Purpose and scope
This policy sets out the principles and commitments with which Cloud Legion protects privacy and personal data, and explains what data we process, why, how we protect it and how to exercise your rights over it. It applies to the data of visitors to this site, clients, suppliers, team members and job applicants, whatever its form, the medium that holds it or where it is located.
It is part of our Privacy Information Management System, certified under ISO/IEC 27701 and integrated with our Information Security Management System (ISO/IEC 27001). It complies with Argentina’s Personal Data Protection Law No. 25,326, its regulatory decree 1558/2001 and related regulations. If you are in Brazil, please see the Portuguese version, adapted to Brazil’s General Data Protection Law (LGPD).
Data controller
- Legal name
- THECLOUDLEGION S.R.L.
- Trade name
- Cloud Legion
- Tax ID (CUIT)
- 30-71562412-1
- Address
- Av. Jujuy 2085 2 "C", Parque Patricios, Autonomous City of Buenos Aires, Argentina
- Privacy contact
- grc@cloudlegion.com.ar
Cloud Legion has a designated privacy and personal data protection officer, independent of operational areas and reporting to the board and the Cybersecurity Committee, who is the point of contact with supervisory authorities.
Principles
- Transparency: we clearly explain what data we process, why, who we share it with and how to exercise your rights.
- Minimization: we only request the data strictly needed for the stated purposes.
- Quality: we keep data accurate, complete and up to date.
- Security: we apply physical, administrative and technical measures that protect data throughout its life cycle.
- Data subject participation: we offer simple ways for each person to control their data and exercise their rights.
- Privacy by design and by default: systems are designed and configured to protect personal data from the start.
- Risk management and proportionality: we identify and treat privacy risks, with measures proportional to the sensitivity of the data.
- Continual improvement: we periodically review and update our measures, audited by qualified staff.
Management commits to promoting these responsibilities, providing the necessary resources, raising staff awareness, requiring compliance with this policy and applicable legislation, and taking privacy risks into account in decision-making.
Personal data we process
Clients and suppliers
- Identification and contact details: first and last name, company name, phone number, email address and address.
- Financial data needed for invoicing and payments.
- Professional details of contact people.
Site visitors, job applicants and subscribers
- The data you send us by email or WhatsApp for enquiries or job applications: first and last name, company, email address, phone number, message and, for job applications, your professional profile.
- Technical connection data (for example, IP address and browser type) logged by the site’s servers for security and operational reasons. The use of cookies is described in the Cookie Policy.
Data we process on behalf of our clients
When we provide services in which we process personal data on behalf of a client, we act as a data processor: the client is the controller towards the data subjects, and we only use the data according to their instructions.
If the necessary data is not provided, the services or the business relationship may be affected. Please keep your data up to date.
Purposes
- Answer enquiries and prepare proposals.
- Provide contracted services and manage our relationship with clients, suppliers, team members and job applicants.
- Send the updates the person has subscribed to.
- Improve the quality, security and efficiency of our services through internal analysis, transparently and respecting data subjects’ rights.
- Meet legal obligations.
We do not sell personal data or use it for purposes other than those stated.
Security and confidentiality
We manage data throughout its life cycle (collection, distribution, use, storage and destruction): we classify and protect it according to its sensitivity, make automated backups with cloud redundancy, prevent information leaks and, once retention periods expire, delete it by means that guarantee its confidentiality. Everyone involved in processing is bound by confidentiality, even after the relationship ends, except for court orders or well-founded reasons of public safety, national defense or public health.
International transfers
Some data may be transferred to Cloud Legion firms or affiliates in the countries where we operate, or hosted with cloud service providers. In all cases we apply the same confidentiality and protection standards, in accordance with Law 25,326’s rules on international transfers.
Your rights
As the data subject, you may at any time exercise your rights of:
- Access to your personal data, free of charge and at intervals of no less than six months, unless you show a legitimate interest.
- Rectification and updating of inaccurate or incomplete data.
- Erasure.
- Objection and restriction of processing.
- Portability: receiving your data in a structured, commonly used format.
- Withdrawal of consent.
- Not being subject to decisions based solely on automated processing that significantly affect you.
To exercise them, write to grc@cloudlegion.com.ar. We will reply within the time limits set by Law 25,326.
Argentina’s Agency for Access to Public Information (AAIP), as the supervisory authority under Law 25,326, handles complaints from anyone whose rights are affected by non-compliance with personal data protection rules.
Retention
We keep data for as long as needed to fulfil the stated purposes and legal obligations, for a maximum of 10 years in accordance with sections 328 and 329 of Argentina’s Civil and Commercial Code, unless a regulation sets another period. Reasons for retention include legal compliance, performance of contracts, legitimate business purposes consistent with data subjects’ expectations, legal defense, employment records, security and audit, and internal investigations. Data from enquiries that do not lead to a business relationship is deleted once it is no longer needed.
Compliance and changes
We provide the resources needed to comply with applicable privacy and data protection legislation. Every exception to this policy is recorded and analyzed according to the risk it introduces, and non-compliance by staff may lead to disciplinary action. We may update this policy to reflect regulatory changes or changes to our services; the current version is always the one published on this site.