Privacy
Policy

The data controller is Fusiora OÜ, registered at Harju maakond, Tallinn, Kesklinna linnaosa, Tornimäe tn 5, 10145, Estonia. Company ID: 16994706 · VAT: EE102745315.

Data protection contact: Mr. Samuel Alvarez — info@fusiora.com.

Fusiora OÜ is not legally required to appoint a Data Protection Officer (DPO) under Art. 37 GDPR, but has designated a single point of contact for all matters concerning personal data processing and the exercise of data subject rights.

We process your personal data under Art. 6 GDPR, on the following legal bases depending on the purpose:

1. Performance of contract (Art. 6(1)(b)) — provision of contracted services, billing, technical support, and provisioning.
2. Legal obligation (Art. 6(1)(c)) — accounting, taxation, anti-money laundering (KYC), response to judicial requests.
3. Legitimate interest (Art. 6(1)(f)) — network security, fraud prevention, anti-abuse, service improvement, direct marketing to existing customers.
4. Consent (Art. 6(1)(a)) — non-essential cookies, marketing communications to prospects, public testimonials.
5. Vital interest (Art. 6(1)(d)) — cooperation with authorities in exceptional situations requiring protection of life.

Legitimate interest has been assessed through a balancing test (LIA). You may request a summary by writing to info@fusiora.com.

We collect the following categories of data:

1. Identification — first name, last name, ID document when KYC applies, date of birth.
2. Contact — email address, phone, postal address.
3. Billing — tax address, Tax ID/VAT, invoice history. Card data is not stored in our systems; it is tokenised by a PCI-DSS payment provider.
4. Technical — IP address, browser type and version, operating system, device identifiers, approximate geolocation by IP.
5. Service usage — access logs, server logs, consumption metrics, support tickets.
6. Account — credentials (hashed), preferences, language, 2FA key.
7. Cookies and similar technologies — session identifiers, consent records, analytics.
8. Communications — content of tickets, emails and chat with support.

We do not process special categories of data (Art. 9 GDPR: health, racial origin, sexual orientation, biometric data, etc.). If inadvertently submitted in tickets, it will be deleted without processing.

Data is processed exclusively for:

1. Provision and management of contracted services (hosting, domains, VPS, support).
2. Billing, collection, bad-debt management and tax compliance.
3. Identity verification (KYC) and anti-fraud / anti-money laundering compliance.
4. Infrastructure security, abuse detection and attack mitigation.
5. Customer care, query response and incident resolution.
6. Service communications (technical notices, maintenance, renewals).
7. Direct marketing to existing customers regarding similar services, with a permanent right to object.
8. Aggregated analytics and continuous service improvement.
9. Compliance with legal obligations and response to competent authorities.

A. Where processing is based on consent, it is collected freely, specifically, informed and unambiguously, through an affirmative action (unchecked checkbox, click on cookie banner, etc.).

B. You may withdraw consent at any time by writing to info@fusiora.com or from your client panel. Withdrawal does not affect the lawfulness of prior processing.

C. Withdrawal of consent may prevent the provision of features that rely exclusively on that legal basis.

We retain data only for as long as necessary for the purposes described:

1. Active account data — for the entire duration of the service.
2. Account data after termination — up to 180 days to allow reactivation, then anonymised or deleted.
3. Billing data — 7 years under Estonian tax law and EU directives.
4. KYC and AML data — 5 years after the end of the relationship, under Directive (EU) 2015/849.
5. Access logs and security logs — up to 12 months on the basis of legitimate interest in security.
6. Support tickets — 3 years after closure for historical record and service quality.
7. Cookies — as stated in the cookie policy (max. 13 months).
8. Data following serious incident or fraud — up to an additional 365 days for investigation and legal disclosure.

Once the retention periods have elapsed, data is irreversibly deleted or anonymised, including rotating backups.

You have the following rights, exercisable free of charge by writing to info@fusiora.com:

1. Access (Art. 15) — obtain confirmation and a copy of the data we process about you.
2. Rectification (Art. 16) — correct inaccurate or incomplete data.
3. Erasure / right to be forgotten (Art. 17) — delete your data when no longer necessary or when you withdraw consent.
4. Restriction of processing (Art. 18) — restrict the use of your data in certain cases.
5. Portability (Art. 20) — receive your data in a structured, commonly used, machine-readable format, or request direct transmission to another controller.
6. Objection (Art. 21) — object to processing based on legitimate interest or to direct marketing at any time.
7. Not to be subject to automated decisions (Art. 22) — including profiling with significant legal effects.
8. Withdrawal of consent (Art. 7(3)) — without retroactive effect on prior processing.
9. Complaint to supervisory authority (Art. 77) — Andmekaitse Inspektsioon (AKI) in Estonia, or your national authority.

We will respond within a maximum period of 1 month from receipt (extendable to 2 months for complex requests, with prior notice). We may require reasonable identity verification.

Some processors are located outside the European Economic Area (EEA), mainly in the United States and the United Kingdom. For these transfers we apply one or more of the safeguards provided in Chapter V of the GDPR:

1. Adequacy decision (Art. 45) — United Kingdom; United States only with regard to companies certified under the EU-US Data Privacy Framework (DPF).
2. Standard Contractual Clauses (Art. 46(2)(c)) — SCCs approved by the European Commission (Decision 2021/914) for transfers not covered by adequacy.
3. Supplementary measures — encryption in transit and at rest, access controls, transfer impact assessments (TIAs).

You may request a copy of the applicable SCCs or information on the location of each processor by writing to info@fusiora.com.

