Privacy

Controller

The controller under the GDPR is:

Company

haygentic e.U.

Owner

Hasan Alper Yaprak

Address

Peter-Behrens-Platz 10 4020 Linz, Austria

Email

hello@haygentic.ai

Telephone

+43 677 61474449

What this website processes

The website provides information about services and lets you get in touch by email, telephone, or through a linked appointment booking. There is no contact form, no user account, and no newsletter. Audience measurement runs without cookies, see below.

Non-essential cookies, advertising pixels, and session replay are not used.

Hosting

The website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Server-side functions run in the Frankfurt am Main (EU) region.

Vercel processes technical log data such as IP address, time, requested address, and browser identifier in order to deliver the website and keep it secure.

The legal basis is Article 6(1)(f) GDPR. The legitimate interest is a secure and functioning website. Vercel is our processor under Article 28 GDPR.

The logs can be viewed in our Vercel account for one day. We do not export them or keep them any longer.

Static files and cached responses are delivered through Vercel’s global network. Personal data may therefore be processed outside the EEA, in particular in the United States. Vercel Inc. is certified under the EU-U.S. Data Privacy Framework, so the transfer relies on the European Commission’s adequacy decision under Article 45 GDPR, supplemented by standard contractual clauses under Article 46(2)(c) GDPR.

Contact by email and telephone

If you write to us, we process your email address, the content of the message, and the technical details of the transmission.

If you call us, we process your telephone number and the details you give during the call. The purpose, legal basis, and retention period are the same as for email.

The purpose is to answer the enquiry and, if requested, to arrange a first conversation.

The legal basis is Article 6(1)(b) GDPR where the message is a step towards a contract, and otherwise Article 6(1)(f) GDPR. The legitimate interest is answering enquiries.

Providing your data is neither a statutory nor a contractual requirement. Without your email address, however, we cannot reply to you.

We use Zoho Mail, provided by Zoho Corporation GmbH, II. Hagen 7, 45127 Essen, Germany, as a processor under Article 28 GDPR, to receive and manage email.

Email is stored in data centres in the European Economic Area. Zoho group companies outside the EEA may access it on a need basis for support and debugging. Transfers to third countries, if they occur, are based on appropriate safeguards, in particular standard contractual clauses.

Enquiries that do not lead to a collaboration are kept as long as needed to handle them and as long as claims relating to the enquiry can be asserted (limitation periods, in particular Section 1489 of the Austrian Civil Code). The legal basis is Article 6(1)(f) GDPR; our legitimate interest is defending ourselves against any claims.

Correspondence that concerns an engagement and is relevant for tax assessment is kept for seven years from the end of the calendar year concerned, as required by Section 132 of the Austrian Federal Fiscal Code (BAO). The legal basis for this is Article 6(1)(c) GDPR.

Appointment booking

To book a first conversation we link to Calendly, a service of Calendly, LLC, 271 17th St NW, Ste 1000, Atlanta, GA 30363, USA. The booking takes place on Calendly’s website; this website itself loads no content from Calendly.

When you book, Calendly processes your name, email address, company, your answers in the booking form, the chosen time, and technical details such as IP address and time zone. We receive these details to prepare and hold the conversation.

Required fields are marked in the booking form. Without them no appointment can be booked; all other details are optional.

The legal basis is Article 6(1)(b) GDPR. For the booking data, Calendly is our processor under Article 28 GDPR. Calendly processes data in the United States. Calendly, LLC is certified under the EU-U.S. Data Privacy Framework, so the transfer relies on the European Commission’s adequacy decision under Article 45 GDPR, supplemented by standard contractual clauses under Article 46(2)(c) GDPR. Calendly’s own privacy notice applies in addition.

If the conversation does not lead to a collaboration, the booking details at Calendly and on our side are handled in the same way as enquiries by email. If a collaboration follows, the retention periods for customers apply.

Customers, prospects, and business partners

When we prepare quotes, conclude and perform contracts, or work with partners, we process data of the respective contact persons: name, company, role, contact details, the content of our communication, and quote, contract, project, invoice, and payment data.

The purpose is to initiate and perform the contract, to communicate during the project, and to issue invoices and keep accounts.

The legal bases are Article 6(1)(b) GDPR for initiating and performing the contract, Article 6(1)(c) GDPR for obligations under commercial and tax law, and Article 6(1)(f) GDPR where we contact persons at business partners. The legitimate interest is working with the respective company.

