GDPR Policy

Last updated: August 2026

This GDPR Policy is the Art. 13/14 information notice for personal data processing by IronCloud PC in connection with ironcloud.gr and the IronCloud Registrar portal my.ironcloud.gr. It complements the Privacy Policy and Cookie Policy.

• 1. Controller
• 2. Purposes and legal bases
• 3. Categories of personal data
• 4. Recipients
• 5. International transfers
• 6. Retention
• 7. Rights and how to exercise them
• 8. Obligation to provide data
• 9. Automated decision-making
• 10. Complaints

1. Controller

IronCloud PC
Leoforos Eleftherias 11, Alimos 17455, Greece
GEMI: 117557101000 · AFM: 800346977
Privacy: [email protected]
Support: [email protected] / [email protected]
Phone: +30 210 2202 667

2. Purposes and legal bases

Purpose	Legal basis
Respond to contact / pre-contractual inquiries (marketing site)	Art. 6(1)(b) and/or 6(1)(f)
Newsletter	Art. 6(1)(a) consent
Analytics, reCAPTCHA, Maps (non-essential)	Art. 6(1)(a) consent
Language preference / essential session cookies	Art. 6(1)(f) / necessity for requested service
Registrar account, domain orders, support	Art. 6(1)(b) contract
Registrant data to FORTH-ICS / registries; tax invoicing	Art. 6(1)(c) legal obligation
Security, fraud prevention, audit logs	Art. 6(1)(f) legitimate interests
Optional Google OAuth	Art. 6(1)(a) and/or 6(1)(b) as applicable
Payments (Stripe / legacy Viva), SSL issuance	Art. 6(1)(b)

3. Categories of personal data

• Marketing site: contact details and messages; newsletter email; consent-based analytics; language cookie.
• Registrar portal: account credentials and identifiers; profile and MFA data; billing/tax identity data; domain contacts (ICCONTACTS); KYC documents for restricted TLDs; order and payment metadata; support tickets; security/audit logs; transient verification tokens; session cookie and theme preference.

Full detail is in the Privacy Policy.

4. Recipients

Processors and recipients include, as applicable: FORTH-ICS, Cloudflare Registrar, Stripe, Viva (legacy), mytimologisi/AADE, The SSL Store, Let’s Encrypt, Google (OAuth/Analytics/reCAPTCHA/Maps), Mailchimp, and our SMTP provider. Registrant data for .gr/.ελ is provided to FORTH-ICS for EETT registrant-database obligations.

5. International transfers

Some providers (e.g. Cloudflare Registrar, Stripe, Google, Mailchimp, The SSL Store) may process data outside the EEA. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) and supplementary measures as needed.

6. Retention schedule

Data	Retention
Contact emails	Up to 24 months
Newsletter	Until unsubscribe
Analytics	Per GA (typically ~14 months if enabled)
Account	While active + reasonable period after closure
Domain / registrant	Registration term + EETT/legal retention
Invoices / billing	Minimum 5 years (Greek tax)
Audit / security logs	Typically 2–7 years
KYC	Verification + legal/registry retention

Where legal or registry obligations apply, erasure may be refused or limited until those obligations end.

7. Rights and how to exercise them

• Access / rectification: self-service profile and billing on my.ironcloud.gr where available; otherwise email [email protected].
• Erasure / account closure: manual process via support ticket or privacy@ — not automated. Some data must be retained.
• Portability: request via privacy@ (no automated export yet).
• Withdraw consent: cookie banner Reject / clear cookies; newsletter unsubscribe; revoke optional OAuth by disconnecting in the portal or contacting support.
• Restriction / objection: email privacy@ with details of your request.

We do not claim automated DSAR, export, or erasure tooling. Requests are handled by staff within GDPR timeframes.

8. Obligation to provide data

You are not required to browse ironcloud.gr, but certain data are necessary for specific services. In particular, domain registration cannot proceed without required registrant and (where applicable) billing/KYC data. Failure to provide mandatory registrant data means we cannot register or maintain the domain under registry rules.

9. Automated decision-making

We do not use personal data for automated decision-making or profiling that produces legal or similarly significant effects within the meaning of Art. 22 GDPR.

10. Complaints

You may lodge a complaint with the Hellenic Data Protection Authority (HDPA): www.dpa.gr.

Related: Privacy Policy · Cookie Policy · Terms of Service · Registrar portal.