Data protection built into the platform.

SaaS Drive is built to help partners commercialize software in a way that respects the European General Data Protection Regulation (GDPR) and similar data-protection laws.

The platforms we license include privacy-by-default settings, clear data-processing roles, and contractual safeguards so that partners can explain to their own customers how personal data is handled.

This statement is a general overview. Specific obligations, roles and technical measures are set out in the applicable Master Agreement, Order Form and Data Processing Agreement (DPA).

CloudStrom Inc. (operating as SaaS Drive) is typically the data controller for personal data collected through the SaaS Drive website, demo requests and direct partner relationships.

For white-label deployments, the partner is usually the controller for its own end-customer data, while CloudStrom Inc. acts as a processor or sub-processor, depending on the architecture described in the DPA.

Each party is responsible for the obligations that attach to its role. We document these roles in the DPA so that responsibilities are clear to regulators and data subjects.

We process personal data only where a valid legal basis exists, such as performance of a contract, compliance with a legal obligation, legitimate interests or consent.

Where consent is required — for example for certain marketing cookies or communications — we collect it before processing and make it easy to withdraw.

Partners operating their own white-label instances are responsible for identifying and documenting the lawful basis for their end-customer processing.

Data subjects can exercise GDPR rights including access, rectification, erasure, restriction, objection and data portability by contacting the controller listed in the relevant privacy notice.

SaaS Drive provides technical and operational support to partners so they can respond to these requests within applicable timeframes.

Requests directed to SaaS Drive are forwarded to the relevant partner when that partner is the controller.

The SaaS platforms use encryption in transit, access controls, audit logging, regular security reviews and infrastructure-level monitoring.

We apply least-privilege access, separate environments where appropriate, and review subprocessors against security and privacy criteria.

Partners retain responsibility for their own account security, user management and any custom integrations they add.

CloudStrom Inc. uses a limited set of subprocessors for hosting, email delivery, analytics, billing, support and security operations.

Subprocessors are contractually bound to process data only on our instructions and to maintain appropriate safeguards.

A current subprocessor list is available on request and may be updated as services evolve.

When personal data is transferred outside the European Economic Area, we rely on appropriate transfer mechanisms such as Standard Contractual Clauses (SCCs) and, where applicable, adequacy decisions.

Transfer impact assessments are carried out for transfers that may present heightened risk, and supplementary measures are applied where needed.

SaaS Drive maintains an incident-response process and will notify affected partners without undue delay where we become aware of a personal-data breach that affects their data.

Partners are responsible for notifying their own end customers or regulators when they are the controller and notification is required by law.

A Data Processing Agreement is available to partners and sets out the subject matter, duration, nature and purpose of processing, the types of personal data and categories of data subjects, and each party's obligations.

To request a DPA or ask questions about GDPR compliance, contact us through the Contact page or your account representative.

This GDPR statement may be updated to reflect changes in law, technology or our services. Material changes will be posted on the website and, where appropriate, communicated to partners directly.