CloudTeam Sales Hub Privacy Policy

(account.cloudteam.global)

Effective date: december 1, 2025.

TL;DR (≈1 minute)
CloudTeam Ltd. ("CloudTeam", "we") operates a Sales Hub at
https://account.cloudteam.global. It is a central B2B portal for:

• set up accounts for organizations (companies, universities, sole proprietorships),
• purchase and manage subscriptions to our SaaS products (e.g. Erudis, Examena, Credentium),
• handling Trials, Prepaid offers, invoices and billing data.

We collect contact and billing data of people representing organizations (first name, last name, email, company data) and basic technical data (IP, user-agent). We store the data in AWS infrastructure in the EU region (Frankfurt), and the login is handled by Auth0 (EU). We only send transactional emails (registration, invoices, subscription information).
We do not use Sales Hub for newsletters or behavioral advertising.
We do not use profiling or automated decisions with legal implications. We do not use cookies for analytics or marketing - only technical mechanisms for logging and system operation.

---

Table of contents

1. Who we are (data controller)
2. Scope and application
3. Simple definitions
4. What data we collect and from where
5. Processing purposes and legal basis
6. Data of children and individual users
7. Automated decisions and profiling
8. Data sharing and processors
9. Transfers of data outside the EEA
10. Data retention period
11. Data security
12. Your rights under the RODO
13. Email communication (no newsletter)
14. Cookies and similar technologies
15. Do we sell or "share" personal data?
16. Jurisdictional allowances (EU/EEA, UK)
17. CloudTeam's relationship with SaaS products
18. Changes to the Policy
19. Contact and availability of the document

---

1) Who we are (data controller)

Personal data administrator:
CloudTeam limited liability company
Plac Konesera 9, 03-736 Warsaw, Poland
KRS: 0000276018 (District Court for the Capital City of Warsaw, XIV Commercial Division of the National Court Register)
NIP: 5252388265
Share capital: 854,000.00 PLN

Data Protection Officer: has not been appointed.
Privacy contact: privacy@cloudteam.pl

CloudTeam acts as a controller of personal data of Sales Hubusers (customers, partners, contact persons) within the meaning of the RODO.

---

2) Scope and application

What does this Policy apply to?

This Policy applies to the processing of personal data in connection with:

• use of the CloudTeam Sales Hub portal at
  https://account.cloudteam.global,
• setting up and managing accounts of organizations (companies, universities, sole proprietorships),
• purchasing and managing subscriptions to CloudTeam's SaaS products,
• handling trials, prepaid offers, coupons and other sales solutions,
• generation and sending of billing documents (invoices, notes),
• communication with our technical support on Sales Hub issues.

What does this Policy not cover?

It does not cover data processing inside individual SaaS products (e.g. Erudis, Examena, Credentium). Each product has its own Privacy Policy, which defines the processing of data of users of these systems (e.g. students, listeners).

---

3) Simple definitions

• Sales Hub - account.cloudteam.global portal, where you manage your organization's account, subscriptions and billing for all CloudTeam SaaS products.

• Organization - an entity that registers with Sales Hub (company, university, sole proprietorship, etc.).

• Sales Hub user - an individual who creates or operates an account on behalf of the Organization (e.g., owner, administrator, person responsible for purchasing / billing, partner / reseller).

• Personal Data - any information that identifies an individual (e.g., name, email, IP).

• RODO - General Data Protection Regulation (EU 2016/679).

The Sales Hub platform is aimed at individuals acting on behalf of organizations (B2B), including sole proprietorships.

---

4) What data we collect and from where

4.1 User account data

When you create an account on Sales Hub, we process, among other things:

• Name - user identification,
• Email address - login, communication (verification, invoices, notifications),
• Password - stored only in hashed form (by Auth0),
• Role / permissions - e.g. organization owner, billing admin, partner,
• Login data via Google or Microsoft - if you use external login, we receive basic profile data (e.g. first name, last name, email) from these providers.

This data comes directly from you or from your Google/Microsoft account (in case of federated login).

