GDPR Notice

This notice applies to individuals located in the European Economic Area (EEA), the United Kingdom (UK), and Switzerland who interact with the Cloudshipped Tech LLC website or services. It supplements our Privacy Policy and provides additional disclosures required by the EU General Data Protection Regulation (GDPR), the UK GDPR, and related data protection legislation.

Cloudshipped Tech LLC is a sole-member limited liability company based in California, United States. When we process personal data of individuals in the EEA, UK, or Switzerland for our own purposes (for example, when you visit the Site, contact us, or act as a contact for one of our clients), we act as a “data controller” as defined under the GDPR.

Personal data may also appear incidentally in client cloud account data we review during an engagement (for example, usernames or email addresses in resource tags). We process that data only on the client’s behalf and under our agreement with the client, as a “processor”; the client is the controller. Please direct requests about that data to the client.

The data controller responsible for your personal data is:

Cloudshipped Tech LLC
Location: California, United States
Email: legal@cloudshipped.co

As a small consultancy with no EU establishment, we are not required to appoint an EU or UK representative at this time. If our processing activities change in scope, we will revisit this position. For any data protection inquiries, contact us directly at the email above.

We process the following categories of personal data for individuals who contact us or visit our Site:

• Contact and identity data: name, email address, company name, and role (when provided voluntarily)
• Communication data: content of emails you send us and details you provide when booking a call through Calendly, such as your estimated AWS spend and notes about your needs
• Call recordings: audio, transcripts, and summaries of calls, only when you consent to AI note-taking
• Technical data: IP address, browser type, referring URL, pages visited (collected automatically by server infrastructure)
• Analytics data: pages viewed, time on the Site, referring site, approximate location (country, region, and city), browser, device type, screen size, language, and link clicks (collected by Umami Cloud without cookies)

We do not process special categories of personal data (such as health data, biometric data, racial or ethnic origin, political opinions, or religious beliefs) and do not intend to do so.

Under the GDPR, we are required to identify a lawful basis for each processing activity. We rely on the following bases:

• Legitimate interests (Article 6(1)(f)): Processing emails and call bookings to respond to inquiries and evaluate potential business engagements. Our legitimate interest is conducting business; this is balanced against your rights because we process only the minimum data necessary and you initiated the contact.
• Legitimate interests (Article 6(1)(f)): Measuring Site usage with cookieless analytics to understand which content is useful and which links visitors use. This is balanced against your rights because the analytics do not use cookies, do not identify you by name or email, and do not track you across other websites.
• Contractual necessity (Article 6(1)(b)): Processing data necessary to perform obligations under a consulting engagement agreement, if you become a client.
• Legal obligation (Article 6(1)(c)): Retaining records as required under applicable U.S. law (e.g., tax and accounting obligations).
• Consent (Article 6(1)(a)): Recording, transcribing, and summarizing calls with an AI note-taking tool, which we do only if you consent when booking. If you decline, the call is not recorded. You may withdraw consent at any time, including during a call, and we will stop recording. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

We do not engage in automated decision-making or profiling that produces legal or similarly significant effects on data subjects. All decisions related to potential engagements are made by a human.

Cloudshipped Tech LLC is based in the United States, which the European Commission has not recognized as providing an adequate level of data protection equivalent to the EEA. If you submit personal data to us from the EEA, UK, or Switzerland, your data will be transferred to and processed in the United States.

We rely on the following safeguards for such transfers:

• Standard Contractual Clauses (SCCs) adopted by the European Commission, as included in our providers' data processing terms, where applicable
• The UK International Data Transfer Addendum or Agreement, as included in our providers' data processing terms, where required for UK data subjects
• Where no other safeguard applies, transfers necessary to take steps you request before entering into a contract with us, such as responding to your inquiry or holding a discovery call, or to perform that contract (GDPR Article 49(1)(b))

For further information on international transfer safeguards, please contact us at legal@cloudshipped.co.

