This page is a translation provided for your convenience. Only the German version is legally binding.

Controller

The controller for data processing on this website is HASHLYNK GmbH, Mölltalstraße 43/1, 9813 Möllbrücke, Austria, company register no. FN 646489w, Regional Court Klagenfurt. Contact: office@hashlynk.at, +43 650 264 687 0.

General

This privacy policy informs you about the main aspects of data processing on our website and in our business. We process personal data only on the basis of the law, in particular the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

When you visit our website, your IP address and the start and end of your session are processed. This is technically necessary and based on our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).

Contacting us

If you contact us through the contact form, the support form, the engineering request or by email, we process the information you send (for example name, company, email, phone number and your message) to handle your request and for follow-up questions. The legal basis is Art. 6(1)(b) GDPR where the request aims at a contract, otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

The information is stored in our customer management system Odoo (see section Odoo). We keep it for six months. If a business relationship arises, the retention period in the section Retention applies. We do not pass your data to third parties without your consent, except to the service providers named in this policy.

This website stores only little information on your device. On your first visit we show you a cookie notice in which you decide whether you allow optional cookies. We use the consent management of Cloudflare Zaraz for this. You can change your choice or withdraw it with effect for the future at any time via “Cookie settings” in the footer.

Strictly necessary and always active:

  • zaraz-consent (cookie, Cloudflare Zaraz, duration 1 year): stores your choice about optional cookies.
  • cf_zaraz_client (cookie, Cloudflare Zaraz, duration 1 year): technical cookie from Zaraz. It is empty and contains no identifier.
  • _zaraz___zarazConsentLanguage (session storage, Cloudflare Zaraz, until you close the tab): stores the language of the cookie notice to match the page.

The legal basis for these entries is Art. 6(1)(f) GDPR (working consent management) and section 165(3) of the Austrian Telecommunications Act 2021 (strictly necessary storage). Cloudflare acts as our processor here (see section Hosting and delivery).

Only with your consent or after your action: Google Analytics and Microsoft Clarity set their cookies only once you agree (see the sections on usage analysis). If you activate a video from YouTube or Vimeo, the providers may set cookies (see section Videos). Fathom Analytics does not set cookies.

Site survey, location and ROI calculation

Data processed: We process the information you enter in the site survey, for example location and system data, energy and building data, technical parameters and free text. If you enter contact details (name, email, phone number), we process these as well.

Purpose and legal basis: We use it to handle your request, to prepare a location and ROI calculation and an offer (Art. 6(1)(b) GDPR, pre-contractual measures).

Automated processing (n8n): We use n8n to automate our workflows (n8n GmbH, Berlin, Germany). n8n runs as a cloud service on Microsoft Azure servers in the EU. For support purposes n8n may access group companies in the USA and the United Kingdom, for which standard contractual clauses are in place. We have a data processing agreement with n8n under Art. 28 GDPR.

AI-assisted analysis (Claude by Anthropic): To analyse and summarise technical project and calculation data we use Claude, an AI service of Anthropic PBC, USA. We transmit technical project and calculation data. We do not transmit contact details or addresses. Processing takes place in the USA and is secured by standard contractual clauses under Art. 46 GDPR. We have a data processing agreement with Anthropic. We use the service through a company account with API access. Under the contract terms, inputs are not used to train models. More information: https://www.anthropic.com/privacy

No automated decision-making including profiling within the meaning of Art. 22 GDPR takes place. The AI analysis is a working basis for our staff, and people decide on offers.

Communication via WhatsApp: At the explicit request of the person we communicate with, we use WhatsApp (Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland). WhatsApp processes the messages and phone numbers exchanged. Processing in third countries (in particular the USA) is possible. Please do not send sensitive or contract-critical information via WhatsApp. The legal basis is Art. 6(1)(b) GDPR (contract initiation and performance), otherwise Art. 6(1)(f) GDPR (efficient communication). More information: https://www.whatsapp.com/legal/privacy-policy-eea

When you place an order in the HashLink shop, we process the information you enter: name, where applicable company and VAT ID, billing and delivery address, email, phone number, your order and your selection in the configurator (for example inverters and miners). The purpose is to perform the contract, issue invoices, ship the goods and activate the licence. The legal basis is Art. 6(1)(b) GDPR, and for retaining invoices Art. 6(1)(c) GDPR.

The order is transmitted to our system Odoo through a Cloudflare Worker. The contract is concluded when you click “Order with obligation to pay”. We do not use a payment service provider. You receive the invoice by email and pay in advance by bank transfer. For shipping by post we pass your name, address and, where applicable, phone number to the shipping company. The mandatory fields are required to conclude the contract. Without them we cannot accept the order.

If you withdraw from a contract online, we process your name, the order or invoice number, your email address, your details on the scope of the withdrawal and, if you add one, your comment, in order to handle the withdrawal and confirm receipt. The legal basis is Art. 6(1)(b) and (c) GDPR.

