Privacy Policy

Last updated: November 2026

This Privacy Policy explains how TPC Management s.r.l., trading as The Projekt Company and TPC Hosting (“TPC”, “we”, “us”, or “our”) collects, uses, and protects personal data when you use the Cluster Fabrik website (clusterfabrik.com), the Cluster Fabrik application (https://app.clusterfabrik.com) and its login service, and when you contact us. Orders and invoicing run through the TPC Hosting customer area at tpc-hosting.com, which is operated by the same controller and has its own privacy policy. We are committed to processing your personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable national data protection laws.

1. Controller

The data controller responsible for processing your personal data is:

TPC Management s.r.l.
Str. Lahovari 8C, 077016 Dumbraveni, com. Balotești, Ilfov County, Romania
Trade Register J23/2598/2021 · VAT ID RO35691219
Email: privacy@clusterfabrik.com

If you have any questions about how we handle your personal data, please contact us at the email address above. We have not appointed a data protection officer, as we are not legally required to; privacy enquiries are handled by our management at the address above.

2. Data We Collect

2.1 Contact Form Data

When you submit a contact or demo request form on our website, we collect the following personal data that you voluntarily provide:

  • Full name
  • Email address
  • Company name
  • Your message or enquiry

This data is processed solely for the purpose of responding to your enquiry and, where applicable, for the performance of a contract or pre-contractual measures.

2.2 Website Analytics (Matomo, without cookies)

We measure how this website is used with Matomo, an open-source analytics tool that we host ourselves on servers in the European Union (analytics.b2b-server.net). No data is shared with third parties. Matomo is configured without cookies: nothing is stored on your device for analytics purposes, and your IP address is anonymised (the last two bytes are removed) before it is stored.

Matomo records pages viewed, time of visit, referring page, approximate region (derived from the anonymised IP), browser, operating system, device type and screen resolution. Browser, operating system, device type and screen resolution are read by the Matomo script in your browser for this purpose. We do not create fingerprints, do not track you across other websites, do not combine this data with other data, and do not use it to identify you; it is evaluated only in aggregated form, to understand which content is useful and to improve the website. If your browser sends a “Do Not Track” signal, no analytics data is collected.

Legal basis is our legitimate interest in measuring and improving our website (Art. 6(1)(f) GDPR). We consider this interest not to be overridden by your interests, because the data is anonymised on receipt, nothing is stored on your device, and the processing is limited to this website.

You can object to this processing at any time by emailing privacy@clusterfabrik.com, or by enabling “Do Not Track” in your browser.

2.3 Server Logs

Our web servers automatically record technical information each time your browser accesses our website. This log data may include:

  • IP address
  • Date and time of access
  • Browser type and version
  • Operating system
  • Referring URL
  • Pages accessed and files downloaded

Server logs are retained for a maximum of 14 days and are then automatically deleted. This data is used exclusively for security monitoring, diagnosing technical problems, and ensuring system stability. We do not use server logs to identify individual users.

2.4 Account, Login and Application Data

When you order the Service and use the Cluster Fabrik application, we process the data needed to provide it:

  • Account data: name, email address, company, billing address and VAT ID, taken from your order in the TPC Hosting customer area.
  • Login data: username, email address, a hash of your password, the time and IP address of logins, and the session cookies of our login service (Keycloak), which are strictly necessary to keep you signed in.
  • Application data: the clusters, nodes, networks and add-ons you create, the hostnames and IP addresses assigned to them, provider credentials and SSH keys you add (stored encrypted), job and audit logs of the actions taken in your account, and your support correspondence with us.

We use this data to provide, secure and bill the Service and to answer your support requests. Legal basis is the performance of the contract (Art. 6(1)(b) GDPR); for audit logs and security measures our legitimate interest in the secure operation of the Service (Art. 6(1)(f) GDPR); and for invoicing data our statutory obligations under tax and accounting law (Art. 6(1)(c) GDPR).

2.5 Data in Your Clusters

Workloads and data you deploy or store in your clusters belong to you. Where they contain personal data, we process it only on your behalf and on your instructions as a processor under Article 28 GDPR, on the basis of the data processing agreement concluded with you. We do not access the contents of your clusters except as described in our Terms of Service.

3. Legal Basis for Processing

We process your personal data only where we have a lawful basis for doing so under Article 6 GDPR:

  • Art. 6(1)(b) GDPR — Contract / pre-contractual measures: Where you contact us to enquire about our services or request a demo, processing your contact form data is necessary to respond to your request and, if applicable, to enter into a contract with you. Account, login and application data (section 2.4) are processed to perform the contract with you.
  • Art. 6(1)(c) GDPR — Legal obligation: We retain invoicing and contract data as required by tax and accounting law.
  • Art. 6(1)(f) GDPR — Legitimate interests: We process server log data on the basis of our legitimate interest in maintaining the security, integrity, and proper functioning of our systems. This interest is not overridden by your fundamental rights and freedoms.
  • Art. 6(1)(f) GDPR — Legitimate interests (analytics and security): We process website usage data with Matomo on the basis of our legitimate interest in understanding and improving our website (section 2.2), and audit and security logs of the application on the basis of our legitimate interest in its secure operation. You can object at any time as described in section 6.

