Legal & Compliance

1. Data Controller

The data controller responsible for your personal data is CloudCodeWorkshop, registered at Am Quarzsprung 15, 56203 Höhr-Grenzhausen, Germany. For any privacy-related inquiries, contact us at [email protected].

2. Data We Collect

We may collect the following categories of personal data when you interact with our website, book a demo, or engage our services:

• Contact Information: Name, email address, phone number, company name.
• Business Information: Job title, team size, security requirements, project scope.
• Technical Data: IP address, browser type, device information, pages visited (collected via essential cookies only).
• Payment Information: Billing details processed securely through our PCI-DSS compliant payment provider. We do not store credit card numbers on our servers.

3. Purpose of Processing

Your data is processed exclusively for the following purposes:

• Responding to your demo requests and security inquiries.
• Delivering contracted cybersecurity services and support.
• Sending service-related communications (e.g., project updates, security alerts).
• Complying with legal and tax obligations under German and EU law.
• Improving our website and service quality through anonymized analytics.

4. Legal Basis for Processing

We process your data under the following legal bases as defined in Article 6 of the GDPR:

• Consent (Art. 6(1)(a)): When you submit a contact form or subscribe to communications.
• Contract Performance (Art. 6(1)(b)): When processing is necessary to deliver our cybersecurity services.
• Legitimate Interest (Art. 6(1)(f)): For fraud prevention, security monitoring, and service improvement.

5. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected. Contact form submissions are retained for up to 24 months. Contract-related data is retained for the duration of the contract plus 10 years, as required by German tax law (AO §147).

6. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of Access (Art. 15): Request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete data.
• Right to Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten").
• Right to Restriction (Art. 18): Request limitation of processing in certain circumstances.
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to Object (Art. 21): Object to processing based on legitimate interests.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

7. Data Security

We implement industry-standard technical and organizational measures to protect your data, including TLS 1.3 encryption in transit, AES-256 encryption at rest, access controls, regular security audits, and SOC 2 Type II compliance procedures. In the event of a data breach, we will notify the relevant supervisory authority within 72 hours as required by Article 33 of the GDPR.

8. International Data Transfers

Your data is primarily stored on servers within the European Economic Area (EEA). If data is transferred outside the EEA (e.g., to our US-based cloud providers), we ensure adequate protection through Standard Contractual Clauses (SCCs) approved by the European Commission, in compliance with Chapter V of the GDPR.

9. Supervisory Authority

If you believe we have not handled your data in accordance with the GDPR, you have the right to lodge a complaint with the supervisory authority: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Postfach 3040, 55020 Mainz, Germany.

1. Agreement to Terms

By accessing our website or engaging CloudCodeWorkshop for cybersecurity services, you agree to be bound by these Terms of Service. If you do not agree, please do not use our services. These terms constitute a legally binding agreement between you (or your organization) and CloudCodeWorkshop, registered at Am Quarzsprung 15, 56203 Höhr-Grenzhausen, Germany.

2. Scope of Services

CloudCodeWorkshop provides cybersecurity consulting, threat detection, zero-trust architecture design, compliance automation, penetration testing, incident response, security awareness training, cloud security hardening, endpoint detection and response, and managed security operations center (SOC) services. The specific scope of services is defined in individual Statements of Work (SOW) or service agreements executed between the parties.

3. Payment Terms

All service fees are specified in the applicable SOW or invoice. Payments are due within 14 days of invoice date unless otherwise agreed. Late payments may incur a statutory interest rate of 9 percentage points above the ECB base rate. Retainer services (e.g., Managed SOC) are billed monthly in advance. All prices are in USD or EUR as specified.

4. Intellectual Property

Upon full payment, all intellectual property rights in deliverables created specifically for the client (including custom security configurations, reports, training materials, and documentation) are transferred to the client. CloudCodeWorkshop retains ownership of pre-existing tools, methodologies, and frameworks used in service delivery. Each party retains ownership of its respective confidential information.

5. Confidentiality

Both parties agree to maintain the confidentiality of all non-public information disclosed during the engagement. This includes vulnerability assessments, security configurations, incident reports, and business-sensitive data. Confidentiality obligations survive the termination of the agreement for a period of 3 years.

