rbox/static/legal/privacy_policy.md

# Privacy Policy

**Last Updated:** November 13, 2025


MyWebdav Technologies ("we," "us," or "our") operates the MyWebdav cloud storage service (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service, in compliance with the EU General Data Protection Regulation (GDPR) and other applicable data protection laws.

## 1. Information We Collect

### 1.1 Personal Data You Provide
When you register for an account or use our Service, we collect:
- Name and contact information (email address, phone number)
- Account credentials and security information
- Billing and payment information (if applicable)
- Communications you send to us
- Files and data you upload to our Service

### 1.2 Information Collected Automatically
We automatically collect:
- IP address and geolocation data
- Browser and device information
- Usage data (pages visited, features used, timestamps)
- Log data (access times, errors, performance metrics)

### 1.3 Cookies and Tracking Technologies
We use cookies and similar technologies to:
- Authenticate users and maintain sessions
- Remember user preferences
- Analyze service usage and performance
- Provide personalized features

You can control cookie settings through your browser, but disabling cookies may limit Service functionality.

## 2. Legal Basis for Processing

We process your personal data based on:
- **Consent:** Where you have explicitly agreed
- **Contract:** To provide the Service and fulfill our obligations
- **Legitimate Interest:** To improve our Service and ensure security
- **Legal Obligation:** To comply with applicable laws

## 3. How We Use Your Information

We use collected information to:
- Provide, maintain, and improve the Service
- Process transactions and manage billing
- Communicate with you about your account and the Service
- Ensure security and prevent fraud
- Comply with legal obligations
- Analyze usage patterns and improve user experience

## 4. Information Sharing and Disclosure

We do not sell your personal data. We may share information:
- With service providers under data processing agreements
- When required by law or to protect rights
- In connection with business transfers (with notice)
- With your explicit consent

All data transfers outside the EU comply with GDPR requirements, including adequacy decisions or appropriate safeguards.

## 5. Data Security

We implement comprehensive security measures:
- Encryption of data in transit (TLS 1.3) and at rest (AES-256)
- Access controls and authentication mechanisms
- Regular security audits and penetration testing
- Incident response procedures

## 6. Data Retention

We retain personal data only as long as necessary for the purposes outlined in this policy, typically:
- Account data: Until account deletion
- Usage logs: 12 months for security and compliance
- Billing data: 7 years for tax compliance

## 7. Your Rights Under GDPR

You have the right to:
- **Access:** Request a copy of your personal data
- **Rectification:** Correct inaccurate or incomplete data
- **Erasure:** Delete your personal data ("right to be forgotten")
- **Restriction:** Limit processing of your data
- **Portability:** Receive your data in a structured format
- **Objection:** Object to processing based on legitimate interests
- **Withdraw Consent:** Revoke consent for processing

To exercise these rights, contact our Data Protection Officer at dpo@mywebdav.eu.

## 8. International Data Transfers

Your data may be processed in countries outside the EU. We ensure adequate protection through:
- EU adequacy decisions
- Standard Contractual Clauses
- Binding Corporate Rules
- Your explicit consent where required

## 9. Children's Privacy

Our Service is not intended for individuals under 16. We do not knowingly collect personal data from children under 16. If we become aware of such collection, we will delete the data immediately.

## 10. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you of material changes via email or Service notifications at least 30 days before they take effect.

## 11. Data Protection Officer

For data protection matters, contact our DPO:
- **Email:** dpo@mywebdav.eu
- **Phone:** +31 XX XXX XXXX

## Contact Information

If you have any questions about this privacy policy, please contact us:

- **Email:** [legal@mywebdav.eu](mailto:legal@mywebdav.eu)
- **Website:** https://mywebdav.eu
- **Address:** MyWebdav Technologies, European Union

MyWebdav Technologies