How Luceris Cloud complies with GDPR

This page describes how Luceris Cloud operates under the EU General Data Protection Regulation (GDPR). It complements our Privacy Policy (the formal Art 13/14 notice) with a more practical view: who we are, what rights you have, how to exercise them, and who else processes your data on our behalf.

For account and billing data we are the controller — we decide why and how we process it. For the content you store in the databases you create on Luceris Cloud we are the processor — that data is yours, and we only handle it as instructed by your use of the Service.

This distinction matters when you exercise rights: requests about your account data come to us; requests about data inside your databases generally need to be initiated by you against your own users.

• Access (Art 15) — request a copy of the personal data we hold.
• Rectification (Art 16) — correct inaccurate data.
• Erasure (Art 17) — request deletion subject to legal retention.
• Restriction (Art 18) — limit our processing temporarily.
• Portability (Art 20) — receive your data in a structured, machine-readable format.
• Object (Art 21) — object to processing based on legitimate interest.
• Withdraw consent (Art 7(3)) — for any processing based on consent.
• Lodge a complaint (Art 77) — with the CNIL (www.cnil.fr).

Or email us directly at [email protected].

Our Data Protection Officer is the point of contact for any privacy question. They can be reached at [email protected].

We use a small set of sub-processors to operate the Service. The current list:

All customer personal data is hosted in the European Union — France is the primary region, with replicas in Germany. We do not transfer customer personal data outside the EU. No Article 44–49 GDPR transfer mechanisms apply because no transfers occur.

• Contract (Art 6(1)(b)) — account, provisioning, billing.
• Legitimate interest (Art 6(1)(f)) — security, fraud detection, abuse prevention.
• Legal obligation (Art 6(1)(c)) — invoice retention (10 years, French Commercial Code).
• Consent (Art 6(1)(a)) — any future analytics / marketing cookies, opt-in only.

Where a security incident materially affects personal data, we notify the CNIL within 72 hours of becoming aware, as required by Article 33 GDPR. We notify affected users directly in line with Article 34 when required.

When our practices change — or when we add or remove a sub-processor — we update this page and bump the “Last updated” date. Customers on the Contact-us tier are notified directly of sub-processor changes.

• Privacy Policy — the formal Art 13/14 notice.
• Cookie Policy — what we store in your browser.
• Security policy — how we protect your data.
• Terms of Service — the contract governing use of the Service.