4.2 Organization data and billing data

To invoice and pin subscriptions to the correct entity, we ask for:

• the full legal name of the organization,
• trade name, if any,
• TIN/ Tax ID,
• optional VAT ID (including country code for VIES),
• address details: street, building number, premises (optional), postal code, city, country,
• optional phone number,
• optional email address for invoices (other than login).

This data comes from you (registration form / organization profile editing) and can be technically verified (e.g. using VIES for VAT numbers).

4.3 Data on subscriptions, trials and prepaid offers

In Sales Hub we also store:

• information about active and past subscriptions (product, plan, number of users/slots, price, duration),
• information about trials (start and end dates, product, plan),
• information about prepaid offers and their usage (e.g., offer IDs, product, period, association with the organization),
• history of basic subscription activities (e.g., activation, renewal, plan change).

This data is created as a result of using Sales Hub (placing orders, activating Trials/Prepaid, configuring subscriptions).

4.4 Technical data and logs

When you use Sales Hub, our systems automatically record:

• iP address,
• browser and operating system information (user-agent),
• timestamps (login, key operations),
• session and request identifiers,
• interface language/location settings.

These data are necessary for security, error diagnostics, auditing of administrative activities, and evidence of contracts and acceptance of terms and conditions.

4.5 Correspondence and support requests

If you contact us (e.g. at support@cloudteam.pl), we process:

• the content of the message (e.g. questions, complaints, bug reports),
• contact information included in the email (e.g. signature, additional phone number),
• technical attachments, if any.

We use them only to respond, solve the problem and improve the quality of service.

4.6 Special categories of data

We do not ask for so-called special categories of data (e.g., health data, religious or political beliefs), and we ask you not to include them in Sales Hub forms or correspondence unless absolutely necessary. If such data nevertheless comes to us, we will try to keep processing to a minimum and, if necessary, delete or anonymize it.

---

5) Processing purposes and legal basis

The following are the main purposes of data processing at Sales Hub and the legal bases in accordance with the RODO.

Purpose of processing	Examples	Legal basis
Account creation and operation	user and organization registration, login, role assignment	necessary for the performance of the contract (Article 6(1)(b) RODO)
Management of subscriptions and trials	purchase and activation of subscriptions, trials, prepaid	contract (Article 6(1)(b))
Billing and accounting	issuance of invoices, adjustments, notes, posting of payments	legal obligation (art. 6(1)(c) - taxes, accounting)
Verification of VAT / company data	checking VAT numbers in VIES, address verification	legal obligation + legitimate interest (art. 6(1)(c) and (f))
Security and logs	fraud prevention, log analysis, audit of changes	legitimate interest (Art. 6(1)(f))
Evidence of agreement and consents	records of acceptance of MSAs, DPAs, regulations	legal obligation and legitimate interest (Art. 6(1)(c) and (f))
Handling of requests and communications	responding to emails, handling complaints	contract + legitimate interest (art. 6(1)(b) and (f))

Provision of data necessary for registration of an organization and user account is voluntary, but necessary so that we can set up an account in Sales Hub and provide services (without this data registration will not be possible).

We do not use Sales Hub data for direct marketing(Newsletter, advertising campaigns) - Sales Hub is mainly used for transactional and operational communication.

---

6) Data of children and individual users

Sales Hub targets individuals acting on behalf of organizations (B2B), including sole proprietorships. We do not target Sales Hub to children or consumers.

While we do not specifically verify the age of users, we assume that those who register organizations and enter into contracts on Sales Hub do so in a professional/business capacity and have the authority to do so.

---

7) Automated decisions and profiling

We do not use in Sales Hub:

• profiling within the meaning of the DPA,
• automated decision-making that produces legal effects on you or similarly significantly affects you (e.g. automatic rejection of orders from certain countries, credit scoring, etc.).

We use automated technical processes (e.g., logging, VAT validation in VIES, basic rules to limit fraud), but this does not constitute profiling in the sense of the RODO, nor does it produce legal effects for you without human involvement.

---

8) Data sharing and processors

8.1 Processors (processors)

In order to provide Sales Hub services, we use third-party providers who process data on our behalf (processors), including but not limited to:

• Cloud provider (e.g., Amazon Web Services in the EU - Frankfurt region)
  - Maintenance of databases, APIs, storage, logs, sending transactional emails.

