Privacy notice
Last updated October 20, 2026
For the website and web application at myrecloud.eu, including its subdomains.
This notice explains which personal data we process when you visit our website, contact us or use myrecloud. myrecloud is intended for businesses and self-employed professionals in the EU, and the European Economic Area.
1. Controller and data protection contact
NOVATRAX HOLDING OÜ
Pärnu mnt. 139b-14
11317 Tallinn
Estonia
Email: support@myrecloud.eu
For questions about data protection or to exercise your rights, please contact us at the email address above.
2. Our different data protection roles
NOVATRAX HOLDING OÜ acts as controller for operating our website, managing our business relationships, billing myrecloud subscriptions and handling enquiries addressed to us.
Where a repair business uses myrecloud to manage the data of its customers, staff or suppliers, we generally process those contents as a processor on the instructions of that business. The business is the controller for those data. If the business itself acts as a processor, we act as its sub-processor. Details are governed by the Data Processing Agreement, or DPA, concluded with the business.
When you make an online booking or access a repair status page, the relevant repair business is therefore responsible for handling the substance of your booking or repair order. This notice does not replace that business’s own privacy information. If we receive a request relating to data processed on its behalf, we forward it to that business.
3. Legal bases
The principal framework is the European General Data Protection Regulation, Regulation (EU) 2016/679, referred to as the GDPR and known in German as the DSGVO. Applicable national provisions, in particular Estonian data protection law, supplement it. Mandatory provisions of other countries remain unaffected.
Where we act as controller, we process data to take steps towards and perform contracts with individuals under Article 6(1)(b) GDPR, to comply with legal obligations under Article 6(1)(c), and to pursue legitimate interests under Article 6(1)(f). For contacts and employees of our business customers, our legitimate interests include managing the business relationship and enabling authorised persons to use the service. The relevant purposes are explained below.
4. Website and technical operation
When you access our website and web application, technically necessary connection data are processed. These include, in particular, your IP address, the date and time, the address requested, technical information about your browser and operating system, and status and error messages. We use these data to deliver our pages, operate the service securely, and detect and investigate disruptions and misuse.
Server and access logs, as well as login and security logs, are retained for 30 days. The legal basis for operating and securing our own services is Article 6(1)(f) GDPR. Our legitimate interest is to provide a secure and reliable service.
Our website, application, databases, backups and email mailbox are hosted with Hetzner Finland Oy in data centres in Helsinki, Finland. Error and availability monitoring also run on our own systems at Hetzner. Provider information: https://www.hetzner.com/de/legal/privacy-policy/
6. Visitor statistics using Umami
We use Umami to analyse page views and general usage statistics. We host Umami ourselves at Hetzner in Helsinki, Finland. We do not send user IDs, email addresses or deliberately entered personal details to Umami. We do not use Umami Cloud. Statistics are retained for twelve months.
The purpose is to understand how our service is used and improve its content and functionality. To the extent that personal data are processed, we rely on Article 6(1)(f) GDPR and our interest in analysing our own service in a data-minimising manner.
7. Registration and account management
On registration, we collect your name, email address, password, company name, business address, telephone number, and VAT ID or commercial registration number. Users supply these details themselves. We do not supplement them from public sources or contact databases. Users sign in with an email address and password; Google and Microsoft sign-in are not provided.
We process these data to manage the business and its authorised users, provide access, administer the contract and send necessary communications. Passwords are stored as salted hashes. Where the user is personally a party to the contract, Article 6(1)(b) GDPR applies. For a business’s contacts and users, Article 6(1)(f) GDPR applies. We process information required by law under Article 6(1)(c) GDPR.
Information marked as required is needed for registration and service provision. Without it, registration or provision of the relevant service cannot be completed. No payment details are required for the free trial.
To protect registration against automated sign-ups, the registration form uses Cloudflare Turnstile, provided by Cloudflare, Inc., San Francisco, USA. When the form is displayed, Turnstile processes technical data about your browser and device, your IP address and signals of how the page is used, and checks them in order to distinguish people from automated programs. It does not set advertising cookies. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is to keep the service free of automated and fraudulent accounts. Data may be transferred to the USA on the basis of the EU-US Data Privacy Framework and Standard Contractual Clauses. Provider information: https://www.cloudflare.com/turnstile-privacy-policy/
8. Subscriptions and payments through Stripe
We use Stripe Payments Europe, Limited, Dublin, Ireland, for payments for myrecloud subscriptions. Payment details are entered on a payment page provided by Stripe (Stripe Checkout); you manage your subscription and payment method in Stripe’s customer portal. Stripe Tax calculates the applicable VAT from the billing address and VAT ID. We do not store full card or bank account details on our servers.
Contract, contact, billing and transaction data necessary to identify and process the payment are processed for this purpose. Stripe also processes technical data generated when its payment interface is used. The legal bases for our processing are Article 6(1)(b) GDPR, Article 6(1)(f) for business contacts, and Article 6(1)(c) for statutory accounting and record-keeping obligations.