We share data with the following processors, all bound by a data processing agreement under Art. 28 GDPR:

1. WHMCS Ltd (United Kingdom) — billing and CRM management. Basis: UK adequacy decision.
2. Cloudflare Inc. (USA) — CDN, WAF, DDoS mitigation. Basis: SCCs + DPF.
3. Bunny.net (BunnyWay d.o.o.) (Slovenia) — CDN and static content delivery. Basis: EEA.
4. Crisp IM SAS (France) — live support chat. Basis: EEA.
5. Trustpilot A/S (Denmark) — review collection. Basis: EEA + consent.
6. Stripe Payments Europe Ltd (Ireland) — card payment processing. Basis: EEA.
7. Datacenter providers (EU) — physical server hosting in Germany, France, the Netherlands and Estonia.
8. Sentry (Functional Software Inc.) (USA) — error tracking. Basis: SCCs + DPF.
9. FraudRecord — industry fraud prevention. Basis: legitimate interest + SCCs.

An up-to-date list is available on request. Processors may not use your data for any other purpose or engage sub-processors without prior written authorisation.

We implement appropriate technical and organisational measures in accordance with Art. 32 GDPR:

1. TLS 1.3 encryption in transit for all web and API communications.
2. Encryption at rest (AES-256) for backups and sensitive data.
3. Bcrypt/argon2 hashing for passwords; rotating session tokens.
4. Role-based access control (RBAC) with least-privilege principle.
5. Mandatory two-factor authentication (2FA) for staff with data access.
6. Network segmentation, perimeter firewalls and WAF.
7. Access logging and monitoring; anomaly detection.
8. Encrypted backups regularly tested.
9. Annual penetration tests and security audits.
10. Regular data protection training for all staff.
11. Documented incident response and breach notification procedure.

We use strictly necessary cookies for the site's functioning (session, authentication, language preference, load balancing) which do not require consent under Art. 5(3) of the ePrivacy Directive.

Non-essential analytics and preference cookies are activated only after your explicit consent via the cookie banner, where you can accept, reject or configure by category.

You may withdraw or modify your consent at any time via the "Cookie Preferences" link in the footer.

See the Cookie Policy for full details on each cookie, purpose, duration and provider.

We use limited automated systems for:

1. Fraud detection — analysis of order patterns, IP, payment method and device fingerprint to prevent fraud. It may result in manual review or order rejection.
2. KYC scoring — automated risk assessment for anti-money laundering compliance.
3. Anti-spam and anti-abuse filtering — in email and network services.

You have the right (Art. 22) not to be subject to decisions based solely on automated processing with significant legal effects. In such cases, you may request human intervention, express your point of view and contest the decision by writing to info@fusiora.com.

We may send you commercial communications about services similar to those you have contracted, based on legitimate interest (soft opt-in) under Art. 13(2) of the ePrivacy Directive.

For communications to prospects or about unrelated products, we will request prior explicit consent.

You may object to direct marketing at any time, free of charge and without justification, via the "Unsubscribe" link included in every email, from your client panel or by writing to info@fusiora.com. The objection will take effect without delay.

Our services are not directed at children under the age of 16 (13 years in Estonia, pursuant to Art. 8 GDPR and § 8 of the Estonian Personal Data Protection Act).

We do not knowingly collect data from minors without the verifiable consent of a parent or legal guardian. If we detect that we have processed a minor's data without such consent, we will delete the information without delay.

If you are a parent or guardian and believe that a minor in your care has provided personal data, contact info@fusiora.com for immediate removal.

In the event of a security breach affecting personal data:

1. Notification to the supervisory authority (AKI Estonia) within a maximum of 72 hours of detection, under Art. 33 GDPR.
2. Notification without undue delay to affected data subjects where there is a high risk to their rights and freedoms, under Art. 34 GDPR.
3. Communication of the scope, nature, categories affected, measures taken and recommendations.
4. Immediate containment, forensic investigation and reinforcement of measures to prevent recurrence.

We keep an internal register of all breaches, under Art. 33(5) GDPR.

Most data is obtained directly from you. Occasionally we receive data from third parties:

1. Payment providers (Stripe, PayPal, etc.) — payment confirmation and anti-fraud signals.
2. Domain registrars — when you transfer a domain to Fusiora.
3. FraudRecord and industry anti-fraud networks — risk signals.
4. KYC verification agencies — identity validation.
5. Public sources (commercial registers, sanctions lists) — AML compliance.

A. We may disclose data to law enforcement or competent authorities only upon a valid legal request (court order, tax requisition, etc.), following the principles of necessity, proportionality and minimisation. Requests: info@fusiora.com.

B. Authorised internal staff may access data for operational, support or compliance purposes under strict confidentiality and RBAC controls.

C. In the event of a merger, acquisition or sale of assets, data may be transferred to the successor, subject to prior notification and the same safeguards.

D. We do not sell personal data to third parties under any circumstances.

Our services may contain links to third-party sites. Fusiora is not responsible for their data practices. Review their privacy policies independently before providing them with information.

If you consider that a request has been denied or mishandled, you may appeal internally within 28 calendar days of the response, by writing to info@fusiora.com.

Regardless of the internal appeal, you retain the right to lodge a complaint with the competent supervisory authority:

Andmekaitse Inspektsioon (AKI) — Tatari 39, 10134 Tallinn, Estonia · aki.ee · info@aki.ee.

You may also refer the matter to the supervisory authority of your country of residence if you reside in another EEA Member State.

We may update this policy to reflect legal, technical or operational changes. The current version is always published on this page with the date of last review.

In case of material changes affecting your rights or the processing, we will notify you at least 30 days in advance by email or prominent notice in the client panel.

Version history available on request at info@fusiora.com.