On this page
1. Who we are and what this policy covers
In short: we collect only what we need to answer you, provide our services and keep them secure. We use no analytics, advertising or tracking cookies, and we do not sell personal data.
This policy applies when you visit flexdedi.com, contact us, request a quote, report abuse, or use our services as a customer. "FlexDedi", "we" and "us" mean the FlexDedi entity responsible for your data. For customers, that is the FlexDedi entity identified on your order confirmation and invoices, which acts as the controller of your personal data. If you are not a customer and want to know which entity handles your data, reply to the last message we sent you.
This policy does not cover data that customers store or process on their own servers. Customers decide how that data is used and are responsible for it, and we do not access it except as described in our Terms of Service.
2. Data we collect
Forms. Our order-request, quote-request and abuse forms ask for your name, email address, company and message. Order and quote requests also include the configuration you chose, such as the server, location and operating system. Abuse reports may include details of the activity reported, such as IP addresses, timestamps, log excerpts and links.
Client area. When you create an account, we store your name, email address and company if you give one, a hash of your password, hashes of your recovery codes, your last sign-in time, the servers attached to your account and your support tickets. The client area uses one strictly necessary session cookie, described in our Cookie Policy.
Technical data. When you visit our website, our web servers and security systems log your IP address, browser user agent, the page requested and the time of the request. We use these logs to deliver the site, protect it from attacks and diagnose problems.
Account and billing data. When you open a customer account, we collect what we need to run it: your name, email address, company, billing address, tax identification number where relevant, the services you order, invoices and payment history, support conversations, and security records such as sign-in times and IP addresses. When you pay online, you enter your payment details with our payment processor, and we receive only what we need to record the payment, such as its amount, date and status.
Network data. To route traffic, filter attacks and keep the network secure, our network and DDoS protection systems process technical data about traffic to and from customer servers, such as IP addresses, ports and traffic volumes.
What we do not collect. We do not use analytics, advertising or tracking cookies, and our website loads no third-party scripts or fonts. We do not buy personal data, and we do not ask for sensitive data such as health information.
3. How we use data and our legal bases
Under the EU General Data Protection Regulation and the UK GDPR (together, the "GDPR"), we need a legal basis for each use of personal data:
| Purpose | Legal basis under the GDPR |
|---|---|
| Answering order, quote and fleet requests | Steps taken at your request before a contract, or our legitimate interest in answering inquiries |
| Delivering servers, providing support and sending service notices | Performance of our contract with you |
| Invoicing, accounting and tax | Legal obligation |
| Securing our website and network, preventing fraud and handling abuse reports | Legitimate interest in keeping our services, our customers and the wider internet safe |
| Answering lawful requests from authorities and defending legal claims | Legal obligation or legitimate interest |
| Anything we ask you to opt in to | Consent, which you can withdraw at any time |
When we rely on legitimate interest, we have balanced it against your rights, and you can object as described in section 8. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
4. Cookies
Our website sets no cookies of its own while you browse. Cloudflare, which delivers and protects the site, may set strictly necessary security cookies to tell people from bots. Our Cookie Policy lists them and explains how to control them.
5. Who we share data with
We share personal data only with the following recipients, and only as far as needed:
- Cloudflare, which provides our content delivery network, DNS, DDoS protection and TLS encryption, and processes requests to our website on our behalf
- Infrastructure providers that host and operate our systems, such as data center and hosting providers
- Payment processors, when you pay online, to process payments and prevent fraud
- Professional advisers, such as accountants, auditors and lawyers, who are bound by confidentiality
- Authorities, when the law requires it, as described in our Acceptable Use Policy
- A buyer or successor, if all or part of our business is sold or merged, under the same protections
Our processors may use personal data only on our instructions and must keep it secure. Payment processors may also act as independent controllers for fraud prevention and their own legal obligations, under their own privacy policies.
When you report abuse, we may forward the content of your report to the customer concerned so they can act on it. If you do not want your contact details passed on, say so in your report.
6. International transfers
FlexDedi operates in North America, Europe and Asia-Pacific, and Cloudflare delivers our website from a global network. Your personal data may therefore be processed outside your country, including in countries whose data protection laws differ from yours.
When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we use safeguards recognized by law. These include the European Commission's Standard Contractual Clauses, with the UK Addendum where relevant, and frameworks such as the EU-U.S. Data Privacy Framework where the recipient is certified. You can ask for details of these safeguards through the channels in section 8.
7. How long we keep data
We keep personal data only as long as we need it:
| Data | How long we keep it |
|---|---|
| Order, quote and fleet requests | Up to 24 months after our last exchange, unless they become part of a customer account |
| Abuse reports | Up to 24 months after the case is closed |
| Web server logs | Up to 30 days |
| Security and network logs | Up to 90 days |
| Account data and support conversations | While your account is open, then up to 24 months after it closes |
| Invoices and billing records | As long as tax and accounting laws require, often 6 to 10 years |
We may keep data longer when the law requires it or to establish or defend a legal claim. At the end of the retention period, we delete or anonymize it.
8. Your rights
Under the GDPR and similar laws, you have the following rights:
- Access: get a copy of the personal data we hold about you
- Rectification: correct data that is inaccurate or incomplete
- Erasure: have your data deleted when there is no longer a valid reason to keep it
- Restriction: limit how we use your data, for example while we check a disputed fact
- Portability: receive data you gave us in a structured, machine-readable format
- Objection: object to processing based on legitimate interest, and to direct marketing at any time
- Withdrawal of consent: withdraw consent at any time where we rely on it, without affecting earlier processing
To exercise a right, open a support ticket from the client area if you have an active server. Otherwise, reply to the last message we sent you, such as a quote or an invoice. You can also delete an account that has no servers yourself, at any time, from the client area. We may ask for information to confirm your identity. We answer within one month, which can be extended by two further months for complex requests, in which case we tell you why.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work or where you believe an infringement took place. We would appreciate the chance to address your concern first.
California residents
If you live in California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), gives you the right to know what personal information we collect, use and disclose, to access, correct and delete it, and not to be discriminated against for exercising these rights.
We collect the categories described in section 2: identifiers (such as name, email address and IP address), commercial information (orders and invoices), internet activity (website and security logs), professional information (company name) and the content of your messages. We collect them from you, from your device and from people who report abuse, use them for the purposes in section 3, and disclose them for business purposes only to the recipients in section 5.
We do not sell personal information or share it for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes that would give you a right to limit it. You or an authorized agent can make a request through the same channels; we will verify it and respond within 45 days. If you live in another US state with a comprehensive privacy law, you can make the same requests.
9. How we protect data
We protect personal data with technical and organizational measures suited to the risk. All connections to our website are encrypted with TLS, the site runs behind Cloudflare's DDoS protection, and access to personal data is limited to people who need it for their work. We keep logs only for limited periods and load no third-party scripts on our website.
No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will notify the competent supervisory authority and, where required, you, without undue delay.
10. Children
Our website and services are intended for businesses and adults. We do not knowingly collect personal data from children under 16. If you believe a child has sent us personal data, tell us through the abuse reporting page and we will delete it.
11. Changes to this policy
We may update this policy to reflect changes in our services or in the law. We will publish the new version on this page with a new "updated" date, and notify customers of material changes by email or in the client area before they take effect.
12. Contact
For questions about this policy or your personal data, or to make a request, use the channels in section 8: a support ticket if you have an active server, or a reply to the last message we sent you. We do not publish an email address or a phone number; how to reach us explains why. To report abuse involving our network, use the abuse reporting page.