Privacy policy

In the event of a conflict, the German version prevails.

1. Controller

Hawk Intelligent Technologies GmbH
Schafäckerlein 23
91413 Neustadt an der Aisch, Germany
E-mail: info@hawkivo.com
Phone: +49 9161 87192-0

2. Processing when visiting our website

2.1 General access data (server logs)

Each time our website is accessed, our web server automatically logs certain data (IP address, date/time of the request, data volume transferred, browser type/version, operating system). We use this data to provide the website, ensure system security, and optimize our offering. No combination with other data sources takes place. Log files are typically stored for 7 days unless security-related events require a longer retention.
Legal basis: Art. 6(1)(f) GDPR (legitimate interests).

2.2 Contact (contact form and e-mail)

If you contact us, we process the information you provide (e.g., name, e-mail address, message) to handle your inquiry. Mandatory fields are marked accordingly.
Legal basis: Art. 6(1)(a) GDPR (consent) or Art. 6(1)(b) GDPR (contract/pre-contractual measures), depending on the request.

The enabled contact form sends your information to our mailbox info@hawkivo.com. If you allow reCAPTCHA (section 2.4), its security result is checked on the server before transmission.

2.2a Technical delivery of contact inquiries

We use Amazon Web Services (AWS), Frankfurt region (eu-central-1), to receive, validate and email your inquiry. Your inquiry is delivered to the mailbox above and retained there for handling. Your email address is used as the reply-to address. After delivery, our service also transfers your name, email address, company, phone number (if provided), message, request type, audience, product interest, language, the address of the form page and the processing notice shown to you to our CRM HubSpot (HubSpot Ireland Limited, Ireland, as processor, EU data centre; for transfers to third countries see section 2.3). There we create a contact with your inquiry in order to handle it, match follow-up questions and contact you later about your request (Art. 6(1)(b) GDPR, pre-contractual measures). We only transfer a HubSpot visitor identifier if you have allowed the HubSpot tracking code (section 2.4). Your inquiry does not subscribe you to a newsletter; you only receive marketing emails with separate newsletter consent. We delete contact data without an ongoing business relationship no later than three years after the last contact, unless statutory retention obligations apply.

To prevent duplicate delivery, we store a technical request identifier, a checksum and the delivery status with an expiry of 24 hours; AWS automatically removes expired entries, with a possible delay in physical deletion. Form contents and reCAPTCHA secrets are not stored in these entries or technical logs. Technical logs without form contents are retained for seven days. Inquiries in the mailbox are deleted once their purpose is fulfilled and statutory retention periods have expired.

2.3 Newsletter and marketing e-mails

On the “Newsletter” page you can subscribe to the general Hawk IVO newsletter and to the product newsletters for Hawk IVO Force, Hawk IVO Plan and Hawk IVO Scheduler. For sending, subscription management and proof of consent we use HubSpot (HubSpot Ireland Limited, 1 Sir John Rogerson’s Quay, Dublin 2, Ireland) as our processor; the data is stored in HubSpot’s EU data center. Your sign-up is first received by our own service on Amazon Web Services in Frankfurt, checked with Google reCAPTCHA (section 2.4) and forwarded to HubSpot with your email address, chosen topics, language, the consent texts shown and the address of the sign-up page. We only pass on a HubSpot visitor identifier if you have allowed the HubSpot tracking code (section 2.4). Our service does not store sign-up data; technical logs without email addresses are kept for seven days.
We use the double opt-in procedure: you receive an email with a confirmation link and only receive the newsletter after confirming. HubSpot stores the consent text, time and confirmation as proof.
Open and click measurement: Newsletter subscription and consent to measurement are independent. You can subscribe without open and click tracking. Personally identifying analysis of whether and when you open our newsletters and which links you click (tracking pixels and redirect links) requires separate, optional consent. You manage this consent in your personal subscription preferences using the link in our emails. HubSpot checks tracking consent for the recipient email address; no measurement takes place without recorded consent or after its withdrawal. You can allow or withdraw measurement independently of your newsletter subscription. Withdrawal also prevents further recording of opens and clicks in emails already sent; it does not automatically delete data previously collected.
Legal basis: Art. 6(1)(a) GDPR and Sec. 25(1) TDDDG (consent).
Unsubscribe: At any time via the unsubscribe link in every email, via the subscription preferences page or by contacting us. Unsubscribed addresses are kept on a suppression list so that you receive no further marketing.
Customer information: Customers receive important information about their contracts and the products they use (such as maintenance, security notices, contract changes) by email via HubSpot even without a newsletter subscription (Art. 6(1)(b) GDPR). These emails contain no open or click measurement.
Retention: Until you unsubscribe; afterwards only your email address on the suppression list and the proof of consent remain for as long as we need them as evidence.
Transfer to third countries: HubSpot, Inc. (USA) is certified under the EU-US Data Privacy Framework; the EU Standard Contractual Clauses apply in addition.
Provider’s privacy policy: https://legal.hubspot.com/privacy-policy (opens in a new tab)

