Legal Center | CloudBridgeCode Privacy, Terms, Cookies & Refunds

Block 01

Privacy Policy (GDPR / CCPA)

1. Controller. CloudBridgeCode, registered at Vier Ruten 54, 28357 Bremen, Germany ("CloudBridgeCode", "we", "us"), is the data controller for personal data processed through this website and our cybersecurity services. Data protection inquiries may be sent to [email protected].

2. Legal bases. We process personal data under Article 6 GDPR on the following bases: (a) performance of a contract or pre-contractual steps at your request; (b) legitimate interests in operating, securing, and improving our services and responding to inquiries; (c) consent, which you may withdraw at any time; and (d) legal obligations under German and EU law.

3. Categories of data & purposes. We collect contact details (name, email, phone, company), inquiry content, billing data processed by our payment provider, and technical logs (IP address, device, timestamps) required for site security and abuse prevention. Data submitted through the contact console is used solely to respond to your request, prepare proposals, and deliver contracted security services.

4. Recipients & processors. Personal data is shared only with vetted processors acting under Article 28 GDPR data-processing agreements — including our hosting, email, analytics, and Stripe payment infrastructure — and with authorities where lawfully required. We do not sell personal information.

5. International transfers. Where data is transferred outside the EEA, we rely on adequacy decisions, Standard Contractual Clauses, or other safeguards recognized under Chapter V GDPR.

6. Retention. Inquiry data is retained for up to 24 months after the last interaction. Contract and invoice records are retained for 10 years to comply with German commercial and tax law (§§ 147 AO, 257 HGB). Technical logs are rotated after 12 months unless needed for incident investigations.

7. Your rights. Under GDPR you have the right of access, rectification, erasure, restriction, portability, and objection, plus the right to lodge a complaint with the competent supervisory authority (Landesbeauftragte für Datenschutz und Informationsfreiheit Bremen). To exercise rights, email [email protected].

8. CCPA notice (California). California residents may request disclosure of categories and specific pieces of personal information collected, request deletion, and opt out of any "sale" or "sharing" as defined by the CCPA/CPRA. CloudBridgeCode does not sell personal information. Requests may be submitted to our support email above; we will not discriminate against you for exercising these rights.

Block 02

Terms of Service

1. Parties & scope. These Terms govern all services provided by CloudBridgeCode, Vier Ruten 54, 28357 Bremen, Germany, including threat detection, zero-trust architecture, compliance automation, penetration testing, incident response, and related advisory work. By engaging our services or using this website you accept these Terms.

2. Statements of Work. Each engagement is defined in a written Statement of Work (SOW) specifying scope, deliverables, timelines, fees, and acceptance criteria. The SOW prevails over these Terms where expressly stated. Work outside the agreed scope requires written change-order approval.

3. Fees & payment. Prices are quoted in USD or EUR as stated in the SOW and are exclusive of VAT where applicable. Invoices are payable within 14 days of issue unless otherwise agreed. Payments may be made via the Stripe payment link provided on our site. Late payments may accrue statutory default interest (§ 288 BGB) and suspend delivery.

4. Client responsibilities. You will provide timely access to systems, credentials (via secure channels), documentation, and personnel reasonably required for delivery. Delays in client cooperation may extend timelines; CloudBridgeCode is not liable for impacts caused by such delays.

5. Intellectual property. Upon full payment, all intellectual property rights in client-specific deliverables, custom code, and reports are assigned to you. CloudBridgeCode retains rights to pre-existing tools, methodologies, frameworks, and generic know-how, which are licensed to you on a perpetual, non-exclusive basis for your internal use.

6. Confidentiality. Each party will protect the other's confidential information with at least the care it uses for its own, and no less than reasonable care, for five years after disclosure, or longer where trade secrets apply.

7. Security testing authorization. Penetration testing and red-team work is performed only against systems you own or are expressly authorized to test. You represent that written authorization exists for all target assets. Unauthorized testing of third-party systems is prohibited.

