1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) for this website and our customer portal is:
Andreas Brandl, trading as 1st Cloud
Regentalweg 10
93073 Neutraubling
Germany
Email: hello@1st-cloud.net
Phone: +49 32 229990173
We are not required to appoint a data protection officer (Art. 37 GDPR, Section 38 BDSG). For questions about data protection, please contact us at the email address above.
2. Principles
We only process personal data where this is necessary to operate this website, to handle your enquiries or to perform contracts. This website does not use analytics or tracking tools, advertising or social media plugins. Fonts and all other components are delivered from our own servers.
3. Hosting and server log files
This website and our customer portal run on our own servers in a data centre in the European Union. The data centre operator only provides space, power and network connectivity and has no access to the stored data.
Each time a page is accessed, our web server automatically stores the following data in log files: IP address, date and time, requested address, HTTP status code and amount of data transferred, browser and operating system, and the previously visited page (referrer).
The purpose is secure and stable operation, in particular detecting errors and misuse. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure operation. We delete the log files automatically after 30 days at the latest. The data is not passed on.
5. Contact by email, phone or ticket
If you contact us by email, by phone or via the ticket form of the customer portal, we process your details, for example name, email address or phone number, the content of your message and any files you attach, to handle your enquiry. Providing these details is voluntary, but without them we cannot answer your enquiry. The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract, otherwise Art. 6(1)(f) GDPR; our legitimate interest is to answer your enquiry. We delete the data as soon as it is no longer needed, at the latest after three years; statutory retention obligations remain unaffected. We send our replies as described in section 6. We process reports of illegal content under Article 16 of Regulation (EU) 2022/2065 (see our legal notice) in order to comply with our obligations under that Regulation; in this respect, the legal basis is Art. 6(1)(c) GDPR. We may inform the customer whose content is concerned about such a report. The customer only learns your name and email address if this is strictly necessary to assess whether the content is illegal, for example in cases of infringement of intellectual property rights (Art. 17(3)(b) of that Regulation).
6. Sending emails
We send outgoing emails, for example replies to your enquiries as well as confirmations and invoices from the customer portal, via our own mail server. It delivers them through the Amazon Simple Email Service (Amazon SES). The provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. We use the AWS region Europe (Frankfurt).
In doing so, Amazon SES processes the sender and recipient addresses, the subject and content of the email, the time of sending and technical delivery information, for example whether an email was delivered or rejected. We evaluate notifications about undeliverable emails and complaints in order to keep delivery reliable, and delete them after twelve months at the latest. Amazon SES adds addresses where delivery has failed permanently, or whose recipient has complained about an email, to a suppression list so that no further emails are sent to them. They remain on this list until we remove them, for example at your request.
The legal basis is Art. 6(1)(b) GDPR where an email relates to a contract or to an enquiry relating to a contract, otherwise Art. 6(1)(f) GDPR; our legitimate interest is reliable delivery. We have concluded a data processing agreement with AWS pursuant to Art. 28 GDPR. Access by the US parent company Amazon.com, Inc. cannot be ruled out. Amazon is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). In addition, the EU Standard Contractual Clauses apply (Art. 46(2)(c) GDPR).
7. Customer account and orders
If you create a customer account or order services, we process the details required for this, such as name, address, email address, phone number, order and invoice data. These details are required to conclude the contract; without them we cannot create a customer account or process an order. The purpose is the performance of the contract, the legal basis Art. 6(1)(b) GDPR, and additionally Art. 6(1)(c) GDPR for invoices and accounting records. We keep invoice-related records for the periods required by commercial and tax law, generally up to ten years.
When you log in, the customer portal also stores your IP address, the host name derived from it and the time; for orders and other actions in your customer account, it stores your IP address and the time, including in an activity log. When you search for a domain, we may store the domain searched together with your IP address in a lookup log. The purpose is to detect misuse and to be able to trace actions. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the security of your account and our systems. The details of your last login are replaced each time you log in. We delete entries in the activity log and the lookup log after twelve months at the latest, and the other details together with your customer account.
As soon as we integrate payment service providers, we will update this policy.
8. Recipients and third countries
We do not sell your data or pass it on for advertising purposes. Recipients are only service providers that we have contractually bound as processors, currently Amazon Web Services for sending emails (section 6), and bodies to which we must disclose data to perform a contract or because of legal obligations. Data reaches countries outside the EU or EEA only as described in section 6. If you follow links to other websites, such as 1st.group or 1st-syscon.net, the privacy policy of the respective provider applies there.
9. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may withdraw any consent you have given at any time with effect for the future (Art. 7(3)). To do so, write to us at hello@1st-cloud.net. No automated decision-making, including profiling, takes place.
Right to object under Art. 21 GDPR
Where we process your data on the basis of legitimate interests under Art. 6(1)(f) GDPR (sections 3 to 7), you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. An informal message to hello@1st-cloud.net is sufficient.
10. Right to lodge a complaint
You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de. You can also contact the supervisory authority at your place of residence or work.
11. Last updated
We update this privacy policy whenever our technology or the legal situation changes. Last updated: November 2026.
This English version is provided for convenience. In case of doubt, the German version applies.
