Privacy Policy.

1. Who is responsible for your data?

Represented by managing director Bruno Gouvea Taketani.
Email: contact@hzero.tech

You can use this address to contact us about privacy or to exercise your data protection rights.

2. Visiting the website

When you visit the website, your browser transmits technical data needed to deliver the requested pages and files. This includes your IP address and information about the request. Hosting and security systems may also record the date and time, requested URL, response status, browser and operating-system information, and referring page.

We process the technical data necessary to deliver the website, maintain its stability and protect it against misuse. The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure and reliable operation of our business website.

Technical connection data is necessary to provide the website. Without it, we cannot deliver the requested content.

The website uses static hosting provided by Porkbun LLC, acting as our processor. Its subprocessors include Amazon Web Services, Inc. (AWS) for hosting infrastructure and Cloudflare, Inc. for content delivery, reverse-proxy and security services. These providers process technical visitor data to deliver and protect the website.

Porkbun retains security-related system and access logs for 14 days. For other hosting data, its processing agreement limits retention to what is necessary to provide the service or meet applicable legal requirements, and provides for return or deletion on termination or written request, subject to legal storage obligations. The 14-day period applies to the specified logs rather than a universal deletion deadline for all infrastructure or backup copies. See Porkbun's Data Processing Addendum for its retention and deletion terms.

3. Contacting us by email

If you email contact@hzero.tech, we process your email address, name if provided, message, attachments and associated communication data to respond and manage the correspondence. Please send only the information necessary for your enquiry.

We use Google Workspace, provided by Google Cloud EMEA Limited, to receive, store and manage this mailbox. Google and its relevant subprocessors process email data under the Cloud Data Processing Addendum. Authorised members of our team access correspondence where needed to handle your enquiry. This mailbox is not connected to our CRM and is not automatically forwarded. We do not use Google Vault.

For enquiries about entering into or performing a contract with you, the legal basis is Article 6(1)(b) GDPR. For other business enquiries, including correspondence on behalf of an organisation, it is Article 6(1)(f) GDPR. Our legitimate interests are responding to enquiries and maintaining business relationships. Article 6(1)(c) GDPR applies where retention is required by law.

Providing information by email is voluntary, but we need sufficient contact and enquiry details to respond. We retain active correspondence while handling the enquiry and any necessary follow-up. We review closed enquiries monthly and delete ordinary enquiries at the first monthly review after six months have elapsed since closure, unless a continuing purpose or legal retention requirement applies. We delete spam, irrelevant messages and unnecessary duplicates promptly.

Correspondence qualifying as commercial or business letters is generally retained for six years, and invoices and accounting vouchers for eight years, calculated from the end of the relevant calendar year. We retain necessary records for longer where an applicable legal obligation, ongoing dispute or audit requires it. We restrict access to records retained solely for those purposes and delete them when the applicable requirements end.

Deletion from the mailbox is followed by Google's recovery and system-deletion processes. Messages normally remain in Trash for 30 days unless it is emptied earlier, and administrators can generally restore messages for 25 days after removal from Trash. Google's processing terms provide for completion of system deletion as soon as reasonably practicable and within 180 days after data is no longer recoverable by us, unless applicable law requires storage.

4. Cookies, local storage and analytics

The website sets no cookies and does not use local or session storage, analytics, advertising trackers, embedded third-party media, user accounts or contact forms. Fonts, images, stylesheets and scripts used for navigation and visuals are loaded from the website itself. The hosting setup adds no browser-side cookies, tracking, security scripts or external service requests.

5. Links to other websites

The website contains links to external websites, including our investors’ websites. Their logos are hosted locally. Following an external link takes you to a website whose operator is responsible for its own processing of your data. Its privacy information applies to your visit there.

6. Processing outside the European Economic Area

Google Workspace uses international infrastructure and subprocessors, so email data may be processed outside the European Economic Area, including in the United States. Applicable transfers are governed by Google's Cloud Data Processing Addendum and the transfer mechanisms it provides, including EU Standard Contractual Clauses where applicable. You can consult the processing terms and Standard Contractual Clauses, or contact us for information about the applicable safeguards.

Porkbun's hosting subprocessors AWS and Cloudflare process visitor data in the United States, as listed in Schedule 1(C) of its DPA. Schedule 3 incorporates EU Standard Contractual Clauses for applicable transfers requiring those safeguards. You can consult Porkbun's DPA and transfer provisions, or contact us for information about the applicable safeguards.

7. Your rights

Subject to the applicable legal conditions, you have the right to request access to your personal data, correction of inaccurate data, erasure, restriction of processing and data portability.

Where processing is based on legitimate interests under Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. If data is processed for direct marketing, you may object to that use at any time.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

To exercise your rights, email contact@hzero.tech. We may request information reasonably necessary to verify your identity. We generally respond within one month; an extension is possible in the circumstances permitted by the GDPR.

You may also lodge a complaint with a data protection supervisory authority, particularly in the country of your habitual residence, place of work or the alleged infringement. The authority responsible for private-sector organisations in Bavaria is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA).

8. Automated decisions

We do not use this website or enquiries sent to contact@hzero.tech for profiling or decisions based solely on automated processing that produce legal or similarly significant effects on you.

9. Changes to this policy

We will update this policy when the website or the way we process personal data changes. The date at the top will identify the current version.