4. Third-Party Processors

4.1 Formspree Inc. (Contact Form Processing)

Our contact forms are powered by Formspree Inc., a form backend service. When you submit a form on our website, the data you enter is transmitted to and processed by Formspree on our behalf.

Formspree acts as a data processor and processes your data strictly in accordance with our instructions and the Data Processing Agreement (DPA) we have in place with them.

Please note that Formspree is a US-based company and may transfer your data outside of the European Economic Area (EEA). Such transfers are based on the Standard Contractual Clauses (SCCs) adopted by the European Commission (Art. 46(2)(c) GDPR) and, where Formspree is certified under the EU-US Data Privacy Framework, on the European Commission's adequacy decision for that framework (Art. 45 GDPR). You can request a copy of the safeguards from us.

For more information on how Formspree processes data, please review the Formspree Privacy Policy.

4.2 Hosting

This website, the Cluster Fabrik application, its login service, our Matomo instance and the clusters of the fully hosted service run on infrastructure owned and operated by TPC in data centres in the European Union (Germany). We do not use a third-party hosting provider for them, and no personal data from these systems is transferred outside the European Union by us.

5. Data Retention

We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law:

  • Contact form data: Retained for 3 years from the date of last contact, after which it is permanently deleted.
  • Server logs: Automatically deleted after 14 days.
  • Website analytics (Matomo): Raw visit data is deleted after 13 months; only aggregated reports are kept after that.
  • Account and application data: Retained for the term of the contract. Clusters and the data in them are deleted 14 days after the contract ends; account data is deleted once no statutory retention period applies.
  • Job and audit logs of the application: Deleted after 12 months.
  • Invoicing and contract data: Retained for the statutory periods under Romanian tax and accounting law (up to 10 years).

Where data must be retained for longer periods due to statutory obligations (e.g., tax or commercial law retention requirements), we will retain only the minimum data necessary and restrict its further processing.

6. Your Rights under GDPR

Information on your right to object (Art. 21 GDPR). Where we process your personal data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), in particular website analytics and security logs, you have the right to object at any time, on grounds relating to your particular situation. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. To object, email privacy@clusterfabrik.com; for website analytics it is enough to enable “Do Not Track” in your browser.

As a data subject under the GDPR, you have the following rights in relation to your personal data:

  • Right of access (Art. 15 GDPR): You have the right to obtain confirmation of whether we process personal data about you, and if so, to receive a copy of that data along with supplementary information about how it is processed.
  • Right to rectification (Art. 16 GDPR): You have the right to have inaccurate personal data corrected without undue delay, and to have incomplete data completed.
  • Right to erasure (Art. 17 GDPR): You have the right to request the deletion of your personal data where one of the grounds specified in Art. 17 applies (e.g., the data is no longer necessary for the purposes for which it was collected).
  • Right to restriction of processing (Art. 18 GDPR): You have the right to request that we restrict the processing of your personal data in certain circumstances (e.g., while a dispute about accuracy is being resolved).
  • Right to data portability (Art. 20 GDPR): Where processing is based on consent or a contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller.
  • Right to object (Art. 21 GDPR): You have the right to object at any time to the processing of your personal data based on our legitimate interests (Art. 6(1)(f) GDPR). We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
  • Right to withdraw consent: Where processing is based on your consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
  • Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement, if you consider that our processing of your personal data infringes the GDPR.

To exercise any of these rights, please contact us at privacy@clusterfabrik.com. We will respond to your request within one month. This period may be extended by a further two months in complex or numerous cases, in which case we will inform you of the extension and reasons.

7. Supervisory Authority

You have the right to lodge a complaint with your national data protection supervisory authority. The competent supervisory authority for TPC Management s.r.l. is:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, Romania
www.dataprotection.ro

You may also contact the supervisory authority of your own country of residence or work if it differs from ours.

8. Cookies

This website sets no cookies. The Cluster Fabrik application and its login service use strictly necessary cookies to keep you signed in. Details are in our Cookie Policy.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures take into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing.

All data transmissions between your browser and our website are encrypted using Transport Layer Security (TLS). However, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security but are committed to promptly addressing any breach in accordance with applicable law.

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the “Last updated” date at the top of this page. We encourage you to review this page periodically to stay informed about how we protect your data.

11. Contact for Privacy Matters

For all questions, requests, or concerns related to the processing of your personal data or this Privacy Policy, please contact us at:

TPC
Email: privacy@clusterfabrik.com

We take data protection seriously and will do our best to address your concerns promptly and thoroughly.