Depending on the activity, Stripe acts as a processor or an independent controller, for example in fulfilling its own legal obligations. Information about the relevant Stripe entities, their processing and international transfers is available at https://stripe.com/privacy and https://stripe.com/legal/privacy-center.
9. Enquiries and system messages
You can contact us by email or through the contact form. We process the contact details you provide, your message and the technical information required to handle it. Enquiries are handled in our email mailbox at Hetzner. The purpose is to answer your enquiry and, where relevant, establish or administer a business relationship.
The legal basis is Article 6(1)(b) GDPR for enquiries relating to a contract with you or steps prior to such a contract; otherwise, it is Article 6(1)(f) and our interest in handling enquiries. We delete completed enquiries three months after closure unless statutory retention requirements or the need to pursue legal claims prevent this. Contract-related records are subject to the rules in section 13.
We use Brevo (Sendinblue SAS, Paris, France) for system emails, such as registration confirmations, password resets and necessary notifications. This involves processing the email address, message content and technical data necessary for sending and delivery. Open and click tracking are disabled for these messages. Brevo keeps the email contents and the sending and delivery logs for 30 days. We do not send newsletters or advertising emails.
Where messages concern our own contractual relationship, the legal bases described in section 7 apply. Where messages are sent to a repair business’s customers on its behalf, processing takes place on its instructions under the DPA. Provider information: https://www.brevo.com/legal/privacypolicy/
10. Processing repair businesses’ contents
Where repair businesses use myrecloud to manage the data of their customers, staff or suppliers, we act as a processor on their behalf; the businesses are the controllers. We process these data only on their documented instructions. Details are set out in the Data Processing Agreement (DPA) concluded with each business.
11. Integrations activated by the customer
Repair businesses can connect external services using their own accounts. Activating and using an integration constitutes an instruction to transmit the data necessary for it. The business is responsible for selecting the service, using it lawfully and entering into the required agreements. The selected provider’s notices contain further information about recipients and their processing.
Our sub-processors are listed in the annex to the DPA.
12. Recipients and international transfers
Within myrecloud, access is restricted to people who need it for their duties. Maintenance and support access is provided by our internal team from the EU or EEA. Customer data are accessed only to the extent necessary for operation, maintenance or requested support; authorised people are bound by confidentiality obligations.
External recipients include, in particular, Hetzner, Brevo and Stripe to the extent described, as well as services activated by the customer. Where providers act as processors, processing must be governed by a contract under Article 28 GDPR. Data may also be disclosed to competent authorities where a legal obligation requires it.
Our systems and backups hosted with Hetzner are located in Helsinki, Finland. This is not a guarantee that all processing by external providers takes place exclusively there. Stripe and integrations selected by customers, in particular, may involve international transfers.
Where we are responsible for transfers to countries outside the EU or EEA, the requirements of Articles 44 onwards GDPR must be met. The basis may be an adequacy decision or another appropriate safeguard, in particular EU Standard Contractual Clauses with any necessary supplementary measures. The EU-US Data Privacy Framework may be relied upon only for covered and appropriately certified US recipients. Information about the safeguards applicable in a particular case and a copy of them are available on request at support@myrecloud.eu.
13. Retention and deletion
We retain our own account and contract data for as long as necessary for the business relationship. We then delete them unless statutory retention obligations or the establishment, exercise or defence of legal claims require further retention. Data subject to statutory retention are restricted to the necessary purposes.
Under section 12(1) of the Estonian Accounting Act, our own accounting source documents are generally retained for seven years from the end of the financial year in which the transaction was recorded. Other documents necessary to reconstruct business transactions are subject to the retention obligations set out in that Act.
For contents processed on behalf of repair businesses, the business generally determines deletion during the contract term. Following termination, data remain available for export for 30 days. Personal data are then deleted unless a statutory obligation requires further retention. Related backups expire no later than a further 30 days afterwards. The same applies after a free trial ends if no paid subscription is taken out.
Backups are retained on a rolling basis for 30 days. Technical logs and Brevo’s email sending logs are retained for 30 days, Umami statistics for twelve months, and our own completed enquiries generally for three months. Order history is deleted with the relevant order.
14. Data security
We protect personal data with appropriate technical and organisational measures under Article 32 GDPR.
15. Your rights
Where the relevant legal conditions are met, the GDPR gives you the right to access your personal data and obtain a copy under Article 15, to rectification under Article 16, to erasure under Article 17, to restriction of processing under Article 18 and to data portability under Article 20.
Where processing is based on your consent, you may withdraw it at any time with effect for the future. Withdrawal does not affect the lawfulness of processing before withdrawal. To exercise your rights, contact support@myrecloud.eu. We may request information necessary to verify your identity.
Your right to object
You may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation. We will then stop processing the data concerned unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You may object to processing for direct marketing at any time without giving particular grounds.
Right to complain
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement. The supervisory authority responsible for us is the Estonian Data Protection Inspectorate, Tallinn, Estonia.
If your request concerns data managed by a repair business in myrecloud, please contact that business as controller. We support it in handling your request under our DPA.
16. Changes to this privacy notice
We update this notice when our processing or legal requirements change. The current version is available on our website.