2.4 Cookies, consent and services used

We use technically necessary entries without consent (Sec. 25(2) no. 2 TDDDG): your choice in the privacy settings (hawk-consent, browser storage, twelve months), your manually selected light or dark appearance (hawk-theme, browser storage, 365 days from selection; removed when you choose “System”) and the confirmation of an accepted contact request (hawk-enquiry-accepted, session storage, until the tab is closed). These entries stay in your browser and are transferred neither to us nor to third parties.

We use all other services only with your consent. They are loaded only after you agree; before that, there is no connection to the providers. The AI assistant is an exception: it only loads when you expressly start it (section 2.8). Consent management is part of this website itself; no external provider is involved. You can change or withdraw your consent at any time with effect for the future via “Privacy settings” in the footer of every page. When you withdraw consent, we delete the service’s cookies on our domain; you can delete cookies on the providers’ domains in your browser. The privacy settings show the provider, purpose, stored entries and retention period for every service used.
Legal basis: Art. 6(1)(a) GDPR and Sec. 25(1) TDDDG (consent); withdrawal under Art. 7(3) GDPR.
Transfers to third countries: For all of the following services, data may be transferred to the USA. Google LLC and Meta Platforms, Inc. are certified under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission of July 10, 2023); the EU Standard Contractual Clauses apply in addition.

Google reCAPTCHA (protecting the contact form)

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Purpose: checking whether the contact form is filled in by a person, to protect against automated requests and misuse. In particular, your IP address, browser and device information and interactions with the page are processed. reCAPTCHA only loads on the contact page and only after you consent; without consent, you can reach us by e-mail, phone or by booking an appointment. The cookie _GRECAPTCHA on www.google.com (opens in a new tab) (6 months) and the entry _grecaptcha in browser storage are stored.
Provider’s privacy notice: https://policies.google.com/privacy (opens in a new tab)

Google Analytics 4 (audience measurement)

Provider: Google Ireland Limited (address above). Purpose: statistical analysis of usage (pages visited, time spent, origin, device and browser) in order to improve the website. Google Analytics 4 does not store complete IP addresses. Google signals, advertising features and ad personalization are switched off. The cookies _ga and _ga_<ID> are stored on our domain (13 months). Google deletes the measurement data after the retention period set in Google Analytics.
Provider’s privacy notice: https://policies.google.com/privacy (opens in a new tab)

Google Ads (advertising measurement)

Provider: Google Ireland Limited (address above). Purpose: measuring whether visitors who click one of our ads on Google go on to contact us, subscribe to the newsletter or book an appointment (conversion measurement), and showing our ads to suitable audiences, including again to visitors of our website (remarketing). In particular, your IP address, browser and device information, pages visited and the ad click identifier are processed; if you are logged in to Google, Google may link the data to your account. The Google Ads tag only loads after you consent and uses Google’s consent mode: without consent, no advertising cookies are set and no data is sent to Google for advertising purposes. Google processes the data for Google Ads as an independent controller. The cookies _gcl_<ID> (such as _gcl_au, _gcl_aw) are stored on our domain (90 days) and the cookie IDE on doubleclick.net (13 months). If you have also allowed the HubSpot tracking code and arrive via one of our ads, our CRM HubSpot stores the ad click identifier (GCLID) with your contact. If you later become an inquiry (lead), a sales opportunity or a customer, HubSpot reports this stage together with the click identifier to Google Ads so that we can measure the success of our ads. We do not transfer your name, email address or phone number in this process.
Provider’s privacy notice: https://policies.google.com/privacy (opens in a new tab)
Data processing terms: https://business.safety.google/adscontrollerterms/ (opens in a new tab)

Meta Pixel (advertising measurement)

Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Purpose: measuring whether visitors open our website after seeing our ads on Facebook or Instagram, and showing ads to suitable audiences. In particular, your IP address, browser information, pages visited and events are processed; if you are logged in to Meta, Meta may link the data to your account. We are jointly responsible with Meta for collecting the data and transmitting it to Meta (Art. 26 GDPR); Meta alone is responsible for any further processing. The cookies _fbp and _fbc are stored on our domain (90 days).
Joint controller agreement: https://www.facebook.com/legal/controller_addendum (opens in a new tab)
Provider’s privacy notice: https://www.facebook.com/privacy/policy/ (opens in a new tab)

HubSpot (linking visits to contacts)

Provider: HubSpot Ireland Limited, 1 Sir John Rogerson’s Quay, Dublin 2, Ireland. Purpose: we recognize which pages you visit and link these visits to your contact in our CRM once you are known to us, for example after a newsletter sign-up or a click on a link in our emails. This lets us tailor content and communication to your interests. Processed data include in particular IP address, browser and device information, pages visited, time spent and origin. The tracking code loads from HubSpot’s EU data center and only after your consent; we do not use HubSpot’s own cookie banner. The cookies __hstc and hubspotutk (6 months), __hssc (30 minutes) and __hssrc (until you close the browser) are stored on our domain. Without this consent we do not link website visits to a contact, even if you subscribe to the newsletter. HubSpot, Inc. (USA) is certified under the EU-US Data Privacy Framework.
Provider’s privacy policy: https://legal.hubspot.com/privacy-policy (opens in a new tab)

YouTube (videos in knowledge articles and news)

Provider: Google Ireland Limited (address above). Purpose: playing videos directly on our website. We serve the video preview images from our own server; this does not connect to YouTube. Only when you click “Play video” does the player load from www.youtube-nocookie.com (opens in a new tab) (privacy-enhanced mode). This click is your consent to YouTube; you can withdraw it in the privacy settings. In particular, your IP address, browser and device information and your use of the player are processed; if you are logged in to Google, Google may link the playback to your account. After playback, YouTube may set cookies on its domains such as YSC (until you close the browser), VISITOR_INFO1_LIVE and VISITOR_PRIVACY_METADATA (6 months) as well as entries in browser storage. Without consent, you can open videos directly on YouTube via “Watch on YouTube”.
Provider’s privacy notice: https://policies.google.com/privacy (opens in a new tab)

HubSpot Meetings (appointment booking)

Details on the booking calendar on our “Appointment” page are given in section 2.7.

2.5 Social media presences and links

We only link to external profiles (Facebook, LinkedIn, X/Twitter, Instagram/Threads, YouTube, WhatsApp). A connection is established only when you click a link. Processing then falls under the provider’s responsibility (their terms/privacy apply). We evaluate interactions only within our legitimate interests.
Legal basis: Art. 6(1)(f) GDPR.

2.6 Hosting by Amazon Web Services

Our website is provided as a static website via AWS Amplify Hosting. The provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. The website is operated in the AWS Europe (Frankfurt) region and delivered via the AWS content delivery network. When the website is accessed, technically required connection data (in particular IP address, time, requested address, browser information) is processed in order to provide the website and ensure its security. A transfer to Amazon Web Services, Inc., USA, cannot be ruled out and takes place – where necessary – on the basis of the EU Standard Contractual Clauses (SCC).
Legal basis: Art. 6(1)(f) GDPR.

2.7 Online appointment booking with HubSpot

On our “Appointment” page you can book a call via HubSpot Meetings (HubSpot Ireland Limited, 1 Sir John Rogerson’s Quay, Dublin 2, Ireland, as processor, EU data centre). The booking calendar only loads when you click “Load booking calendar”; this click is your consent to this service, which you can withdraw in the privacy settings (section 2.4). Without consent, the link opens the booking page directly at HubSpot. When loading, HubSpot processes in particular your IP address and browser details and may set the cookies __hstc and hubspotutk (6 months), __hssc (30 minutes) and __hssrc (until the browser is closed) on go.hawkivo.com.

