Privacy Policy

Version 1.0 · Last updated: 1 October 2026

This policy explains how Brova Cloud handles personal data: when you visit
brova.cloud, when you contact us or report an incident, and when you are a client.
If you are a visitor or customer of a website that we host for one of our clients,
that client is responsible for your data; see section 8.

1. Who is responsible

Joaquín Martínez Herrera (CEO), trading as Brova Digital Group
Headquarters: Franklin D. Roosevelt 1884, 1428 Buenos Aires, Argentina
Germany: Kleine Fleischergasse 8, 04109 Leipzig, Germany
United Kingdom: Princes Square 28, London W2 4NJ, United Kingdom
Email: contact@brova.cloud

We have not appointed a data protection officer, as we are not required to. For
anything about your data, write to contact@brova.cloud.

2. Visiting brova.cloud

When a page loads, your browser sends the usual technical information: IP address,
date and time, the page requested, the referring page, browser and operating system.
We need it to deliver the page and to keep the server secure.

• Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR).
• Where: brova.cloud runs on our own Brova Cloud servers in a Hetzner data centre in
  Helsinki, Finland (EU).
• How long: server logs are deleted after 14 days, unless a specific entry is needed
  to investigate an attack.

Cookies and storage on your device. brova.cloud sets no cookies. It uses no
analytics, advertising, tracking pixels or social-media plugins, and it loads no fonts,
scripts or images from other companies: everything comes from our own server.

If your browser language differs from the page, a bar offers the site in your language.
If you close that bar or follow its link, your browser stores one entry
(brova-language-suggestion-dismissed) in its local storage so the bar doesn't come
back. It never leaves your device and we can't read it. You can delete it at any time
by clearing this site's data in your browser. Because it only stores a choice you made,
it needs no consent (§ 25(2) no. 2 TDDDG).

Links to other services. WhatsApp buttons and links to brova.digital are plain
links. Nothing is sent to those services until you click.

3. Contacting us

Email. When you email us, we use your address and message to answer you. Our
mailboxes run on our own Brova Cloud servers (Hetzner, Finland). To filter spam, our
mail server checks the address of the server sending an email against public blocklists.

WhatsApp. If you message us on WhatsApp, WhatsApp (Meta Platforms Ireland Ltd., with
processing also in the USA) processes your number, profile and messages under its own
privacy policy. Please don't send passwords, access keys or other sensitive data through
WhatsApp.

• Legal basis: steps before a contract or performing it (Art. 6(1)(b) GDPR); otherwise
  our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).
• How long: enquiries that don't lead to a contract are deleted after 12 months.
  Messages that concern a contract are business correspondence and are kept as required
  by commercial and tax law (see section 6).

4. Reporting an incident

When you use the incident form, we collect your name and email address;
optionally your company and phone number; the affected service and domain; what you are
seeing, when it started, whether the service is online, whether personal data may be
affected and recent changes; your description; any files you attach; and an existing
case number if you are following up.

What we do with it. The form gives your report a case number and an initial priority
and emails it to our incident inbox. We use the information to investigate and resolve
the incident and to contact you about it.

Protections specific to the form.

• Your IP address is not stored. To detect abuse such as repeated or automated reports,
  we keep a one-way hash of it, made with a secret key, for up to 24 hours.
• The form refuses descriptions that look like passwords, private keys or API keys.
  Please never send credentials.
• Attachments are checked for type and sent with the report to our incident inbox. They
  are not stored on the website.

Who receives it. The report goes from our website to our incident mailbox; both run on
our own servers (Hetzner, Finland). No other service receives it.

Legal basis. If you are our client: performing our contract (Art. 6(1)(b) GDPR).
Otherwise: our legitimate interest, and yours, in dealing with a security incident
(Art. 6(1)(f) GDPR).

Data about other people in your report. Log files and screenshots can contain data
about your own customers or users. If you are our client, we process that data on your
behalf under our data processing agreement.

How long.

• Incident emails, including attachments: 3 years after the case is closed, to handle
  follow-ups and legal claims.
• Abuse-prevention records (hashed IP address, hashed email address, counters): 24 hours.

5. If you are a client

To provide our services we process the contact and billing details of you and your staff
(names, email addresses, phone numbers, company, address, tax ID), the contract, support
history and invoices.

• Legal basis: performing the contract (Art. 6(1)(b) GDPR) and legal obligations under
  commercial and tax law (Art. 6(1)(c) GDPR).
• How long: for the duration of the contract, then as required by law (section 6).

We don't send newsletters or marketing emails.

6. How long we keep data

After these periods we delete the data. Where deletion isn't possible yet (for example in
backups), we exclude it from any use until it is overwritten.

7. Who else receives data

We don't sell personal data or share it for advertising. We use these providers, bound by
data processing agreements:

WhatsApp (Meta) processes messages you send us under its own terms (section 3). Only Brova
staff whose role requires it can access personal data, with defined permissions and bound
to confidentiality.

Transfers to the USA. Resend is certified under the EU–US Data Privacy Framework and
has also agreed to the EU Standard Contractual Clauses. Cloudflare relies on the Standard
Contractual Clauses and the Data Privacy Framework. You can ask us for a copy of the
safeguards.

We disclose data to authorities only where the law requires it.

8. Websites we host for clients

For the personal data on the websites and applications we host (for example orders,
accounts, form entries), our client is the controller and we act only on its
instructions as a processor (Art. 28 GDPR). To exercise your rights regarding such a
site, please contact its operator. If you contact us, we forward your request to them.

9. Security

We protect personal data with technical and organisational measures appropriate to the
risk, including encrypted connections (TLS), restricted key-based administrative access,
separation between hosted sites, automatic security updates and regular backups. No
system is completely secure. If a breach affects your data and puts you at high risk, we
will inform you as the law requires.

10. Your rights

You have the right to:

• access the data we hold about you (Art. 15 GDPR);
• have it corrected (Art. 16) or deleted (Art. 17);
• restrict its processing (Art. 18);
• receive it in a portable format (Art. 20);
• object at any time, for reasons relating to your situation, to processing based on
  our legitimate interests (Art. 21);
• withdraw any consent you have given, with effect for the future (Art. 7(3)).

Write to contact@brova.cloud. We answer within one month.

You can also complain to a data protection authority, in particular in the country where
you live or work. The authority responsible for our German address is the Sächsische
Datenschutz- und Transparenzbeauftragte, Postfach 11 01 32, 01330 Dresden, Germany,
www.datenschutz.sachsen.de. In the UK you can
contact the Information Commissioner's Office (ico.org.uk).

If you are in Argentina. You can exercise your rights of access, rectification,
update and deletion under Law 25.326 by writing to
contact@brova.cloud.

El titular de los datos personales tiene la facultad de ejercer el derecho de acceso a
los mismos en forma gratuita a intervalos no inferiores a seis meses, salvo que se
acredite un interés legítimo al efecto conforme lo establecido en el artículo 14, inciso
3 de la Ley Nº 25.326. La Agencia de Acceso a la Información Pública, en su carácter de
Órgano de Control de la Ley Nº 25.326, tiene la atribución de atender las denuncias y
reclamos que interpongan quienes resulten afectados en sus derechos por incumplimiento
de las normas vigentes en materia de protección de datos personales.

11. No automated decisions

We don't make decisions about you based solely on automated processing that have legal
or similarly significant effects. The priority shown after an incident report is
calculated automatically to order our work; a person reviews it, and it has no legal
effect on you.

12. Children

Our services are not directed at children, and clients must be adults. We don't knowingly
collect data from children.

13. Changes

We update this policy when our services or the law change. The version and date at the
top show which version applies.