Privacy policy

Who we are

Data controller: DX Clouditive LLC, 7901 4th ST N STE 300, St. Petersburg, FL 33702, United States.

Contact for privacy matters: Mat Caniglia, mat@dxclouditive.com.

DX Clouditive LLC does not have a designated Data Protection Officer. Given the scale and nature of our processing, a DPO is not required under Article 37 of the GDPR. You can direct all data protection inquiries to the contact above.

Information we collect

We collect the following categories of personal information:

Contact and identity data: your name, email address, company name, and job role, which you provide when you fill out a contact form, request an assessment, or correspond with us.

Assessment responses: answers you submit through our self-assessment tools, which may include information about your engineering organization and technology practices.

Usage and technical data: your IP address, browser type, and the pages you visit on dxclouditive.com. This data is processed by Cloudflare as part of hosting and network security. We do not operate our own analytics platform.

We do not collect sensitive categories of personal data (for example, health data, financial account numbers, or government identification numbers) through this website.

Providing your contact data is voluntary. However, without it we cannot respond to your inquiry or deliver assessment results.

Why we process your data and the legal basis

We process your personal data for the following purposes, each with an identified legal basis under Article 6 of the GDPR:

Responding to inquiries (legal basis: legitimate interests, Article 6(1)(f)). When you contact us, we have a legitimate interest in reading and replying to your message. This interest is not overridden by your privacy interests because the communication is initiated by you and is directly related to a service you requested.

Delivering assessment results (legal basis: performance of a contract or pre-contractual steps, Article 6(1)(b)). When you complete a self-assessment, processing your responses is necessary to generate and send you the results you requested.

Managing ongoing consulting engagements (legal basis: performance of a contract, Article 6(1)(b)). If you become a client, processing your contact and organizational data is necessary to perform the services described in our engagement agreement.

We do not rely on consent as the primary legal basis for any of the processing described above. If we introduce processing that requires consent in the future, we will update this policy and obtain your consent before that processing begins.

Data processors and recipients

We share your personal data with the following categories of recipients acting as data processors on our behalf:

Microsoft Corporation (Microsoft 365 and Graph API): we use Microsoft 365 to receive, store, and manage email correspondence and contact records. Microsoft processes data under its Data Processing Agreement and Standard Contractual Clauses.

Cloudflare, Inc.: our website is hosted on Cloudflare Pages and routed through Cloudflare's network. Cloudflare processes IP addresses and request metadata for security, performance, and DNS resolution. Cloudflare processes data under its Data Processing Addendum.

We do not sell, rent, or share your personal data with third parties for their own marketing or commercial purposes. We do not share your data with data brokers.

We may disclose your data if required by law or in response to valid legal process, in which case we will notify you to the extent permitted by law.

International transfers

DX Clouditive LLC is based in the United States. If you are located in the European Economic Area, the United Kingdom, or Switzerland, your personal data will be transferred to and processed in the United States, which is a third country under the GDPR.

For transfers to Microsoft, we rely on the Standard Contractual Clauses (SCCs) adopted by the European Commission (Commission Decision 2021/914) incorporated into Microsoft's Data Processing Agreement.

For transfers processed by Cloudflare, we rely on the SCCs incorporated into Cloudflare's Data Processing Addendum.

You may request a copy of the applicable transfer mechanism by contacting mat@dxclouditive.com.

How long we keep your data

We retain your personal data only as long as necessary for the purposes for which it was collected, or as required by applicable law.

Inquiry correspondence: email records are retained for 3 years from the date of your last communication, after which they are deleted or anonymized.

Assessment responses: retained for 2 years from submission, or for the duration of an active engagement plus 1 year, whichever is longer.

Client engagement records: retained for 7 years after the close of an engagement to comply with applicable US business record-keeping obligations.

Cloudflare technical logs (IP address, request metadata): retained by Cloudflare for up to 7 days under their standard log retention configuration.

When the retention period expires, your data is deleted or anonymized so that it can no longer be associated with you.

Your rights under GDPR

If you are located in the EEA, the UK, or Switzerland, you have the following rights under applicable data protection law. We will respond to verified requests within 30 days.

Right of access (Article 15): you may request a copy of the personal data we hold about you.

Right to rectification (Article 16): you may request that we correct inaccurate or incomplete data.

Right to erasure (Article 17): you may request that we delete your personal data where there is no overriding legal reason to retain it.

Right to restriction of processing (Article 18): you may request that we pause processing while a dispute is resolved.

Right to data portability (Article 20): where processing is based on your consent or a contract, you may request your data in a structured, machine-readable format.

Right to object (Article 21): where processing is based on our legitimate interests, you may object. We will stop processing unless we can demonstrate compelling legitimate grounds.

Right to withdraw consent: if we rely on consent for any processing (we do not currently), you may withdraw it at any time without affecting the lawfulness of prior processing.

Right to lodge a complaint: if you believe we have not complied with applicable data protection law, you have the right to lodge a complaint with your local supervisory authority. In the EU, you can find your authority at edpb.europa.eu/about-edpb/about-edpb/members_en. In the UK, the relevant authority is the Information Commissioner's Office at ico.org.uk.

To exercise any of these rights, contact mat@dxclouditive.com with your request. We may need to verify your identity before processing the request.

Your rights under CCPA (California residents)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you the following rights.

Right to know: you may request that we disclose the categories and specific pieces of personal information we have collected about you, the sources, the business purposes, and the categories of third parties with whom we share it.

Right to delete: you may request that we delete personal information we have collected from you, subject to certain exceptions.

Right to correct: you may request that we correct inaccurate personal information we maintain about you.

Right to opt out of sale or sharing: we do not sell your personal information and do not share it for cross-context behavioral advertising. No opt-out mechanism is required.

Right to limit use of sensitive personal information: we do not collect sensitive personal information as defined by the CPRA.

Non-discrimination: we will not discriminate against you for exercising any of these rights. Exercising your rights will not affect the quality or availability of our services.

To submit a CCPA request, contact mat@dxclouditive.com. We will verify your identity and respond within 45 days, with one possible 45-day extension where necessary.

Cookies and tracking technologies

We do not use tracking cookies, analytics cookies, or behavioral advertising cookies. We rely on Cloudflare's infrastructure, which may set essential cookies for security and routing purposes. These cookies do not identify you as an individual and are not used to build profiles. No cookie consent banner is currently active on this site because no non-essential cookies are set.

Automated decision-making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on individuals, as described in Article 22 of the GDPR.

Children's privacy

Our website and services are directed at business professionals. We do not knowingly collect personal data from individuals under the age of 16. If you believe we have inadvertently collected data from a minor, contact mat@dxclouditive.com and we will delete it promptly.

Changes to this policy

We may update this policy to reflect changes in our practices or applicable law. When we do, we will update the "Last updated" date at the top of this page. Material changes will be communicated by posting a notice on dxclouditive.com. We encourage you to review this policy periodically.

Contact

For any questions or requests related to this privacy policy or your personal data, contact mat@dxclouditive.com. We aim to respond within 10 business days.