• Authentication provider (Auth0/Okta, EU region)
  - User login, storage of encrypted passwords, Google/Microsoft login support.

• Email providers (e.g., AWS SES email services)
  - Sending transactional emails (registration, password reset, invoices).

• VAT verification service (VIES) - to check the validity of VAT numbers of EU organizations.

• Potentially: address validation service (e.g., Google Maps API) - if enabled, will only be used for technical address validation and unification.

• Interface translation service (e.g., DeepL) - can be used to translate interface content and email templates, without providing personal user data (e.g., names, emails).

We publish the current list of subcontractors processing data in Sales Hub at:

https://legal.cloudteam.global/sales-hub/sub-processors

We enter into a data entrustment agreement or other relevant legal instruments with each such entity in accordance with Article 28 of the RODO.

8.2 Other recipients

Your data may also be transferred to:

• to public authorities or courts, if required by law (e.g. tax authorities, law enforcement agencies),
• our advisors (legal, tax, auditors) - only to the extent necessary to provide their services and with confidentiality.

We do not transfer Sales Hub data to other entities for their own direct marketing.

---

9) Data transfers outside the EEA

As a general rule, we maintain Sales Hub on infrastructure located in the European Union (e.g. the Frankfurt cloud region), but:

• some providers (e.g. Auth0, CDN providers, translation services) may have infrastructure or personnel outside the EEA,
• to a limited extent, data may be processed outside the EEA (e.g., when going through global CDN nodes or during technical support).

In such cases, we apply appropriate safeguards under Chapter V of the RODO, in particular:

• european Commission standard contractual clauses (SCC),
• if necessary, additional technical and organizational measures (e.g. encryption, pseudonymization).

If you want to learn more about specific transfers and safeguards, you can write to us at privacy@cloudteam.pl.

---

10) Data retention period

We store data only for as long as necessary to fulfill the purposes described above or as long as required by law.

10.1 Account and organization data

• We storeuser account data and organization data for the duration of an active account on Sales Hub.
• After the account is closed
  • we delete or anonymize login and user profile data to the extent that it is no longer needed,
  • we leave a limited set of information (e.g., organization identifiers, subscription information, MSA/DPA acceptance dates) for evidence and billing purposes - generally up to 6 years from the end of the relationship (end of the last subscription), in accordance with the statute of limitations for claims.

10.2 Subscriptions and accounting documents

• We keep data on subscriptions and document acceptances (MSAs, DPAs, rules and regulations), as a rule, until 6 years after the end of the last subscription, in order to be able to prove the existence and scope of the agreement.
• We keep accounting documents (invoices, adjustments, notes), as a rule, up to 6 years from the end of the year to which they relate, in accordance with accounting regulations and the statute of limitations.

10.3 Technical logs and backups

• We generally store technical logs (e.g., logins, errors) for up to12 months, unless a longer period is necessary in connection with a security incident or investigation.
• Data may be stored in encrypted backups for a limited time (typically 30-35 days for cloud backup mechanisms), for disaster recovery purposes only.

---

11) Data security

We use appropriate technical and organizational measures to protect your data, including but not limited to:

• encryption of communications (HTTPS/TLS),
• encryption of data at rest (in databases and cloud file stores),
• role-based access control and least privilege principle,
• logging and monitoring of significant security events,
• regular environment updates and cloud configuration checks,
• storing secrets (service passwords, API keys) in secure secret stores.

No system is completely immune to attacks, but we do our best to minimize the risk of breaches and respond to them quickly. If a data breach occurs, we will take the actions required by the RODO (including, if necessary, reporting the breach to the supervisory authority and notifying data subjects).

---

12) Your rights under the RODO

If you are subject to the RODO (e.g., you are in the EU/EEA), you have, among other things:

• the right to access your data,
• the right to rectify (correct) your data,
• the rightto delete yourdata ("right to be forgotten"),
• theright to limit processing,
• the right to data portability (to the extent provided by law),
• the right to object to processing based on legitimate interests (e.g., logs, data archiving),
• the right to lodge a complaint with a supervisory authority.

How can you exercise these rights?

