Version v4 (May 2026). Adapted to the Workstation on Demand model. If you contracted an earlier version before this date, it is governed by the version in force at the time of your contract.
1. Data controller (DPO)
The data controller is Busanmat S.L. (operating the LilDesk brand), domiciled in Spain. For privacy enquiries, contact our DPO at [email protected].
2. Data we collect
We collect the following categories of personal data:
- Account data: name, email, preferred language (when you create an account).
- Payment data: securely processed by Stripe (USA, with transfer under Standard Contractual Clauses). We do not store card details.
- Technical data: IP, browser user-agent, login and RDP connection timestamps — used for security and fraud detection.
- Usage data (billing): power-on and shutdown timestamps of your workstation, aggregated into peak / off-peak hours per month. Required to calculate your bill.
- Your workstation content: files in /home, applications you install, configuration. We do NOT access this content except at your explicit request to support (typically to restore after a failure).
3. How we use your data
We use your data to provide the service (provision the workstation, count hours, send operational emails), process payments, send important technical communications (maintenance, idle shutdown, monthly usage summary, retention expiry after cancellation), and comply with legal obligations (invoicing, accounting and tax law). We do not sell your personal data to third parties.
4. Processors (third parties)
We use the following providers that process data on our behalf:
- Hetzner Online GmbH (Germany) — cloud infrastructure where your workstation VMs reside. Datacenter in Falkenstein (DE), EU. Full GDPR compliance.
- Stripe Payments Europe Limited (Ireland, EU) + Stripe Inc. (USA) — payment processing. Transfer to the USA under Standard Contractual Clauses + Data Processing Addendum.
- Brevo (formerly Sendinblue, France) — transactional email delivery (welcome, workstation ready, monthly usage summary, idle shutdown). EU.
All providers meet GDPR requirements and have a signed DPA with us.
5. Location and storage
Your workstation data (persistent disk, /home, installed apps, configuration) is stored exclusively in the Hetzner datacenter located in Falkenstein, Germany. It is not replicated outside the EEA.
Encrypted backups run daily to a second Hetzner server in the same region (they never leave the EEA).
6. Retention period
- Account data: for the lifetime of your account + 30 days after closure (in case you want to reactivate).
- Your workstation data (persistent disk): for the lifetime of your Workstation subscription. On cancellation, the VM and its disks are purged immediately and are not recoverable.
- Payment and invoicing records: 7 years (legal/tax obligation).
- Usage records (RDP sessions): 12 months after session close, for support and billing audit. They are then aggregated into anonymous metrics.
- Server logs: 90 days.
7. Your rights (GDPR)
Under the GDPR you have the right to:
- Access the personal data we process about you.
- Rectify it if inaccurate.
- Erase it (“right to be forgotten”) — this implies cancelling the subscription and purging the VM immediately.
- Port it to another provider (you can download your /home via SSH/SFTP from your workstation while it is active, before cancelling).
- Restrict or object to processing.
- Withdraw consent at any time.
- Lodge a complaint with the Spanish Data Protection Agency (AEPD, aepd.es) or your local EU supervisory authority.
To exercise these rights, contact our DPO at [email protected]. We respond within a maximum of 30 calendar days.
8. Cookies
We use essential cookies for language preference (the lang cookie) and session management. Analytics cookies only with your explicit consent (cookie banner). You can manage your preferences at any time.
9. Security
We apply appropriate technical and organisational measures: encryption in transit (TLS 1.3), encryption of sensitive credentials in the database (Fernet/AES-128), per-customer VM isolation with no shared network, restricted and audited administrative access, and encrypted backups.
10. Changes to this policy
We will notify you of significant changes to this policy via email or through the panel at least 30 calendar days in advance.
11. Contact
Controller: Busanmat S.L. (Spain).
DPO: [email protected].