These details are required to conclude and perform the contract; without them we cannot enter into a contract. The details on invoices are required by law (Section 11 of the Austrian VAT Act).

We prepare quotes with our own tool. We issue invoices and keep our accounts with ProSaldo.net by ProSaldo.net GmbH, Hoffmeistergasse 8/Top H1, 1120 Vienna, Austria, as a processor under Article 28 GDPR.

Payments are handled through Sparkasse Oberösterreich Bank AG, Promenade 11-13, 4020 Linz, Austria. The bank processes payment data as a controller in its own right.

For video calls we use Google Meet by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It processes the participants’ names, email addresses, audio and video, and technical connection data. The legal basis is Article 6(1)(b) GDPR, and Article 6(1)(f) GDPR for contact persons at business partners; the legitimate interest is easy coordination without travel.

Google processes this data as a controller in its own right under Google’s privacy policy. Google may also process data in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, so the transfer relies on the European Commission’s adequacy decision under Article 45 GDPR.

We store project documents locally on our own devices. For AI-assisted analysis we use Cortecs GmbH, Althanstraße 4, 1090 Vienna, Austria, as our processor under Article 28 GDPR. Cortecs uses AI providers as sub-processors for this. Where data is transferred to third countries such as the United States in this context, the transfer is based on an adequacy decision under Article 45 GDPR, such as the one for the EU-U.S. Data Privacy Framework, or on standard contractual clauses under Article 46(2)(c) GDPR.

We only transcribe video or telephone meetings if all participants consent at the start; the legal basis is Article 6(1)(a) GDPR. To do so we record the audio and create the transcript locally on our own devices or through Cortecs. The audio recording is deleted as soon as the transcript has been created. The transcript is deleted on the same schedule as other documents from the collaboration or, if none comes about, as enquiries; after a withdrawal of consent it is deleted immediately. Without consent the meeting takes place without recording.

Accounting records such as quotes, invoices, and receipts are kept for seven years from the end of the calendar year in which they arose, as required by Section 132 of the Austrian Federal Fiscal Code (BAO) and Section 212 of the Austrian Commercial Code (UGB), and while proceedings are pending until they are concluded. Other data from the collaboration is kept as long as claims arising from the collaboration can be asserted (limitation periods, in particular Section 1489 of the Austrian Civil Code).

Personal data we process on a customer’s behalf within a project, for example when developing or testing an AI agent, is governed by a separate data processing agreement under Article 28 GDPR. The customer is the controller of that data.

Audience measurement

To learn how often pages are viewed, where visitors come from, and how fast the pages load, we use Vercel Web Analytics and Vercel Speed Insights by Vercel Inc. They record the page viewed, the referring address, country, browser and device type, and technical loading-time measurements.

No cookies are set and nothing is stored on your device. A visit is recognised through a hash formed from the IP address and browser identifier that cannot be traced back to you and is discarded at the end of the day. There is no cross-site tracking.

The legal basis is Article 6(1)(f) GDPR. The legitimate interest is understanding how the website is used and improving it. Transfers to the United States are covered in the same way as for hosting.

Cookies and fonts

This website does not set non-essential cookies.

Fonts are served with the website. Your browser does not load fonts from Google or other third parties.

Recipients

Personal data is received only by parties that need it for the purposes above: Vercel for hosting and audience measurement, Zoho for email, Calendly for appointment booking, Google for video calls, ProSaldo.net for invoices and accounting, Sparkasse Oberösterreich for payments, and Cortecs for AI-assisted analysis of project documents and transcription of meetings.

Where we are legally obliged to, for example during an audit by the tax authority, we disclose data to public authorities. If we engage a tax adviser, they receive the accounting data; tax advisers are bound by professional secrecy.

Data is not disclosed for advertising.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability, and objection to processing based on Article 6(1)(f) GDPR. You may withdraw any consent you have given at any time with effect for the future; this does not affect the lawfulness of processing carried out before the withdrawal. A message to hello@haygentic.ai is enough to exercise these rights.

We are not legally required to appoint a data protection officer and have not appointed one. The owner is the contact for all data protection questions.

If you believe that the processing of your data violates data protection law, you may lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40-42, 1030 Vienna, telephone +43 1 52 152-0, email dsb@dsb.gv.at, www.dsb.gv.at.

Automated decisions

No automated decision-making, including profiling within the meaning of Article 22 GDPR, takes place.

Changes

If the processing changes, this notice will be updated.