Privacy policy

1. Controller

eprocloud GmbH
Röntgenstraße 14, 95478 Kemnath, Germany
Represented by the managing director Marc Eberhart
Email: digital@eprocloud.com · Phone: +49 9642 6293660

Please direct data protection enquiries to digital@eprocloud.com.

2. Principles and legal bases

We process personal data only where necessary. Depending on the processing, the legal bases are Art. 6 (1) (a) GDPR (consent), (b) GDPR (contract or pre-contractual steps), (c) GDPR (legal obligation) and (f) GDPR (legitimate interest, in particular in the secure and functional operation of this website).

3. Hosting and server log files

This website is operated in a data centre in Germany. When you access it, the server automatically collects: IP address, date and time, requested file, data volume transferred, referrer URL, browser type and operating system. Processing is based on Art. 6 (1) (f) GDPR to deliver the site and detect attacks. Log files are deleted or anonymised after 30 days at the latest.

A data processing agreement under Art. 28 GDPR is in place with the hosting provider.

4. Cookies

This website only uses technically necessary cookies (§ 25 (2) TDDDG), for example to secure forms. No tracking or marketing cookies are set and no third-party content is loaded. Should this change, we will obtain your consent in advance via a cookie banner.

5. Contact form, email and phone

In the "Request a consultation" form we process name, company, email address, optionally phone number, topic, company size and your brief description. The purpose is to answer your enquiry and prepare an appointment; the legal basis is Art. 6 (1) (b) or (f) GDPR. The details are sent to digital@eprocloud.com and stored in our CRM and ticketing system. We delete them once the enquiry is closed and no commercial or tax retention obligations apply (usually after six months; in the case of contract initiation according to the statutory periods).

6. Cloud & AI readiness check

If you complete the readiness check, we process your answers across the six dimensions and your contact details in order to email you the assessment. The legal basis is your consent under Art. 6 (1) (a) GDPR. The assessment is rule-based; no automated decision with legal effect under Art. 22 GDPR takes place. A sales call is only made if you expressly allow it. We delete the answers twelve months after sending the assessment.

7. Newsletter

For the newsletter we process your email address using a double opt-in procedure: you receive a confirmation email and the subscription only becomes effective once you confirm. We log the subscription and confirmation as evidence. The legal basis is Art. 6 (1) (a) GDPR. You can unsubscribe at any time via the unsubscribe link or by email; we then delete your address unless retention obligations apply. Dispatch takes place via our own infrastructure in Germany.

8. Support and operation of customer environments

As part of managed cloud and support services we process data from your systems exclusively as a processor under Art. 28 GDPR, on the basis of a separate data processing agreement and only on your instructions. Your company remains the controller for this data. We retain ticket, access and change logs for traceability.

9. Microsoft cloud services

We work within the Microsoft ecosystem and use, among others, Microsoft 365, Microsoft Entra ID, Microsoft Defender, Microsoft Sentinel and Azure services. Processing takes place in the Azure regions Germany West Central (Frankfurt) and Germany North within the EU Data Boundary on the basis of the Microsoft Product Terms including the Data Protection Addendum. Where data is transferred to a third country in individual cases, this is based on EU standard contractual clauses and supplementary safeguards.

10. Use of AI systems

We use AI services within the Microsoft ecosystem – in particular Microsoft 365 Copilot, GitHub Copilot, Copilot Studio and Azure AI Foundry / Azure OpenAI. The following rules apply to us:

• No training with your data. Inputs and outputs of the Microsoft AI services we use are not used to train the underlying models.
• Processing in the EU. AI processing takes place in Azure regions in Germany or within the EU Data Boundary.
• Existing permissions continue to apply. AI assistants only access content the requesting person is already authorised to see; permissions are enforced via Entra ID and Microsoft Purview.
• Logging and cost caps. Requests to AI applications are logged, content is filtered via content safety and consumption is capped per application.
• People decide. AI output is preparation, not a decision. We do not make automated individual decisions within the meaning of Art. 22 GDPR.
• No AI chat on this website. This website contains no AI chat. Should we introduce an assistant, we will inform you here in advance and obtain your consent where required.

Where we use AI services on behalf of a customer, this is done exclusively on the basis of the respective data processing agreement and the purposes agreed there.

11. Job applications

Application documents sent to digital@eprocloud.com are processed solely to carry out the application procedure (Art. 6 (1) (b) GDPR, § 26 BDSG). After completion we delete the documents no later than six months after a rejection, unless you have consented to longer storage.

12. External services and links

Fonts are served locally from our server; no connection to Google Fonts or other font services is made. Our site links to external profiles such as LinkedIn. The respective provider is responsible for data processing on linked pages; data is only transferred once you click the link.

13. Recipients and processors

Data is only passed on to service providers who support us with hosting, email, CRM, ticketing and cloud operations, in each case on the basis of a data processing agreement under Art. 28 GDPR, and to tax advisors and authorities to the extent required by law. We do not sell personal data.

14. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You may withdraw any consent given at any time with effect for the future. Please contact digital@eprocloud.com.

You also have the right to lodge a complaint with a supervisory authority, for example the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 27, 91522 Ansbach, Germany.

15. Data security

This website is transmitted encrypted via TLS. We implement Zero Trust principles: multi-factor authentication, Conditional Access, time-limited privileged access (PIM), encryption of stored data, and logging and analysis of security events in Microsoft Sentinel.

16. Changes

We update this policy when our services, the tools we use or the legal situation change. The version published on this page applies.