Privacy notice

terminalthor.com

1. Introduction

This notice describes the processing of personal data in connection with terminalthor.com (the Website). We process your data under the GDPR, the Austrian Data Protection Act (DSG) and the TKG 2021.

2. Controller and contact details

TerminalThor and Hexalion are brands of Tewelon GmbH’s AI business. Where the Website or this notice refers to TerminalThor or Hexalion, the controller is always Tewelon GmbH.

3. Individual processing activities

3.1 Display and technical operation of the Website

The Website is served from Tewelon GmbH’s own rented server, operated by Hetzner Online GmbH (data centre: Hetzner Finland Oy, Helsinki, Finland — within the European Union). The Website consists of static pages; to display it, your browser communicates with the server over an encrypted connection (HTTPS).

No content delivery network, external platform or third-party server is used to display the Website.

3.2 Cookie choices

We store your consent or refusal and its time in your browser for up to 6 months. This storage is necessary to remember your choice; its basis is GDPR Article 6(1)(f) and the necessity exemption in TKG 2021 § 165(3). Language and runic display are reflected in the URL, not in a separate identifier.

3.3 Statistics and referral sources

Only with prior, voluntary consent (GDPR Article 6(1)(a), TKG 2021 § 165(3)) do we record the referring website's domain and the utm_source, utm_medium and utm_campaign campaign tags. We do not store the full referring URL. If you submit a form, the consented source is attached to your enquiry so we can identify the channel it came through. If you refuse, we do not attach this source data; the website and form remain available.

Google Analytics 4 loads only after consent. It measures page views, traffic channels, device data, approximate geographic region and a form-submission event without identifying information. We do not send names, email addresses, messages or form-field contents to Google, nor link the analytics identifier to an applicant's name. Google Ireland Limited provides the service; section 5 covers transfers to the USA. User-level and event-level measurement data are retained for 2 months; this limit does not apply to aggregated reports. We do not use ad personalisation or Google Signals.

3.4 Enquiries and beta applications

If you send a message through the Website’s form or apply for the inner circle, we process the following data: name, e-mail address, message and — if you provide them — company, phone number, team size and the chosen hosting environment; furthermore the chosen language, the time of submission, the version of this notice and your acknowledgement of it, and — only with the separate consent described in section 3.3 — the referral source. Your browser sends the form contents over an encrypted connection directly to our own server (section 3.1). There, a small service validates the fields and composes a single e-mail from the submission, which is delivered through the Resend e-mail service (Plus Five Five, Inc., USA — see sections 4 and 5) to the Controller’s mailbox (Google Workspace, Google Ireland Limited). The submission is not stored on the server — neither in a file nor in a database; the service’s operational log contains only a timestamp, a status code and the e-mail provider’s message identifier, no personal data. Your IP address is handled by the service only in memory and for at most one minute, to limit the number of submissions per minute (abuse prevention); it is never written to a log or to disk.

Purpose: answering your enquiry, evaluating your application and arranging the invitation; we reply to the e-mail address you provide. Legal basis: for individuals as prospective contracting parties, steps prior to entering into a contract — Article 6(1)(b) GDPR; for company contacts or general enquiries, our legitimate interest in handling the enquiry — Article 6(1)(f) GDPR. The mandatory checkbox confirms that you have read this notice; it is not a newsletter consent. Without the mandatory fields we cannot accept the request.

We keep the enquiry and application data — the e-mail received in our mailbox and our reply to it — for at most 6 calendar months from submission, then delete it; the e-mail header states the due date of deletion. Deletion also covers referral data attached with your consent. Sending a voluntary update does not restart the period. At the e-mail provider, delivery data is subject to the provider’s own, shorter retention. If a collaboration comes about, we will inform you separately about the further processing of the necessary data. In case of a substantiated legal claim or a statutory obligation, we retain only the necessary data, for the necessary time, separately.

3.5 Optional email updates

We send TerminalThor news and offers only with consent through the separate, unticked checkbox (GDPR Article 6(1)(a), TKG 2021 § 174). We record the consent wording, language, version, time and latest expiry alongside the enquiry. Permission lasts for up to 6 months and ends earlier if withdrawn. Unsubscribe by replying to an update or emailing info@tewelon.at. This does not affect application review or a requested reply. We do not use individual email-open tracking pixels. We must honour an unsubscribe request before any further mailing.

4. Service providers used

5. Transfers of data to third countries

The e-mail provider (Plus Five Five, Inc.) operates in the United States: it sends the e-mails from its Irish infrastructure but stores the e-mail address, the message content and the delivery log in the United States. The transfer is based on the standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR); according to the provider, it is also certified under the EU–US Data Privacy Framework, which is covered by a Commission adequacy decision (Article 45 GDPR). The clauses are available at resend.com/legal/dpa or on request via the contact details in section 2.

Google LLC (USA) is a certified participant in the EU–US Data Privacy Framework; any transfer to the USA relies on that adequacy decision (Article 45 GDPR).

We do not make decisions with legal effects based solely on automated processing, or carry out profiling for such purposes, within the meaning of Article 22 GDPR.

6. Your rights

Right to object: you may object at any time to processing based on legitimate interests (Article 21 GDPR).

You may exercise the following rights in relation to the processing of your data at any time, free of charge:

Submit your request using the contact details in section 2. We will provide a substantive response within one month at the latest.

7. Remedies

If you believe that the processing of your data infringes the GDPR, you may lodge a complaint with a supervisory authority. The authority for the Controller’s registered office is: Österreichische Datenschutzbehörde (DSB), Barichgasse 40–42, 1030 Vienna, Austria — www.dsb.gv.at.

8. Changes to this notice

We update this notice as necessary; the current version is available at /adatvedelem/ .

Summary

From the data you enter in the form, our own EU-based server composes a single e-mail and delivers it through the Resend service to Tewelon GmbH’s mailbox; nothing is stored on the server. We keep the e-mail for at most 6 months, then delete it. News and offers are sent only with your separate, voluntary consent, and you can unsubscribe at any time at info@tewelon.at. Cookies are used only to remember your settings; Google Analytics is not enabled.