Privacy policy

Personal data is processed by VEXCLOUD, a French non-profit association (loi 1901), 2 rue de la Monnaie, 45110 Châteauneuf-sur-Loire, France, SIREN 918 897 703.

For any question about your data: [email protected].

We only collect the data needed to manage your account and services in our client area (WHMCS software):

• Identity and contact details: first and last name, company name where applicable, email address, phone number, postal address.
• Account: login credentials. The password is stored encrypted.
• Orders and billing: subscribed services, invoices, payment history. Card details are entered and processed directly by Stripe or PayPal: VexCloud has no access to them and does not store them.
• Support: content of tickets, emails and exchanges with the team.
• Technical data: IP addresses used to connect to the client area and services, technical logs needed for security.
• Student offers: proof of student status (photo of the card) sent to benefit from the offer.

The data you store yourself on your services (websites, files, databases) is processed on your behalf: VexCloud then acts as a processor within the meaning of Article 28 of the GDPR.

• Performance of the contract: creating and managing the account, providing services, billing, support, checking student status for the relevant offers.
• Legal obligations: accounting, keeping invoices, data retention required of hosting providers.
• Legitimate interest: service security, prevention of fraud and cyber attacks.

Your data is never sold or used for advertising.

Your data is only accessible to authorised members of the VexCloud team and to the following providers, to the extent needed for their task:

• WHMCS: customer, order and billing management software, published by WHMCS Limited and installed on our servers.
• Stripe and PayPal: online payment. They process payment data under their own privacy policies.
• Cloudflare: website delivery and network protection. It processes visitors' IP addresses in particular.
• Better Stack: service monitoring and public status page (status.vexcloud.fr). When you view service status on our website, your browser queries Better Stack, which receives your IP address.

Data may also be disclosed to authorities upon legal request.

Some of these providers may process data outside the European Union, in particular in the United States. These transfers are covered by the safeguards provided by the GDPR: an adequacy decision (EU-US Data Privacy Framework) or the European Commission's standard contractual clauses.

• Account data and support exchanges: for the whole duration of the contractual relationship, then for as long as needed to meet our legal obligations and handle any disputes.
• Invoices and accounting records: 10 years, in accordance with Article L123-22 of the French Commercial Code.
• Identification and connection data: for the periods required of hosting providers by French decree no. 2021-1362 of 20 October 2021.
• Proof of student status: for as long as needed to check and maintain the student offer.

We implement appropriate measures to protect your data: encrypted connections (HTTPS), encrypted password storage, access restricted to authorised people only, DDoS protection of the infrastructure.

On vexcloud.fr, we use no advertising or audience measurement cookies. The website only stores:

• your light or dark theme choice ("vexcloud-theme" cookie, valid for 1 year, shared with the client area);
• the dismissal of the offers banner, for the duration of your visit;
• security cookies set by Cloudflare to protect the website.

In the client area (my.vexcloud.fr), session cookies are needed for login and the shopping cart.

These items are strictly necessary for the website to work or store a preference you chose: they do not require your prior consent.

Under the GDPR, you have the right to access, rectify and erase your data, to restrict its processing, to data portability and to object. You can exercise these rights by email at [email protected] or through a ticket in the client area. We reply within one month.

Some data cannot be erased while a legal obligation requires us to keep it (invoices in particular).

If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

This policy may be updated to reflect changes to our services or regulations. The date of the last update is shown at the top of this page. See also the legal notice and the terms of sale.