GDPR Policy

Effective Date: 10 December 2025

Last Updated: 10 December 2025

1. Introduction

At Sync Your Cloud, we are committed to protecting the privacy and data security of our customers and users. This GDPR Policy outlines how we collect, process, store, and handle personal data in compliance with the General Data Protection Regulation (GDPR) (EU) 2016/679 and the UK Data Protection Act 2018 (DPA). This policy applies to all users of our cloud assessment platform, including those who complete our free cloud assessments, connect their AWS accounts, and subscribe to our ongoing advisory services.

2. Data Controller and Contact Information

Sync Your Cloud is the data controller responsible for the processing of personal data. If you have any questions, concerns, or requests related to your personal data or this policy, please contact us at:Company Name: Sync Your Cloud
Email: enquiries@syncyourcloud.io
Support Email: support@syncyourcloud.io
Data Protection Officer: dpo@syncyourcloud.io You can also contact us through our website contact form or by mail at our registered business address.

3. Types of Personal Data We Collect

We collect and process various types of personal data necessary for providing our cloud assessment and advisory services:3.1 Account Information:

• Full name and display name
• Email address
• Password (stored encrypted)
• Company name and size
• Industry sector
• Job title and role

3.2 Assessment Data:

• Pre-screen questionnaire responses (company information, cloud challenges, business goals)
• Cloud assessment survey responses
• AWS infrastructure configuration data (when you connect your AWS account)
• Cloud usage patterns and metrics
• Security configurations and compliance status

3.3 AWS Account Integration Data:

• AWS Account ID (12-digit identifier)
• External ID for secure role assumption
• IAM role ARN
• Resource metadata (EC2, S3, RDS, Lambda configurations)
• CloudWatch metrics and cost data
• Security findings and compliance data

3.4 Technical and Usage Data:

• IP addresses and device information
• Browser type and version
• Pages visited and features used
• Time spent on platform
• Session information

3.5 Communication Data:

• Support ticket history and communications
• Email correspondence
• Newsletter subscription preferences
• Feedback and survey responses

3.6 Billing and Payment Information:

• Billing address
• Payment method details (processed securely via Stripe)
• Transaction history
• Subscription plan details

4. Purpose of Data Processing

We process personal data for the following specific purposes:4.1 Service Delivery:

• Providing free cloud assessments and generating personalized reports
• Analyzing AWS infrastructure when you connect your account
• Delivering ongoing strategic advisory services (£10,000/month subscription)
• Generating security, cost optimization, and performance recommendations
• Creating prioritized action plans and roadmaps

4.2 Account Management:

• Creating and managing user accounts
• Authenticating users and maintaining session security
• Storing user preferences and assessment progress
• Managing AWS account connections and permissions

4.3 Communication:

• Sending assessment results and reports (delivered within 24 hours)
• Providing customer support and responding to inquiries
• Sending service updates and important notifications
• Delivering newsletters (with your consent)
• Marketing communications about our services (with opt-out option)

4.4 Platform Improvement:

• Analyzing usage patterns to improve our AI assessment algorithms
• Enhancing user experience and platform functionality
• Conducting research and developing new features
• Quality assurance and testing

4.5 Legal Compliance:

• Complying with legal and regulatory obligations
• Fraud prevention and security monitoring
• Enforcing our terms of service
• Responding to legal requests and protecting our rights

5. Lawful Basis for Processing

We process personal data under the following lawful bases as defined by GDPR:5.1 Performance of a Contract (Article 6(1)(b)):
Processing necessary for fulfilling our contractual obligations when you use our free assessment service or subscribe to our £10,000/month advisory service.5.2 Legitimate Interests (Article 6(1)(f)):
Processing necessary for our legitimate business interests, such as:

• Improving our AI-powered assessment platform
• Ensuring platform security and preventing fraud
• Internal analytics and business development
• Direct marketing to existing customers (with easy opt-out)

5.3 Consent (Article 6(1)(a)):
Where required, we obtain explicit consent for:

• Connecting to your AWS account and accessing infrastructure data
• Newsletter subscriptions
• Non-essential cookies and tracking
• Marketing communications to prospects

5.4 Legal Obligation (Article 6(1)(c)):
Processing required to comply with legal obligations, such as tax laws and data retention requirements.

6. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy:6.1 Active Account Data:
Retained for the duration of your account plus 90 days after account closure to allow for reactivation.6.2 Assessment Data:

• Assessment responses: Retained for 3 years or until account deletion
• Generated reports: Available for download for 12 months
• AWS infrastructure data: Retained for 6 months after last scan

6.3 Communication Data:

• Support tickets: Retained for 2 years
• Marketing emails: Until you unsubscribe or 3 years of inactivity

6.4 Financial Data:
Billing records retained for 7 years to comply with tax and accounting regulations.6.5 Legal Requirements:
Some data may be retained longer if required by law or to protect legal rights. Once data is no longer required, it will be securely deleted or anonymized in accordance with our data deletion procedures.

7. Data Security

We implement comprehensive technical and organizational measures to ensure the security, confidentiality, and integrity of personal data:7.1 Technical Measures:

• Encryption: All data transmitted using TLS/SSL encryption; data at rest encrypted using AES-256
• AWS Security: Data stored in AWS S3 with server-side encryption and versioning enabled
• IAM Role Security: AWS account connections use IAM roles with External ID for secure, temporary access
• Authentication: AWS Amplify authentication with MFA support
• Access Controls: Role-based access control (RBAC) and least privilege principles
• Firewalls: Network security groups and web application firewalls
• Monitoring: 24/7 security monitoring and intrusion detection

7.2 Organizational Measures:

• Regular security assessments and penetration testing
• Staff training on data protection and security
• Incident response procedures and breach notification protocols
• Vendor security assessments for third-party services
• Regular backups with secure off-site storage

7.3 AWS Infrastructure Assessment Security:
When you connect your AWS account, we:

• Use read-only access only - we cannot make changes to your resources
• Never access actual data in S3 buckets or databases
• Use temporary credentials with automatic expiration
• Store only metadata and configuration information
• Allow you to revoke access at any time by deleting the IAM role

8. Sharing of Personal Data

We may share personal data with trusted third-party service providers who assist us in delivering our services. We ensure all providers comply with GDPR and maintain appropriate security measures:8.1 Service Providers:

• AWS (Amazon Web Services): Cloud hosting and storage infrastructure
• Stripe: Secure payment processing for £10,000/month subscriptions
• SendGrid/Mailgun: Transactional email delivery (assessment reports, notifications)
• Google Analytics: Website analytics and usage tracking (anonymized)
• Substack: Newsletter delivery platform

8.2 Business Transfers:
In the event of a merger, acquisition, or sale of assets, your data may be transferred to the new entity, subject to the same GDPR protections.8.3 Legal Requirements:
We may disclose data if required by law, court order, or to protect our legal rights and safety.8.4 Data Not Shared:
We do not:

• Sell personal data to third parties
• Share data with advertisers
• Use data for purposes beyond those disclosed in this policy

9. International Data Transfers

As a UK-based company providing cloud services, we may transfer and store personal data outside of the UK or the European Economic Area (EEA).9.1 AWS Data Storage:
Data is primarily stored in AWS data centers. We use AWS regions that provide adequate data protection:

• Primary region: eu-west-2 (London, UK)
• Secondary/backup regions: EU-based regions when possible

9.2 Safeguards for International Transfers:
When data is transferred outside the UK/EEA, we ensure protection through:

• Standard Contractual Clauses (SCCs): EU-approved data transfer agreements
• Adequacy Decisions: Transfers to countries with adequate data protection
• AWS Data Processing Addendum: GDPR-compliant data processing terms

9.3 Your Rights:
You have the right to obtain information about international transfers and the safeguards in place.

10. Data Subject Rights

Under GDPR, you have the following rights regarding your personal data. You can exercise these rights by contacting us at dpo@syncyourcloud.io:10.1 Right of Access (Article 15):
Request a copy of your personal data we hold, including assessment responses, AWS connection data, and reports.10.2 Right to Rectification (Article 16):
Request correction of inaccurate or incomplete personal data in your account or assessment records.10.3 Right to Erasure / "Right to be Forgotten" (Article 17):
Request deletion of your personal data when:

• No longer necessary for the purposes collected
• You withdraw consent for processing
• You object to processing and there's no overriding legitimate interest
• Data has been unlawfully processed

Note: Some data may need to be retained for legal compliance (e.g., billing records for tax purposes).10.4 Right to Restriction of Processing (Article 18):
Request limitation of processing when:

• You contest the accuracy of data
• Processing is unlawful but you don't want erasure
• We no longer need the data but you need it for legal claims
• You've objected to processing pending verification

10.5 Right to Data Portability (Article 20):
Receive your personal data in a structured, commonly used, machine-readable format (JSON, CSV) to transfer to another service provider. This includes:

• Assessment responses and results
• Account information
• AWS connection metadata

10.6 Right to Object (Article 21):
Object to processing based on legitimate interests or for direct marketing purposes. We will stop processing unless we have compelling legitimate grounds.10.7 Rights Related to Automated Decision-Making (Article 22):
Our AI-powered assessment system makes automated recommendations. You have the right to:

• Request human review of automated decisions
• Express your point of view
• Contest automated decisions

All assessments are reviewed by AWS-certified experts, ensuring human oversight.10.8 Right to Withdraw Consent:
Where processing is based on consent, you can withdraw it at any time without affecting prior processing.10.9 Right to Lodge a Complaint:
You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

• Website: https://ico.org.uk/
• Telephone: 0303 123 1113

10.10 Response Time:
We will respond to rights requests within 1 month. In complex cases, we may extend this by 2 additional months and will notify you of the delay.

11. AWS Account Connection and Data Processing

11.1 Explicit Consent:
Before connecting your AWS account, you must provide explicit consent acknowledging:

• Read-only access to AWS resources
• Analysis of infrastructure configuration
• Access to CloudWatch metrics and cost data
• Generation of security and optimization recommendations

11.2 Data Collected from AWS:
When you connect your AWS account, we collect:

• Resource configurations (EC2, S3, RDS, Lambda, etc.)
• Security group rules and IAM policies
• CloudWatch metrics and alarms
• Cost and usage data
• Compliance findings

11.3 What We DO NOT Access:

• Actual data stored in S3 buckets
• Database records or application data
• Source code or proprietary information
• Private keys or credentials

11.4 Revoking Access:
You can revoke AWS access at any time by:

• Deleting the IAM role in your AWS account
• Contacting us to disconnect the integration
• Using the "Disconnect AWS" feature in your account settings

12. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience. See our separate Cookie Policy for details.Essential Cookies: Required for authentication and core platform functionality
Analytics Cookies: Help us understand how you use the platform (with consent)
Marketing Cookies: Used for targeted advertising (with consent) You can manage cookie preferences through our cookie consent banner.

13. Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child without parental consent, we will take steps to delete it promptly.

14. Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will:

• Notify the ICO within 72 hours of becoming aware
• Notify affected individuals without undue delay
• Provide information about the breach, its consequences, and mitigation measures
• Take immediate action to contain and remedy the breach

15. Changes to this Policy

We may update this GDPR Policy from time to time to reflect:

• Changes in our practices or services
• Legal or regulatory requirements
• Technological developments
• Industry best practices

Notification of Changes:

• Updated policy posted on our website with new effective date
• Email notification for material changes
• Consent requested for significant changes requiring it
• Previous versions available upon request

We encourage you to review this policy periodically.

16. Your Acceptance of this Policy

By using our cloud assessment platform, creating an account, or connecting your AWS account, you acknowledge that you have read, understood, and agree to this GDPR Policy and our Privacy Policy. If you do not agree with this policy, please do not use our services and contact us to delete your account and data.

17. Contact Us

For any questions, concerns, or requests related to this GDPR Policy or your personal data, please contact:General Inquiries: enquiries@syncyourcloud.io
We are committed to resolving any concerns and responding to your requests promptly.