When you book an appointment, we process your first name, last name, email address, the chosen slot and any information you voluntarily provide in the booking form. HubSpot creates or updates a contact in our CRM and adds the appointment to our Microsoft 365 calendar (Microsoft Ireland Operations Limited, Ireland, as processor). The call takes place via Microsoft Teams; you receive the access link with the invitation. Booking does not subscribe you to a newsletter. We delete contact data without an ongoing business relationship no later than three years after the last contact, unless statutory retention obligations apply.
Legal basis: for loading the calendar Art. 6(1)(a) GDPR and Sec. 25(1) TDDDG (consent), for the booking Art. 6(1)(b) GDPR (pre-contractual measures).
Transfer to third countries: HubSpot, Inc. and Microsoft Corporation (USA) are certified under the EU-US Data Privacy Framework; the EU Standard Contractual Clauses apply in addition.
Providers’ privacy policies: https://legal.hubspot.com/privacy-policy (opens in a new tab) and https://privacy.microsoft.com/privacystatement (opens in a new tab)
Alternative: Appointments can also be arranged by email or phone.

2.8 AI assistant (Hawk IVO Force)

On our website you can ask an AI assistant questions. It runs on our Hawk IVO Force platform. The assistant is loaded only when you open it and select “Start chat”. Before that, there is no connection to Hawk IVO Force and nothing is stored in your browser. You are chatting with an AI: the answers are generated automatically, may contain errors and are not binding.

Data processed: your messages and the assistant’s answers. So that the assistant can help with the page you have open, our website sends the following information with each message:

• the page identifier, language and address of the page without parameters, plus its title, description and main heading;
• the heading of the visible section and any questions you have opened;
• for the contact form: whether it is available, the selected topic, audience and product interest, and the names of fields with errors;
• the addresses of further pages of this website that you have opened in the same tab since your last message (without parameters);
• for the assistant’s actions: the headings and questions of the open page, the names of the available filters and language versions, and the options of the contact form.

Not transmitted: what you type into form fields, selected text, the previously visited page (referrer) and your mouse or keyboard input outside the chat. Loading and using the chat involves technically necessary connection data, in particular IP address, time and browser information.

Voice input: you can also speak your questions in the chat. This is optional. The microphone is only used once you tap the microphone icon in the chat and allow access in your browser; nothing is recorded before that. A second click ends the recording; it stops automatically after 60 seconds at the latest. The recording is transmitted to Hawk IVO Force and converted into text there by a speech model that Microsoft provides through Azure OpenAI as our processor. You see the recognized text in the input field and can edit or discard it. It is only sent when you submit it; after that we treat it like any other chat message. We delete the audio recording immediately after conversion, at the latest after two hours. As long as the conversation is stored, only technical details such as duration, file size and detected language are kept. No voice profile is created. Your browser may remember the permission for our website; you can revoke it at any time in its site settings.

Purpose and legal basis: we answer your questions about our company, our products and the page you have open. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a quick, relevant answer) and, for inquiries about entering into a contract, Art. 6(1)(b) GDPR. In your browser we store only what is strictly necessary to provide the chat you started, in accordance with Section 25(2) No. 2 TDDDG. The chat only accesses the microphone if you explicitly choose voice input and allow it in your browser. The assistant does not make decisions with legal effect (Art. 22 GDPR). We do not analyze chat content for advertising or profiling.

Attached files: When you attach files, their names and contents are transferred to Hawk IVO Force and processed for your question, for example to assess a requirements catalogue. Readable content is extracted from supported PDF, XLSX, DOCX, text and Markdown files. Unreadable or incompletely processed sections must be taken into account in the answer.

Actions on the website: The assistant can offer to open something on our website for you: a section or question of the open page, a filtered list, the search with a search term, the contact form with a preselected topic and product, another language version or the privacy settings. An action is only carried out once you confirm it in the prompt that appears. Whether it was carried out, declined or not possible is transmitted with your next message. The assistant cannot submit forms, write into form fields or change your consent settings.

Storage in your browser: After your explicit start, our panel controls store only whether the assistant is open or minimized in this tab’s sessionStorage under “hawk-assistant”. The SDK and Hawk IVO Force also use tab-bound identifiers and visit state to continue the current conversation after navigation or reload, where your browser permits this. Messages are loaded from the server-side chat. The X minimizes the chat. “End chat” ends the current conversation after confirmation and removes the embed and panel marker; it does not delete server messages. The separate “Allow persistent chat history” choice remains in “hawk-consent” for at most twelve months. Persistent browser storage requires this consent and a suitable Delivery setting; it is currently disabled. On withdrawal, the website waits for confirmed cleanup before its own reload or removal. Blocked storage or missing confirmation prevents a deletion guarantee. If the chat is already removed, cleanup takes place at the next explicitly started chat. You can also clear browser entries in your browser settings.

