Privacy
We sell hardware and the space to run it. That needs a company name, an address and a way to reach you, and almost nothing else. This page says what we hold, where it sits, and how to make us delete it.
Who holds your data
Aucuparia Holdings Ltd, a company registered in Cyprus, trading as Blukora. We are the data controller for everything described here. Write to hello@blukora.com and it reaches a person, not a queue nobody reads.
What we collect, and only when you give it
There is no tracking on this site, so visiting it collects nothing. Data reaches us only when you fill in a form or send us an email.
When you place an order: your company name, your name, your email address, the registered address of the company buying the hardware, the country, a VAT number if you give one, the configuration you chose and the prices you were quoted. The hardware is bought in your company's name, which is why the legal entity and its address are required rather than optional.
When you ask a question or open a ticket: your name, your email address, your company if you give one, and what you wrote.
When you confirm your email: we email you a short code. We store a one-way hash of it, never the code itself, and it stops working after thirty minutes.
When you email us: the message, its headers, and the result of the spam, virus and sender checks our mail provider performs on arrival.
Why we are allowed to hold it
An order is a contract, and we cannot perform it without knowing who is buying and where the hardware goes. That is our legal basis for order data under Article 6(1)(b) of the GDPR.
Answering a question you sent us, and confirming that the address on it is really yours, rests on legitimate interests under Article 6(1)(f). Confirming the address is what stops someone using our mail server to send things to people who never asked.
Where tax or company law requires us to keep a record of a sale, the basis is our legal obligation under Article 6(1)(c).
Where it is stored
In Frankfurt, Germany. The web server, the database and the mail that arrives for us all run in Amazon Web Services' eu-central-1 region. Amazon is our processor and we have a data processing agreement with them.
Nothing in the ordinary running of this service moves your data outside the European Economic Area. If that ever changes we will say so here before it happens, not after.
Cookies, analytics and the things we do not do
We run no analytics. We load no fonts, scripts, images or stylesheets from anybody else, so no third party learns that you were here. There are no advertising or social media trackers, because there is nothing on the page to carry them.
We set no cookies and keep nothing in your browser, so there is no consent banner. If that ever changes, this page and the site will say so before anything runs.
Who else sees it
Amazon Web Services, who host the servers and deliver our email. Our accountants and, where a sale requires it, the Cypriot tax authority. Nobody else. We do not sell data, share it for advertising, or pass it to a data broker, and there is no arrangement under which we could.
If a law enforcement request ever reaches us we will tell you, unless we are legally barred from doing so.
How long we keep it
An order and its invoice are commercial records. We keep them for as long as Cypriot tax and company law requires us to, and delete them after that.
A question that did not become an order is kept for two years, so that if you come back we know what we already told you, and is then deleted. Verification codes are hashed and expire in thirty minutes. Raw inbound email is deleted once it has been filed against its ticket.
Your rights
You can ask us for a copy of everything we hold about you, ask us to correct it, ask us to delete it, ask us to stop using it, or ask for it in a portable format. Email hello@blukora.com and we will answer within thirty days. We will not ask you why.
Deleting an order we are legally required to retain is the one request we may have to refuse. If so we will tell you which record, and why.
If we handle this badly you can complain to the Office of the Commissioner for Personal Data Protection in Cyprus, or to the data protection authority where you live. You do not need our permission and you do not need to come to us first.
Changes to this page
If we change how any of this works, we change this page and move the date at the top. We will not quietly broaden what we collect and leave the old text standing.