Odoo (customer management, quotes, invoices, newsletter)

We use Odoo as a cloud service for contact management, quotes, orders, invoices, support and sending the newsletter. The provider is Odoo S.A., Chaussée de Namur 40, 1367 Ramillies, Belgium. Data is stored in data centres in the EU. We have a data processing agreement with Odoo under Art. 28 GDPR. The legal basis is Art. 6(1)(b) GDPR (contract and contract initiation) and Art. 6(1)(f) GDPR (efficient administration). More information: https://www.odoo.com/privacy

Hosting and delivery (Cloudflare)

Our website is hosted on Cloudflare Pages and delivered through the Cloudflare network. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare serves the pages from data centres near you and protects our website against attacks and misuse, for example DDoS attacks. The same network runs the functions we need for forms and requests (Cloudflare Workers).

When you visit the site, Cloudflare processes the technically necessary connection data, in particular your IP address, date and time of access, the page requested, information about your browser and operating system and the previously visited page (referrer). This data serves to deliver the site and to keep it secure and stable. The legal basis is Art. 6(1)(f) GDPR. Cloudflare keeps this data for no longer than 30 days.

Cloudflare processes the data as a processor, and we have a data processing agreement with Cloudflare under Art. 28 GDPR. Processing in third countries (in particular the USA) is possible. Cloudflare is certified under the EU-U.S. Data Privacy Framework, and standard contractual clauses under Art. 46 GDPR are part of the agreement. More information: https://www.cloudflare.com/privacypolicy/

Protection of our forms (Cloudflare Turnstile)

To protect our forms against automated requests and abuse, we use Cloudflare Turnstile. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Turnstile runs invisibly in the background, you do not have to solve anything. It only loads once you start filling in a form or when you send it.

For this, Turnstile runs small checks in your browser and processes technical characteristics of your access, such as your IP address, the TLS fingerprint, the browser identifier (user agent) and the identifier and origin of the form. The sole purpose is to tell people from automated access. Turnstile does not process what you enter in the form. When you send a form, we have Cloudflare confirm the result using a one-time identifier. If the check fails, you can send us your request by email to office@hashlynk.at.

The legal basis is Art. 6(1)(f) GDPR (protecting our forms against abuse) and, where your device is accessed, section 165(3) of the Austrian Telecommunications Act 2021 (strictly necessary so that we can accept your form). Cloudflare acts as our processor for protecting our website. To improve Turnstile’s bot detection, Cloudflare also processes the same data as an independent controller on the basis of its legitimate interest. For processing in third countries, see section Hosting and delivery. More information: https://www.cloudflare.com/turnstile-privacy-policy/

Fonts

We use the fonts Montserrat and Space Mono. They are stored on our server and delivered with the website. Visiting the site does not create a connection to Google Fonts or other font providers.

Server log files

When the website runs, technically necessary access data is processed: IP address, browser, operating system, language setting, page requested, date and time and the previously visited page. This data is personal data. We do not combine it with other data and evaluate it only if there are indications of unlawful use. The legal basis is Art. 6(1)(f) GDPR. We keep it for no longer than 30 days.

Web analytics (Fathom Analytics)

To understand how our website is used, we use Fathom Analytics. The provider is Conva Ventures Inc., 26 Bastion Square, Third Floor Burnes House, Victoria, British Columbia, V8W 1H9, Canada. We load Fathom through Cloudflare Zaraz.

Fathom does not set cookies and does not build cross-site user profiles. On each page view Fathom briefly processes your IP address and browser information (user agent) to form a site-specific identifier that changes daily. To protect against misuse, the IP address may be held for up to 24 hours. It does not enter the statistics. We receive only aggregated reports, for example on page views, referrers, browser, device type and country.

Requests from the EU are first processed on infrastructure in the EU and anonymised there. For Canada, an adequacy decision of the European Commission exists. We have a data processing agreement with Fathom under Art. 28 GDPR. The legal basis is Art. 6(1)(f) GDPR (privacy-friendly audience measurement). You can object at any time, contact: office@hashlynk.at. More information: https://usefathom.com/legal/privacy

Usage analysis (Google Analytics)

If you agree to the category “Statistics & analytics” in the cookie notice, we use Google Analytics 4 to understand which content on our website is used and to improve it. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We embed Google Analytics server-side through Cloudflare Zaraz: no Google script is loaded in your browser, and your IP address is not sent to Google. Without your consent, nothing is measured.

The page viewed and its title, the page visited before, language setting, screen size, browser information (user agent), the time of use and random identifiers for your browser and your session are transmitted. Cloudflare Zaraz stores these identifiers in the cookies cfz_google-analytics_v4 (duration 1 year) and cfzs_google-analytics_v4 (until you close the browser). Google keeps the data for at most 14 months.

Google processes the data as our processor. Processing in the USA is possible. Google LLC is certified under the EU-U.S. Data Privacy Framework.

The legal basis is your consent under Art. 6(1)(a) GDPR and section 165(3) of the Austrian Telecommunications Act 2021. You can withdraw it at any time with effect for the future via “Cookie settings” in the footer. After that, no more data is sent to Google. The cookie cfz_google-analytics_v4 stays stored until its content expires after one year at the latest; you can delete it in your browser at any time. More information: https://policies.google.com/privacy

Usage analysis (Microsoft Clarity)

If you agree to the category “Statistics & analytics” in the cookie notice, we use Microsoft Clarity to understand how our website is used and to improve it. The provider for the European Economic Area is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. We embed Clarity through Cloudflare Zaraz. Clarity is not loaded without your consent.

