Cloud Policy and Personal Data Retention
Purpose
This documentation outlines our Cloud usage, Personal Data Retention, and Data Breach response to ensure compliance with GDPR and other applicable regulations.
It is designed as a living document to be expanded as modules are completed.
Cloud Usage Policy
Cloud Providers and Data Locations
| Cloud Service | Purpose | Data Location |
|---|---|---|
| Firebase Firestore | Application data storage and backup | Frankfurt, Germany |
| Stripe | Payment processing and subscriptions | EU Data Region |
Data Types Stored
- Personal Identifiable Information (PII)
- Payment and billing information
- Usage data, logs, and metadata
- Media uploads (if applicable)
- Device data (if necessary for the service)
Access Management
- Role-Based Access Control (RBAC)
- Mandatory Multi-Factor Authentication (MFA) for administrative access
- Access logs monitored and stored securely
Data Retention Policy
Retention Matrix
| Data Category | Retention Period | Notes |
|---|---|---|
| User Account Data | 5 years post inactivity | Anonymization applies after the period |
| Payment Records (Stripe) | 10 years | Compliance with tax obligations |
| Communication Logs | 3 years | Includes emails, support chats |
| Analytics & Usage Data | 2 years | Aggregated beyond this period |
| Backups (Firestore) | 30 days | Auto-deletion configured |
| Media Content | Until account deletion or request | User-controlled deletion possible |
Deletion and Anonymization Process
- Soft deletion with recovery window where applicable
- Hard deletion from production and backup systems
- Data anonymization after the expiration of retention periods
Data Breach Procedure
Based on the approved Data Breach Management Policy.
Key Steps:
- Identify and analyze the breach
- Contain the breach and mitigate risks
- Notify the Supervisory Authority within 72 hours if required
- Notify affected users if the breach presents a high risk
- Document all breaches, including false positives
- Review and improve security controls
Reporting
All potential incidents must be reported immediately to the Privacy Officer at: privacy@tomorrowtech.it.
User Rights
- Access: Users can request their data in a portable format
- Deletion (Right to be Forgotten): Data can be erased upon verified request
- Correction: Users can update or correct their personal information
Security Measures
- Data encrypted in transit (TLS 1.3) and at rest (AES-256)
- Regular vulnerability assessments and penetration tests
- Strict vendor agreements (DPA) in place with Firebase and Stripe
- Backups stored securely and tested periodically
Third-Party Processors
| Processor | Purpose | Compliance |
|---|---|---|
| Stripe | Payment processing | PCI-DSS Level 1, EU Storage |
| Firebase | Cloud database, storage | GDPR Compliant, Frankfurt server location |
Data Location
| Service | Hosting Country | Ownership |
|---|---|---|
| Firebase | Germany (Frankfurt) | Google-owned infrastructure |
| Stripe | European Union | Stripe EU infrastructure |
Review and Updates
| Responsibility | Compliance / Legal Officer |
|---|---|
| Review Cycle | Annual |
| Next Review Date | 26/03/2026 |
| Last Reviewed | 26/03/2025 |
This documentation is subject to updates as processes and technologies evolve. For questions or updates, contact privacy@tomorrowtech.it.