We retain personal data only for as long as necessary for the purposes described in this notice and our Privacy Policy, or as required by applicable law:

• Inquiry data (emails and call bookings): for as long as reasonably needed to respond, follow up, and maintain our business relationship, and deleted on request unless we must keep it for legal reasons or it becomes part of a client engagement record
• Call recordings and transcripts: only as long as needed to follow up on your inquiry or perform an engagement, and deleted on request unless they become part of a client engagement record
• Client working data (cost and usage exports, log extracts, and query results): deleted from the systems we control within 10 days after the engagement's follow-up question period ends, or when a follow-on engagement ends, and earlier on request
• Client engagement records (agreements, deliverables, correspondence, invoices, and the workpapers supporting our findings): 7 years from the end of the engagement to satisfy legal and accounting obligations, then deleted from the systems we control
• Server logs: retained by our hosting provider according to its retention settings, and used only for security and operational purposes

After these periods, data is securely deleted or anonymized so it can no longer be attributed to an individual.

Under the GDPR (and UK GDPR), you have the following rights with respect to your personal data:

• Right of access (Article 15): You may request a copy of the personal data we hold about you and information about how it is processed.
• Right to rectification (Article 16): You may request correction of inaccurate or incomplete personal data.
• Right to erasure (Article 17): You may request deletion of your personal data where it is no longer necessary for the purpose it was collected, you withdraw consent, or you object and we have no overriding legitimate grounds.
• Right to restriction of processing (Article 18): You may request that we restrict processing of your data in certain circumstances, such as while a dispute is being resolved.
• Right to data portability (Article 20): Where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, commonly used, machine-readable format.
• Right to object (Article 21): You may object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests or the processing is necessary for legal claims.
• Right not to be subject to automated decision-making (Article 22): As noted above, we do not engage in automated decision-making with legal effects.

To exercise any of these rights, submit a request to legal@cloudshipped.co. We will respond within a reasonable time, and within any period required by applicable law. We may ask you to verify your identity before processing your request. We will not charge a fee for exercising your rights unless requests are manifestly unfounded or excessive.

If you believe we have processed your personal data in violation of applicable data protection law, you have the right to lodge a complaint with your local supervisory authority. Supervisory authorities include:

• European Economic Area: the data protection authority in your EU member state (e.g., CNIL in France, BfDI in Germany, DPC in Ireland)
• United Kingdom: the Information Commissioner's Office (ICO) — ico.org.uk
• Switzerland: the Federal Data Protection and Information Commissioner (FDPIC) — edoeb.admin.ch

We encourage you to contact us first at legal@cloudshipped.co so we have an opportunity to resolve your concern directly.

The Site does not use advertising pixels, cross-site tracking, or non-essential cookies. For aggregate analytics we use Umami Cloud, which does not set cookies or store identifiers on your device and does not track you across sites. Only strictly necessary cookies or session data required for the Site to function may be set.

If we introduce other analytics or optional cookies in the future, we will update this notice, display a cookie consent banner to EEA/UK visitors, and obtain consent before setting any non-essential cookies, in accordance with the ePrivacy Directive and applicable national implementing laws.

We may engage the following categories of sub-processors who may have access to personal data in connection with providing their services to us:

• Hosting and infrastructure providers (web hosting, CDN) — process server logs and serve Site content
• Scheduling tools (e.g., Calendly) — process contact information when you book a call
• AI note-taking tools — record, transcribe, and summarize calls when participants consent
• Customer relationship management (e.g., HubSpot) — store contact details and inquiry history
• Analytics providers (Umami Cloud) — process cookieless usage data that does not identify you by name or email
• Email service providers — process message content when we correspond with you
• Software tools, including AI assistants — may process client engagement information to help with analysis, only under terms or settings under which the provider does not use it to train its models
• Document storage and productivity tools (e.g., Google Workspace) — store correspondence and client engagement records
• Invoicing and payment providers — process billing contact and payment details for clients
• Cloud infrastructure providers (e.g., Amazon Web Services) — store working data during client engagements

We choose providers whose terms include data processing and security commitments, and we rely on those terms when they process personal data for us.

We may update this GDPR Notice to reflect changes in our data practices or applicable law. When we make material changes, we will update the “Last updated” date and provide notice on the Site. We encourage you to review this notice periodically.

For any questions, concerns, or requests relating to this GDPR Notice or our data protection practices, contact us:

Cloudshipped Tech LLC
Email: legal@cloudshipped.co
Location: California, United States