6. Limitation of Liability

CloudCodeWorkshop's total liability under any engagement shall not exceed the total fees paid by the client for the specific service giving rise to the claim. We are not liable for indirect, incidental, or consequential damages, including loss of profits, data, or business opportunities. This limitation does not apply to liability arising from willful misconduct or gross negligence.

7. Termination

Either party may terminate a service agreement with 30 days' written notice. Retainer services may be cancelled with 30 days' notice effective at the end of the current billing period. Termination does not relieve the client of obligations to pay for services already rendered. Sections on confidentiality, intellectual property, and limitation of liability survive termination.

8. Governing Law

These Terms of Service are governed by the laws of the Federal Republic of Germany. Any disputes arising from or related to these terms shall be submitted to the exclusive jurisdiction of the courts in Koblenz, Germany, unless otherwise required by applicable consumer protection law.

1. What Are Cookies

Cookies are small text files placed on your device when you visit our website. They help us recognize your browser, remember your preferences, and ensure our platform functions correctly.

2. Cookies We Use

• Strictly Necessary Cookies: These cookies are essential for basic website functionality (e.g., session management, security tokens, cookie consent persistence). They cannot be disabled.
• Functional Cookies: These remember your preferences (e.g., language, region) to provide a personalized experience. You may disable these, but some features may not function as intended.
• Analytics Cookies: We use privacy-respecting, anonymized analytics to understand how visitors interact with our website. This data is aggregated and does not identify individual users.

3. Third-Party Cookies

Our website may embed third-party content (e.g., Google Maps on our contact page) which may set their own cookies. We do not control these third-party cookies. Please refer to the respective third party's privacy policy for more information. We do not use advertising or tracking cookies.

4. Managing Cookies

You can manage or disable cookies through your browser settings at any time. Most browsers allow you to block all cookies or accept only essential cookies. Note that disabling cookies may affect website functionality. Our cookie consent banner allows you to accept or decline non-essential cookies before they are set.

5. Cookie Retention

Session cookies are deleted when you close your browser. Persistent cookies (including your cookie consent preference) remain on your device for up to 12 months or until you manually clear them.

1. General Policy

At CloudCodeWorkshop, we are committed to delivering high-quality cybersecurity services. If you are not satisfied with our services, we offer refunds under the conditions outlined below. All refund requests must be submitted in writing to [email protected].

2. One-Time Project Services

For one-time project services (e.g., threat detection setup, zero-trust architecture, penetration testing), you may request a full refund within 7 days of project commencement if no work has been initiated. If work has commenced, refunds will be calculated proportionally based on the percentage of work completed. No refund is available once the deliverable has been accepted by the client.

3. Retainer Services

Monthly retainer services (e.g., Managed SOC) may be cancelled with 30 days' written notice. The current billing period is non-refundable, but no further charges will be incurred after cancellation. Setup or onboarding fees are non-refundable once onboarding has begun.

4. Training Services

Security awareness training packages may be refunded in full if cancelled more than 7 days before the scheduled training date. Cancellations within 7 days are eligible for a 50% refund or rescheduling at no additional cost. Completed training sessions are non-refundable.

5. Refund Processing

Approved refunds will be processed within 14 business days using the original payment method. Currency conversion fees incurred during the refund process are the responsibility of the client. We will notify you by email once the refund has been processed.

6. Exceptions

Refunds are not available for: (a) services delivered in full and accepted by the client; (b) custom development work that has been deployed to production; (c) third-party software licenses or subscriptions procured on the client's behalf; (d) government-mandated fees or taxes. Disputes regarding refunds will be resolved in accordance with German consumer protection law.

1. Categories of Personal Information

Under the California Consumer Privacy Act (CCPA) as amended by the CPRA, we collect the following categories of personal information from California residents: Identifiers (name, email, phone), Commercial Information (service history, payment records), Internet Activity (browsing history on our site), and Professional Information (job title, company).

2. Your CCPA Rights

If you are a California resident, you have the right to:

• Know: Request disclosure of the categories and specific pieces of personal information we collect about you.
• Delete: Request deletion of your personal information, subject to certain exceptions.
• Opt-Out: Opt out of the sale or sharing of your personal information. We do not sell your personal information.
• Non-Discrimination: Not be discriminated against for exercising your CCPA rights.

3. Exercise Your Rights

To exercise your CCPA rights, contact us at [email protected] with the subject line "CCPA Request." We will verify your identity and respond within 45 days as required by law. You may also designate an authorized agent to make a request on your behalf.