Privacy Policy

The controller within the meaning of the GDPR is HeyHo Systems GmbH, Kurfürstenstr. 9b, 31275 Lehrte, Germany. Email: hey@heyhosystems.com.

When you access this site, our hosting provider (Vercel Inc., USA — operating under the EU–US Data Privacy Framework) automatically records technical information your browser transmits: IP address (shortened before storage), date and time of the request, requested URL, HTTP status, referrer URL, browser and operating system. This data is used solely for security and operational monitoring and is retained for no longer than 14 days. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, functioning website).

The site stores your language choice and separate analytics and marketing choices for six months. Earlier marketing consent is not reused for the added server-side data transfer. Vercel Analytics loads only after analytics consent; Google Ads and Meta Pixel load only after marketing consent. After marketing consent, we store available campaign parameters for the lifetime of this browser tab in session storage; withdrawal clears them.

After analytics consent, Vercel Analytics measures page views and website interactions without advertising cookies. We remove query parameters from page addresses sent to Vercel. Only with marketing consent do interactions also carry a shortened campaign key; no form contents are sent to Vercel. After marketing consent, Google Ads and Meta Pixel load: Meta measures page views and separate signals for WhatsApp, phone, email and CTA clicks, clicks on the website self-test and opening demo or case-study videos. These clicks are not confirmed conversations. A Meta Lead fires only after successful form delivery. We then also send the normalized email address and, where available, international phone number as SHA-256 hashes, the browser identifier, browser type and, where available, IP address to Meta through the Conversions API. Hashes remain personal data. Name, message and form fields in plain text are not sent to Meta. Browser and server Lead share an event ID so Meta can deduplicate them. Google Ads measures confirmed form inquiries and WhatsApp and demo-start clicks. You can change your choices at any time using the button below. Optional analytics and marketing measurement rely on Art. 6(1)(a) GDPR. Google and Meta services may transfer data to the USA.

When you submit the contact form, we process the data you enter (name, email, phone, optional message, optionally how you heard about us) to respond to your inquiry. After marketing consent, we also send any available campaign parameters. This data is transmitted to our internal Slack workspace via a webhook. We retain the conversation for as long as needed to handle your inquiry and for up to 24 months afterward for follow-up; after that, it is deleted or anonymised. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).

You have the right, under the GDPR, to:

• access your personal data (Art. 15)
• have inaccurate data corrected (Art. 16)
• have your data erased (Art. 17)
• restrict processing (Art. 18)
• receive your data in a portable format (Art. 20)
• object to processing based on legitimate interest (Art. 21)
• withdraw consent at any time, with effect for the future
• lodge a complaint with a supervisory authority (e.g. the State Commissioner for Data Protection of Lower Saxony)

To exercise any of these rights, please contact hey@heyhosystems.com. We will respond within 30 days.