Recipients and place of processing: Hawk IVO Force is operated by us and runs in data centers in Germany. The language model is provided by Microsoft Ireland Operations Limited (Dublin) via Azure AI Foundry as a processor. Processing takes place in the EU data zone (EU and EEA countries and Switzerland).

Retention: Server retention for chat histories and page information sent with them: 90 days after the last activity, followed by a daily deletion run. Backlogs or errors may delay complete deletion. Connection data for abuse prevention (rate limiting) is stored for at most one month and technical logs for at most 24 hours. Server retention is separate from optional persistent browser storage.

Your choice: you decide whether to start the assistant. Please do not enter sensitive data in the chat. For binding inquiries, please use e-mail, phone or appointment booking.

3. Processing when using our SaaS services

We offer cloud-based software services (SaaS) (e.g., an intelligent shift-planning platform) and process registration/usage data to the extent necessary to provide the services.
Legal basis: Art. 6(1)(b) GDPR (contract); internal analyses preferably in aggregated/anonymous form. Processing on behalf of business customers: Where customers use our platform as controllers, we act as a processor (DPA in place). Service providers/transfers: Instructed service providers (hosting, e-mail, support, etc.); transfers only where contractually/legally required.
Retention: Data is stored only as long as necessary; afterwards deletion/anonymization.

4. Job applications

If you apply to us, whether for an advertised position or on your own initiative, we process the information you send us for this purpose: in particular contact details, cover letter, CV, references and other certificates, our correspondence with you and any further information you share during the process, for example in interviews.

Purpose: Reviewing your application and deciding whether to enter into an employment relationship.
Legal basis: Art. 6(1)(b) GDPR and § 26(1) BDSG (German Federal Data Protection Act; steps prior to an employment relationship). If you voluntarily provide special categories of personal data (e.g. a severe disability), we process them under Art. 9(2)(b) GDPR and § 26(3) BDSG to the extent the process requires. To defend against legal claims after the process has ended, we rely on Art. 6(1)(f) GDPR. We ask for your separate consent before adding you to our talent pool (Art. 6(1)(a) GDPR).
Submission: We accept applications by e-mail to the address given on our careers pages, currently info@hawkivo.com. Ordinary e-mail is not end-to-end encrypted. You may also send your documents another way, for example by post to the address in section 1.
Recipients: Only the management and the people involved in selecting candidates for the position have access to your application. Service providers that operate our IT and our e-mail mailbox process the data only on our instructions as processors (Art. 28 GDPR). We do not pass your application on to any other third parties.
Retention: If no employment relationship is established or you withdraw your application, we delete your data no later than six months after the process has ended. This period allows us to defend against possible claims under the German General Equal Treatment Act (AGG). We keep the data longer only with your consent for the talent pool, which you can withdraw at any time with effect for the future. If you are hired, we transfer the necessary information to your personnel file.
Obligation to provide data: Providing your data is required neither by law nor by contract. Without it, however, we cannot consider your application. No decision based solely on automated processing (Art. 22 GDPR) is made.

Your rights under section 5 also apply to your application data.

5. Your rights as a data subject

• Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18)
• Data portability (Art. 20)
• Objection (Art. 21) – in particular to direct marketing
• Withdrawal of consent (Art. 7(3))
• Complaint (Art. 77) with a supervisory authority (e.g., BayLDA)

To exercise your rights, please contact us by e-mail (see above). For access requests (Art. 15), we may ask for proof of identity.

6. Objection and opt-out options

• Cookies/tools: Non-essential services only with consent; change or withdraw at any time via “Privacy settings” in the footer of every page. You can also delete cookies that have already been set in your browser.
• Newsletter/email marketing: Unsubscribe at any time via the link in each email or by sending us a message (suppression list).

7. Currency and changes to this Privacy Policy

We reserve the right to adapt this Privacy Policy as needed (e.g., if our services or legal requirements change). The current version is always available on our website.

8. Additional information for users outside the EU

Our offerings are primarily aligned with the GDPR. We do not sell personal data. When accessing from third countries, data transfers outside the EEA may occur (e.g., to service providers in the USA). Where required, we rely on EU Standard Contractual Clauses (SCC) and additional safeguards; details on recipients/transfers can be found in the sections on the respective services. Rights may vary by jurisdiction; we endeavor to honor legitimate requests under the applicable law.

Download privacy policy (English) (opens in a new tab)