Privacy notice

terminalthor.com

1. Introduction

This notice describes the processing of personal data in connection with terminalthor.com (the Website). We process your data in accordance with the GDPR, Hungarian Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.) and Hungarian Act C of 2003 on Electronic Communications (Eht.). This notice is available in nine languages; in the event of any discrepancy in content, the Hungarian version prevails.

2. Controller and contact details

3. Individual processing activities

3.1 Display and technical operation of the Website

The Website is served from its own server running on the server infrastructure of Hetzner Online GmbH (data centre: Hetzner Finland Oy, Helsinki, Finland — within the European Union). The Website consists of static pages; to display it, your browser communicates with the server over an encrypted connection (HTTPS).

No content delivery network, external platform or other external server is used to display the Website.

3.2 Cookie choices

We store your consent or refusal and its time in your browser for up to 6 months. This storage is necessary to remember your choice; its basis is GDPR Article 6(1)(f) and the necessity exemption in Section 155 Eht. Language and runic display are reflected in the URL, not in a separate identifier.

3.3 Statistics and referral sources

Only with prior, voluntary consent (GDPR Article 6(1)(a), Section 155 Eht.) do we record the referring website’s domain and the utm_source, utm_medium and utm_campaign campaign tags. We do not store the full referring URL. If you submit a form, the consented source is attached to your enquiry so we can identify the channel it came through. If you refuse, we do not attach this source data; the Website and form remain available.

Google Analytics 4 loads only after consent. It measures page views, traffic channels, device data, approximate geographic region and a form-submission event without identifying information. We do not send names, email addresses, messages or form-field contents to Google, nor link the analytics identifier to an applicant’s name. Google Ireland Limited provides the service; section 5 covers transfers to the USA. User-level and event-level measurement data are retained for 14 months; this limit does not apply to aggregated reports. We do not use ad personalisation or Google Signals.

3.4 Enquiries and beta applications

If you send a message through the Website’s form or apply for the inner circle, we process the following data: name, email address, message and — if you provide them — company, phone number, team size and the chosen hosting environment; furthermore the chosen language, the time of submission, the version of this notice and your acknowledgement of it, and — only with the separate consent described in section 3.3 — the referral source. Your browser sends the form contents over an encrypted connection directly to the Website’s own server (section 3.1). There, a small service validates the fields and composes a single email from the submission, which is delivered through the Resend email service (Plus Five Five, Inc., USA — see sections 4 and 5) to the info@hexalion.ai mailbox (Google Workspace, Google Ireland Limited). The submission is not stored on the server — neither in a file nor in a database; the service’s operational log contains only a timestamp, a status code and the email provider’s message identifier, no personal data. Your IP address is handled by the service only in memory and for at most one minute, to limit the number of submissions per minute (abuse prevention); it is never written to a log or to disk.

Purpose: answering your enquiry, evaluating your application and arranging the invitation; we reply to the email address you provide. Legal basis: for individuals as prospective contracting parties, steps prior to entering into a contract — Article 6(1)(b) GDPR; for company contacts or general enquiries, our legitimate interest in handling the enquiry — Article 6(1)(f) GDPR. The mandatory checkbox confirms that you have read this notice; it is not a newsletter consent. Without the mandatory fields we cannot accept the request.

We keep the enquiry and application data — the email received in our mailbox and our reply to it — for at most 6 calendar months from submission, then delete it; the email body states the due date of deletion. Deletion also covers referral data attached with your consent. Sending a voluntary update does not restart the period. At the email provider, delivery data is subject to the provider’s own, shorter retention. If a collaboration comes about, we will inform you separately about the further processing of the necessary data. In case of a substantiated legal claim or a statutory obligation, we retain only the necessary data, for the necessary time, separately.

3.5 Optional email updates

We send TerminalThor news and offers only with consent through the separate, unticked checkbox (GDPR Article 6(1)(a), Section 6 of Hungarian Act XLVIII of 2008 on Commercial Advertising). We record the consent wording, language, version, time and latest expiry alongside the enquiry. Permission lasts for up to 6 months and ends earlier if withdrawn. Unsubscribe by replying to an update or emailing info@hexalion.ai. This does not affect application review or a requested reply. We do not use individual email-open tracking pixels. We must honour an unsubscribe request before any further mailing.

4. Service providers used

5. Transfers of data to third countries

The email provider (Plus Five Five, Inc.) operates in the United States: it sends the emails from its Irish infrastructure but stores the email address, the message content and the delivery log in the United States. The transfer is based on the standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR); according to the provider, it is also certified under the EU–US Data Privacy Framework, which is covered by a Commission adequacy decision (Article 45 GDPR). The clauses are available at resend.com/legal/dpa or on request via the contact details in section 2.

Google LLC (USA) is a certified participant in the EU–US Data Privacy Framework; any transfer to the USA relies on that adequacy decision (Article 45 GDPR).

We do not make decisions with legal effects based solely on automated processing, or carry out profiling for such purposes, within the meaning of Article 22 GDPR.

6. Your rights

Right to object: you may object at any time to processing based on legitimate interests (Article 21 GDPR).

You may exercise the following rights in relation to the processing of your data at any time, free of charge:

Submit your request using the contact details in section 2. We will provide a substantive response within one month at the latest.

7. Remedies

If you believe that the processing of your data infringes the GDPR, you may lodge a complaint with the supervisory authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) (Hungarian National Authority for Data Protection and Freedom of Information), 1055 Budapest, Falk Miksa utca 9–11, Hungary; postal address: 1363 Budapest, Pf. 9.; phone: +36 1 391 1400; email: ugyfelszolgalat@naih.hu — naih.hu. You may also go to court if your rights are infringed (Article 79 GDPR, Section 23 Infotv.); at your choice, the proceedings may also be brought before the regional court (törvényszék) competent for your place of residence or stay.

8. Changes to this notice

We update this notice as necessary; the current version is available at /en/adatvedelem/.

Summary

From the data you enter in the form, the Website’s own EU-based server composes a single email and delivers it through the Resend service to the info@hexalion.ai mailbox; nothing is stored on the server. We keep the email for at most 6 months, then delete it. News and offers are sent only with your separate, voluntary consent, and you can unsubscribe at any time at info@hexalion.ai. Without your consent, cookies are used only to remember your settings; Google Analytics and its _ga cookies (up to 180 days) load only after your separate consent.