Privacy.
What you send us goes to our mailbox and nowhere else. This page says exactly where, for how long, and how to have it removed.
What we collect, and why
When you use the form, we receive what you type: your name, the company you name, the problem you describe, and the email address or phone number you give us. When you book a call, Microsoft Bookings collects your name, email address and the slot you chose. That is all. We use it for one purpose: to answer you and, if you become a client, to do the work. The legal basis is our legitimate interest in replying to someone who asked us to, and then the contract between us.
Where it goes
A form submission is checked for bots and delivered by a small Cloudflare Worker, which sends it through Microsoft 365 to our Microsoft 365 mailbox, where it is stored. We also record the enquiry in our own customer records, on our own server in Cyprus. The Worker keeps nothing. A booking is made and stored in Microsoft 365. An AI assistant we run helps sort incoming enquiries and drafts nothing that is sent without a person reading it; the assistant sees the enquiry in order to file it. A person from our team reads every enquiry. We do not sell, share, rent or trade a single address, and we do not use your data for advertising.
Who processes it for us
Cloudflare, Inc. (hosting, bot check and form delivery) and Microsoft Ireland Operations Ltd (mailbox, calendar, bookings and document storage). Both act on our instructions under their standard data processing terms. An AI assistant helps sort enquiries; it processes the text of the enquiry for that purpose only and does not use it to train anything. Where any of these providers moves data outside the European Economic Area, they do so under the EU standard contractual clauses or an adequacy decision.
How long we keep it
An enquiry that does not become work is deleted, from the mailbox and from our customer records, twenty-four months after the last message. Client records are kept for as long as the engagement runs and then for the period Cypriot tax and company law requires us to keep business records, which is six years from the end of the relevant year. Booking records follow the same rule.
Your rights
You can ask us what we hold on you, ask us to correct it, ask us to delete it, ask us to stop using it, or ask for a copy in a portable form. Write to legal [at] theofficelab.eu and we do it within the same week, and in any case within the month the law allows. If you think we have got something wrong, you can complain to the Commissioner for Personal Data Protection in Cyprus, or to the data protection authority in your own country.
Inside your systems
When we do work for you inside your Microsoft tenant, we see whatever that work requires, and we act as your processor on your instructions. What we see stays inside your business. Our terms say so in writing, and we sign a data processing agreement where your engagement needs one.
Children
This site and our services are for businesses. We do not knowingly collect data from anyone under eighteen.
Contact
legal [at] theofficelab.eu. One working day, English or Dutch.