Who we are
This policy explains how Rackyard handles personal data. The data fiduciary (controller) responsible for your data is Rackyard. You can reach us about privacy at support@rackyard.cloud.
We follow the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000. If you are in the European Economic Area or the United Kingdom, the GDPR also gives you the rights described below.
What we collect
- Account and identity details: your name, email address, phone number, postal address, company details and GSTIN if you give them, the purpose you are hiring a server for, and, where we ask for it, a copy of an identity document.
- Billing records: your orders, invoices and payments. Card and bank details are handled by our payment providers; we do not see or store full card numbers.
- Service records: the services you hire, their dates, and the IP addresses assigned to them.
- Contact form submissions and support correspondence: what you send us and our replies.
- Technical logs: IP addresses, login times, access logs, resource usage and similar records from our website, client area and network, which we use to keep our systems secure and to investigate problems and abuse.
The contents of your servers are yours. We do not inspect the files or data on your server, except where we need to investigate abuse, where the law requires it, or where you ask us to help with something. If you store other people’s personal data on your server, you are responsible for it, and we process it only to host it for you.
Why we use your data
- To provide the services you order: setting up and running your services, billing, and sending service notices. You give us this data so that we can do so.
- To verify who you are and keep the subscriber records that the CERT-In directions require of virtual server providers.
- To answer your enquiries and support requests, including messages sent before you become a customer.
- To keep our network and customers safe: preventing fraud, detecting and investigating abuse, and securing our systems.
- To meet legal obligations, such as keeping accounting records and responding to lawful requests from authorities.
We will only send you marketing email if you have asked for it, and every such email lets you unsubscribe. We do not use your data for automated decisions that significantly affect you, apart from fraud screening of orders, which a person reviews before an order is refused.
How long we keep it
| Data | How long |
|---|---|
| Account details and identity verification records | While your account is open, then 5 years after it closes (required by the CERT-In directions) |
| Records of the services you hired and the IP addresses assigned to them | While the service runs, then 5 years after it ends (CERT-In) |
| Invoices, payments and other accounting records | 8 years (Indian tax and company law) |
| Support tickets and correspondence | 2 years after your account closes |
| Contact form messages that do not lead to an account | 12 months |
| Website, client area and network logs | 180 days (CERT-In), or longer when part of an abuse or security investigation |
| Abuse and fraud records | Up to 5 years after the account closes, to prevent repeat abuse |
| The contents of your server | Deleted when the service is terminated; we keep no copy |
When a period ends, we delete the data or make it anonymous.
Security
We protect personal data with reasonable technical and organisational measures, including encryption in transit, two-factor authentication for staff, and limiting access to the people who need it. No system is perfectly secure. If a breach affects your personal data, we will tell you and the Data Protection Board of India as the DPDP Act requires, and report it to CERT-In where the incident falls under its directions.
Where your data is processed
Your data may be processed outside the country where you live: in India, and in the countries where our servers and service providers operate. We transfer it only to countries the Indian government has not restricted, and, for customers in Europe, with the safeguards the GDPR requires, such as standard contractual clauses.
Your rights
You can ask us to:
- give you a summary of the personal data we hold about you and how we use it;
- correct, complete or update it;
- erase it, where we no longer need it and the law does not require us to keep it;
- withdraw consent you have given, such as for marketing email; and
- name another person to exercise these rights for you if you die or become unable to (your nominee).
If you are in Europe or the UK, you can also restrict or object to how we use your data and receive a copy in a portable format.
To make a request, email support@rackyard.cloud. We may need to confirm your identity first. We reply within 30 days. Some data, such as billing and verification records, has to be kept for the periods above even if you ask us to delete it; we will tell you when that applies.
Children
Our services are for adults. We do not knowingly collect personal data from anyone under 18, and we delete it if we find we have.
Complaints
If you are unhappy with how we handle your data, email support@rackyard.cloud and we will reply within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India, or, in Europe or the UK, to your local data protection authority.
Changes to this policy
We will post any update on this page. If a change materially affects how we use your data, we will also email account holders before it takes effect.