A practical companion to the Privacy Notice. Each flow below lists what we capture, where it lives, how long it stays, what we use it for, and who (if anyone) it is shared with. No marketing fluff; if it's not below, we don't do it.
Last updated: February 2026
§ Contact form / lead enquiry
When it happens
You fill in a form on the site, for example the contact form or the enquiry form on a service page.
What we capture
Your name, work email, organisation, optional phone.
The free-text message and the interest tag attached to the form.
The consent text shown and a server-side timestamp.
Your IP and User-Agent string. Recorded once, only with the lead, to evidence consent and to deter automated abuse.
Where it lives
MongoDB collection `leads`. encrypted at rest, EU jurisdiction (CloudVoro infra) or UK (CloudVoro infra) depending on which entity you contracted with.
What we use it for
Replying to your enquiry (manual, by a senior engineer).
Detecting and blocking spam / automated abuse via IP rate-limiting.
No marketing use without your separate, explicit opt-in.
How long we keep it
24 months from the date of last contact, then permanently deleted.
Who it's shared with
Email is delivered via SMTP through our email provider (see Subprocessors). No data shared with marketing, sales-intelligence or data-broker platforms.
The page path, document referrer, country (derived from IP at request time), timestamp.
We do NOT store the raw IP in the visit row. Only the derived country code.
We do NOT set a cross-session identifier or fingerprint.
Where it lives
MongoDB collection `visits`. TTL index on `created_at_ttl` automatically deletes rows after 12 months.
What we use it for
Understanding traffic patterns (which pages are read, which countries we reach, which referrers send traffic) at aggregate level.
No individual visitor profile is constructed.
How long we keep it
12 months, auto-deleted by MongoDB TTL index.
Who it's shared with
Nobody. No third-party analytics provider receives this data.
Legal basis
GDPR Art. 6(1)(f) legitimate interests; no cookie required for this processing because it is strictly-necessary first-party analytics with no cross-session identifier.
§ Administrator authentication
When it happens
A staff member logs into /loginmanage.
What we capture
Staff email, bcrypt password hash (we never store the plaintext password).
WebAuthn passkey public keys + sign counters (private keys remain on the device).
TOTP secret encrypted at rest; recovery codes stored as bcrypt hashes.
An HttpOnly authentication cookie with 24-hour expiry.
Where it lives
MongoDB collections `users`, `webauthn_credentials`, `totp_secrets`. All access encrypted in transit and at rest.
What we use it for
Authenticating staff users for CMS access.
Brute-force detection. Repeated failed attempts trigger an account lockout.
Every authenticated admin action is recorded in an immutable audit log.
How long we keep it
User record retained for the duration of the employment + 6 months. Audit log: 12 months. Failed-login records: 30 days.
For B2B clients who require a signed Data Processing Agreement under Art. 28 GDPR, we provide a counter-signable DPA template on request. The template covers our role as processor, the sub-processor list, security measures, breach-notification timing (24h for confirmed personal-data breaches), and a written exit / data-portability commitment.
Request: email hello@cloudvoro.com with "DPA request" in the subject and the contracting entity name. Turnaround: 2 working days.
Contact the Data Protection Officer
hello@cloudvoro.com. Response within 5 working days; 30-day maximum under GDPR Art. 12(3).
