Privacy.
What you send us goes to our mailbox and nowhere else. This page says exactly where, for how long, and how to have it removed.
What we collect, and why
When you use the form, we receive what you type: your name, the company you name, the problem you describe, and the email address or phone number you give us. When you book a call, Microsoft Bookings collects your name, email address and the slot you chose. When you sign up for a training, we receive your name, your email address, the company you name if you give one, and the courses you chose. That is all. We use it only to answer you, to invite you to a session of a course you signed up for, and, if you become a client or join a session, to do the work. The legal basis is our legitimate interest in replying to someone who asked us to, and then the contract between us.
Where it goes
A form submission is checked for bots and delivered by a small Cloudflare Worker, which sends it through Microsoft 365 to our Microsoft 365 mailbox, where it is stored. We also record the enquiry in our own customer records, on our own server in Cyprus. The Worker keeps nothing. A booking is made and stored in Microsoft 365. An AI assistant we run helps sort incoming enquiries and drafts nothing that is sent without a person reading it; the assistant sees the enquiry in order to file it. A person from our team reads every enquiry. We do not sell, share, rent or trade a single address, and we do not use your data for advertising.
Who processes it for us
Cloudflare, Inc. (hosting, bot check and form delivery) and Microsoft Ireland Operations Ltd (mailbox, calendar, bookings and document storage). Both act on our instructions under their standard data processing terms. An AI assistant helps sort enquiries; it processes the text of the enquiry for that purpose only and does not use it to train anything. Where any of these providers moves data outside the European Economic Area, they do so under the EU standard contractual clauses or an adequacy decision.
How long we keep it
An enquiry that does not become work is deleted, from the mailbox and from our customer records, twenty-four months after the last message. Client records are kept for as long as the engagement runs and then for the period Cypriot tax and company law requires us to keep business records; correspondence needed to establish or defend a legal claim is kept for as long as such a claim is possible. Working copies of client data are deleted within thirty days after an engagement ends. Booking records follow the same rule. A training sign-up is kept until we can invite you; if no session of your course takes place, it is deleted twenty-four months after the last message, and you can ask us to remove it at any time.
Your rights
You can ask us what we hold on you, ask us to correct it, ask us to delete it, ask us to stop using it, or ask for a copy in a portable form. Write to legal [at] theofficelab.eu and we do it within the same week, and in any case within the month the law allows. If you think we have got something wrong, you can complain to the Commissioner for Personal Data Protection in Cyprus, or to the data protection authority in your own country.
Inside your systems
When we do work for you inside your Microsoft tenant, we see whatever that work requires, and we act as your processor on your instructions. What we see stays inside your business. Our terms say so in writing, and we sign a data processing agreement where your engagement needs one.
Children
This site and our services are for businesses. We do not knowingly collect data from anyone under eighteen.
Contact
legal [at] theofficelab.eu. One working day, English or Dutch.