8. Liability. To the fullest extent permitted by law, CloudBridgeCode's aggregate liability arising from an engagement is limited to the fees paid for the affected SOW in the twelve months preceding the claim. We are not liable for indirect, consequential, or lost-profit damages. Nothing limits liability for intent, gross negligence, or mandatory statutory liability (e.g., under the German Product Liability Act).

9. Termination. Either party may terminate an SOW for material breach with 14 days' written cure notice. Upon termination you pay for work performed up to the termination date. Sections that by nature should survive (confidentiality, IP, liability, payment) survive termination.

10. Governing law. These Terms are governed by the laws of the Federal Republic of Germany, excluding its conflict-of-law rules. The place of jurisdiction for merchants is Bremen. Mandatory consumer protections remain unaffected.

Block 03

Cookie Policy

1. What cookies are. Cookies are small text files placed on your device by websites you visit. Similar technologies (local storage, session storage) may store or read information on your device. This policy explains how CloudBridgeCode, Vier Ruten 54, 28357 Bremen, Germany, uses such technologies.

2. Strictly necessary cookies. We use essential cookies required for core site functions — including session integrity, load balancing, security protections (CSRF tokens), and your cookie-consent preference stored under the key cookie_accepted. These cannot be disabled through our banner without breaking basic functionality.

3. Preference & analytics cookies. Where enabled, preference cookies remember your settings, and analytics cookies help us understand aggregated traffic patterns so we can improve content and performance. Analytics data is pseudonymized where feasible.

4. Third-party cookies. Embedded services (such as the Google Maps iframe on our contact page) may set cookies when loaded. Google's handling of data is governed by Google's own policies. Payment interactions on Stripe are subject to Stripe's cookie and privacy policies.

5. Consent & control. Non-essential cookies are set only after you click "Get Started" on our cookie banner. You may clear or block cookies through your browser settings at any time; blocking essential cookies may impair site features. Withdrawing consent does not affect the lawfulness of prior processing.

6. Retention. The consent flag persists in your browser's localStorage until you clear site data. Session cookies expire when you close the browser. Analytics cookies, where used, expire within a maximum of 13 months.

7. Contact. Questions about this Cookie Policy can be directed to [email protected].

Block 04

Refund Policy

1. Commitment. CloudBridgeCode stands behind the quality of its cybersecurity deliverables. Refunds are handled fairly and in accordance with applicable EU consumer protection law and the terms of your Statement of Work.

2. Fixed-scope projects. For fixed-price engagements (e.g., penetration tests, compliance assessments, architecture builds), you may cancel before work begins for a full refund minus any non-recoverable third-party costs already incurred. After kickoff, fees are non-refundable except as stated below, because specialist time is reserved exclusively for your engagement.

3. Dissatisfaction remedy. If a delivered fixed-scope deliverable materially fails to meet the acceptance criteria in the SOW, notify us within 14 days of delivery. We will, at our choice, re-perform the deficient work at no charge or issue a pro-rata refund for the affected portion.

4. Subscriptions & retainers. Monthly services (managed detection, incident response retainers) may be cancelled effective at the end of the current billing period; prepaid partial months are non-refundable unless mandatory law provides otherwise. Annual retainers cancelled within the first 30 days receive a pro-rata refund for unused full months.

5. Duplicate & erroneous payments. Duplicate charges or payments taken in error will be refunded in full to the original payment method within 10 business days of confirmation.

6. Statutory rights. Where you act as a consumer and a distance contract right of withdrawal applies under § 355 BGB / EU consumer directives, you have 14 days from conclusion to withdraw without reason. This right does not apply to fully performed services already begun with your express prior consent and acknowledgment of waiver.

7. Refund method & contact. Approved refunds are issued to the original payment method (typically via Stripe) within 10 business days. To request a refund, contact [email protected] with your invoice or payment reference.

Legal & Governance Center

Privacy Policy (GDPR / CCPA)

Terms of Service

Cookie Policy

Refund Policy