Clarity records how you use the website, such as mouse movements, clicks, scrolling and pages viewed, as well as information about your device and browser, and creates heatmaps and session recordings from this. When the connection is established, your IP address is transmitted to Microsoft for technical reasons. What you enter in form fields is masked and not recorded. On this website Clarity sets the cookies _clck (duration 1 year: an identifier to recognise your browser on this website, and Clarity settings) and _clsk (duration 1 day: links several page views into one session). Microsoft may also set its own cookies on clarity.ms, such as MUID and CLID. According to Microsoft, recordings are kept for 30 days, heatmaps and marked sessions for 9 months.

Microsoft and we are each independently responsible for this processing; Microsoft is not our processor. Microsoft may also use the personal data collected through Clarity for its own purposes under its own privacy statement, such as improving its products, creating user profiles, including for advertising, and providing Microsoft Advertising. We pass on to Clarity the setting that advertising storage is not allowed. According to Microsoft, the data is then not shared with Microsoft Advertising. Processing in the USA is possible. Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework.

The legal basis is your consent under Art. 6(1)(a) GDPR and section 165(3) of the Austrian Telecommunications Act 2021. You can withdraw it at any time with effect for the future via “Cookie settings” in the footer. Clarity is then stopped and the cookies _clck and _clsk are deleted. More information: https://privacy.microsoft.com/en-us/privacystatement

Videos (YouTube and Vimeo)

On some pages we embed videos from YouTube and Vimeo. A video only loads once you click “Show video”. Until then you see a preview image stored on our website, and there is no connection to YouTube or Vimeo. With the click, your IP address and technical information about your browser are transmitted to the provider. The provider may use cookies and similar technologies. We embed YouTube videos in enhanced privacy mode (youtube-nocookie.com) and Vimeo videos with the “Do Not Track” setting.

YouTube is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Vimeo is provided by Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, USA. Both also process data in the USA. Transfers rely on the EU-U.S. Data Privacy Framework, under which both providers are certified, and additionally on standard contractual clauses under Art. 46 GDPR.

The legal basis is your consent under Art. 6(1)(a) GDPR and section 165(3) of the Austrian Telecommunications Act 2021, which you give by clicking. You can withdraw it at any time with effect for the future by reloading the page and deleting your browser cookies for youtube-nocookie.com, youtube.com and vimeo.com. More information: https://policies.google.com/privacy and https://vimeo.com/privacy

Newsletter

You can subscribe to our newsletter on our website. We need your email address and your explicit consent (Art. 6(1)(a) GDPR). First and last name are optional and used for personal salutation.

After you sign up, you receive an email with a confirmation link (double opt-in). We add you to the list only after confirmation. We send the newsletter through Odoo (see section Odoo). We store your data until you withdraw consent. You can unsubscribe at any time, using the link in every email or by writing to office@hashlynk.at. Your data is then removed from the list immediately. The lawfulness of processing before withdrawal remains unaffected.

We measure whether you open newsletter emails and which links you click, in order to improve our content. The legal basis is your consent, which you give when you sign up and can withdraw at any time, for example by unsubscribing from the newsletter.

Our website contains links to partners, sources and to our profiles on LinkedIn, Instagram, Facebook and X. Simply visiting our page does not transmit data to these providers. Only when you click a link does the respective provider process data under its own privacy policy.

Recipients and processors

We use external service providers who process personal data on our behalf. We conclude data processing agreements under Art. 28 GDPR with all of them. They are: Cloudflare (hosting, delivery, Workers, Zaraz, Turnstile), Fathom (audience measurement), Google (Google Analytics, only with your consent), Odoo (customer management, invoices, newsletter), n8n (automation) and Anthropic (AI analysis of technical data). YouTube, Vimeo and WhatsApp receive data only after your action, and Microsoft (Clarity) only with your consent, as described above. Microsoft and, to improve Turnstile, Cloudflare also process this data for their own purposes, as described in the relevant sections. Beyond that, we do not pass data to third parties for their own purposes. We pass data to tax advisers, banks and authorities where the law requires it.

Retention

We keep contact enquiries for six months. If an enquiry or site analysis does not lead to a business relationship, we delete or anonymise the data no later than twelve months after the last activity. If a business relationship arises, we keep the data as long as needed to perform the contract. Invoice and accounting data is kept for seven years in line with statutory periods (Austrian Business Code, Federal Fiscal Code).

Your rights

You have the following rights regarding your data:

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing (Art. 21 GDPR)
  • Withdrawal of consent (Art. 7(3) GDPR)

If you believe that the processing of your data violates data protection law, you can complain to us or to the Austrian Data Protection Authority (www.dsb.gv.at).

Contact

HASHLYNK GmbH, Mölltalstraße 43/1, 9813 Möllbrücke, Austria. Email: office@hashlynk.at, phone: +43 650 264 687 0.