or to protect our rights. We do not sell personal data.

Transfers outside the EEA

Some of these providers are based in, or may process data in, countries outside the European Economic Area, including the United States. Where they do, we rely on an adequacy decision (such as the EU–US Data Privacy Framework, for certified companies) or on the European Commission's Standard Contractual Clauses.

How long we keep data

Website server logs: a short period for security and troubleshooting, then deleted.
Cookies: each cookie's lifetime is listed in the cookie declaration under Cookies and analytics.
Enquiries and booking details that don't lead to work: up to two years after our last contact.
Customer, contract and support records: for the duration of the relationship and as long afterwards as needed for legal claims.
Accounting records: seven years, as required by the Estonian Accounting Act.

Your rights

You have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format. To use any of these rights, email [email protected]. We will answer within one month.

You can also complain to a data protection authority. In Estonia that is the Data Protection Inspectorate (Andmekaitse Inspektsioon), www.aki.ee(opens in a new tab). You may also contact the authority where you live or work.

Changes

We will update this notice when our practices change, and change the date at the top. Significant changes that affect customers will also be communicated directly.