• You can change some of your data yourself in the Sales Hub dashboard (e.g. organization data, contact information, some account settings).
• You can make a request for access, deletion, restriction or transfer by sending an email to privacy@cloudteam.pl.
• Currently, there is no full "delete account" function available in the interface; we implement account deletion and disable access to Sales Hub upon receipt of your request.
  Please note that due to laws and statutes of limitation on claims, some data (e.g. subscription and invoice information) must be kept longer - even after deletion of your account.

You can also file a complaint with the supervisory authority:

President of the Office for Personal Data Protection (UODO)
2 Stawki Street, 00-193 Warsaw, Poland

or - if you live in another EU/EEA country - to the supervisory authority competent for your place of residence.

---

13) Email communication (no newsletter)

We only send transactional emails from the email address associated with your Sales Hub account, e.g:

• registration emails (address verification),
• password reset,
• confirmations of organization creation,
• information about activation / expiration of subscriptions, triali, Prepaid,
• invoice notifications or changes relevant to your account.

Sales Hub is not used to send newsletters and marketing communications. If in the future we would like to introduce such features, it will involve a separate legal basis (e.g. consent) and a corresponding update of this Policy.

You cannot opt out of receiving messages that are essential to the service (e.g. security information, password reset) unless you close your Sales Hub account.

---

14) Cookies and similar technologies

At Sales Hub:

• we do not use cookies or similar technologies for marketing analytics (no Google Analytics, no advertising pixels),
• we only use technically necessary mechanisms (e.g., cookies or other session identifiers used by the Auth0 authentication service and possibly by our front-end) to ensure login functionality and maintain user sessions.

Login tokens may be stored locally in your browser (e.g. localStorage/sessionStorage) as necessary for the application to function. We do not use these mechanisms to track you on other services or for marketing profiling.

We do not currently display a separate cookie consent banner because we do not use mechanisms that require marketing/analytics consent.
If we implement additional tools (e.g. analytics) in the future, the Policy will be updated accordingly, and where required, we will introduce a consent mechanism.

---

15) Do we sell or "share" personal information?

We do not sell your personal data and we do not "share" your personal data for cross-contextual behavioral advertising purposes (as defined by certain regulations, e.g. state regulations in the US).

We do not conduct in Sales Hub:

• marketing profiling,
• remarketing campaigns,
• building "audience lists" for third-party advertising platforms.

---

16) Jurisdictional allowances (EU/EEA, UK)

EU/EEA

If you are located in the EU/EEA, data processing is carried out in accordance with the RODO. Your rights are described in Section 12, and the supervisory authority in Poland is the President of UODO (contact details above).

United Kingdom (UK GDPR)

If you are located in the UK, data processing is done in accordance with the UK GDPR. You have similar rights as in the RODO, and the supervisory authority is:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom

We have not currently appointed a separate representative in the UK. For Sales Hub related matters, you can contact us atprivacy@cloudteam.pl.

---

17) Relationship with CloudTeam's SaaS products

Sales Hub is just a "sales-subscription layer."

• When you purchase or activate a product (e.g., Erudis, Examena, Credentium), the terms and conditions and Privacy Policy of that product additionally start to apply.
• Personal data of users of these products (e.g., students in Erudis) are processed according to separate policies and documents (e.g., product DPAs).

If you want to find out how data is processed in a specific product, take a look at its Privacy Policy available on CloudTeam's website.

---

18) Changes to the Policy

We may update this Policy from time to time, such as when:

• sales Hub features change,
• we begin to support new payment methods or new subcontractors,
• laws or regulatory guidelines change.

We always state the effective date of the current version at the beginning of the document. In case of significant changes, we may additionally inform you in the Sales Hub panel or by email (if appropriate).

---

19) Contact and availability of the document

You can contact us on matters related to the processing of personal data in Sales Hub:

E-mail (RODO / privacy): privacy@cloudteam.pl
E-mail (Sales Hub operational support): support@cloudteam.pl

Mailing address:
CloudTeam sp. z o.o.
Plac Konesera 9
03-736 Warsaw, Poland

If you need this Policy in a different format (e.g. adapted to a screen reader), please write to us - we will try to help you.