This is an English translation for convenience. The legally binding version is the German Datenschutzerklärung.

Privacy Policy

As at: 27 September 2026.

1. Controller

Hydreatio GmbH, Ludwig-Ganghofer-Straße 4, 82031 Grünwald, Germany
Email: contact@hydreatio.org · Telephone: +49 89 90 17 39 75

A data protection officer is not required by law and has not been appointed. For all privacy questions, please contact us at contact@hydreatio.org.

2. Accessing the website

When you access the website, our hosting service provider processes technically necessary connection data, in particular IP address, date and time, requested resource, referrer, browser, operating system and status code. The processing serves the secure, stable provision of the service and the detection of misuse. The legal basis is Art. 6(1)(f) GDPR. Log data are stored for at most 14 days and are subsequently erased or anonymised, unless a security incident requires longer retention.

The hosting provider is Render (Render Services, Inc., USA); the transfer to the USA takes place on the basis of the EU standard contractual clauses (Art. 46 GDPR). Technical connection data (e.g. truncated IP addresses in server logs) are processed. The servers are located in the Frankfurt region (Germany).

3. Contacting us

If you contact us via a form, by email or by telephone, we process your contact and content data in order to handle the enquiry. The legal basis is Art. 6(1)(b) GDPR for pre-contractual or contractual matters, otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in appropriate communication. We keep the data until you ask us to erase them or object to the processing, and review once a year whether storage is still necessary; statutory retention obligations remain unaffected. Enquiries sent through the forms are transmitted to our form server (Render, Frankfurt region), stored in our database (Supabase, EU region Frankfurt) and forwarded to us by email via Zoho Mail (Zoho Corporation B.V., the Netherlands, data centres in the EU).

White paper downloads

To download a white paper, you enter your business email address and, optionally, your company. We process these details to provide the white paper to you and to record the request as a business contact, so that we can respond to technical questions. The legal basis is Art. 6(1)(b) GDPR for providing the requested document and Art. 6(1)(f) GDPR; our legitimate interest lies in communicating with professionally interested parties. You only receive promotional emails if you tick the separate box (Art. 6(1)(a) GDPR, see section 5). Transmission, storage and retention follow the details above for contacting us.

Website assistant (chat)

The website offers a chat with an AI assistant. It is only started when you open it; it sets no cookies. We process the messages you type, the page you started on, the time and a shortened, hashed form of your IP address to answer your question and to protect the service from misuse. To generate an answer, your message is sent to the language model provider we use (Google Ireland Limited / Google LLC, Gemini API; as a fallback Anthropic PBC, USA), each acting as our processor. Please do not enter sensitive personal data in the chat.

If you want the assistant to prepare an enquiry, open a booking or an upload page for you, or continue a longer conversation, we ask for your name and email address and confirm the address with a code sent by email. At the end of such a conversation you and our team receive the transcript by email. So that you are not asked for a code again, the confirmation is stored in your browser on this device for up to 90 days; you can remove it in the chat at any time. The legal basis is Art. 6(1)(b) GDPR for handling your request, your consent under Art. 6(1)(a) GDPR given in the chat for the transcript email, and Art. 6(1)(f) GDPR; our legitimate interest lies in answering enquiries efficiently and in preventing misuse. Conversations are stored in the EU and deleted when they are no longer needed for handling your request, unless statutory retention duties apply.

4. Short assessment, maturity level, cost/ROI calculator and solution matching

When you use our tools, we process your entries, for example industry, location, water application, operating parameters and challenges. Contact data are only processed if you enter them. The purpose is the evaluation you requested and, if desired, sending it to you. The legal basis is Art. 6(1)(b) GDPR; separate promotional contact takes place exclusively on the basis of your consent under Art. 6(1)(a) GDPR.

The evaluation is an automated orientation. It produces no legal or similarly significant effect; no decision within the meaning of Art. 22 GDPR takes place. Entries and results are stored until you ask us to erase them or object to the processing; we review once a year whether storage is still necessary. The database and storage are provided by Supabase (Supabase Inc.), instance in the EU region Frankfurt (Germany); any third-country access is covered by EU standard contractual clauses.

5. Email information

We send promotional emails only after demonstrable consent or within the narrow scope of § 7(3) UWG (German Act Against Unfair Competition). For documentation purposes we store the email address, the consent wording, the time, the source and the confirmation status. The legal basis is Art. 6(1)(a) GDPR; the keeping of records is additionally based on Art. 6(1)(f) GDPR. You can withdraw your consent at any time with effect for the future. Every promotional email contains a simple option to unsubscribe.

Dispatch takes place via Zoho Mail (Zoho Corporation B.V., the Netherlands, data centres in the EU) as processor. We keep the consent records for as long as the consent exists and thereafter only as long as they are needed as evidence.

6. Cookies and similar technologies

We store or read technically necessary information pursuant to § 25(2) TDDDG (German Telecommunications Digital Services Data Protection Act) in so far as this is strictly necessary for the service expressly requested. All other cookies, pixels, local storage and comparable technologies are only used after your consent pursuant to § 25(1) TDDDG. In so far as personal data are processed, Art. 6(1)(a) GDPR is the legal basis. You can change your selection at any time under “Cookie settings”; the withdrawal does not affect the lawfulness of the previous processing.

The only analytics tool we use is Google Analytics 4, and only with your consent (see below). We use no tracking or marketing tools. We store your choice in the cookie banner in your browser’s local storage (key “hydreatio-consent”) so that the banner does not appear on every visit; this is technically necessary (§ 25(2) TDDDG). External media (YouTube videos) are only loaded after your consent in the “Marketing/external media” category.

Google Analytics 4

With your consent in the “Statistics” category we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics sets cookies (e.g. “_ga”) and processes shortened IP addresses, device and browser information, pages viewed, time on page and referral source to give us pseudonymised reports on how the website is used. Advertising features and Google signals are switched off. The legal basis is § 25(1) TDDDG and Art. 6(1)(a) GDPR. A transfer to Google LLC in the USA is possible; Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). The data is deleted after 14 months. You can withdraw your consent at any time under “Cookie settings”; the cookies are then removed. More information: https://policies.google.com/privacy.

7. Embedded media and social networks

External media and social media content are only loaded after your consent. When they are loaded, the provider may receive your IP address and technical usage data and may transfer data to third countries. The website embeds videos from YouTube (Google Ireland Limited, Ireland) in privacy-enhanced mode (youtube-nocookie.com); a video is only loaded when you click it and agree to the “Marketing/external media” category. Google may transfer data to the USA; the basis is the EU-US adequacy decision (Data Privacy Framework).

8. Recipients, processors and third countries

We engage service providers only to the extent necessary and, where applicable, on the basis of a contract pursuant to Art. 28 GDPR. Transfers outside the EEA take place only where there is an adequacy decision or with appropriate safeguards pursuant to Art. 46 GDPR; supplementary protective measures are assessed on a risk basis.

Recipients in connection with this website are: Render (Render Services, Inc., USA; server region Frankfurt; EU standard contractual clauses) for hosting and the form server, Supabase (Supabase Inc.; EU region Frankfurt; EU standard contractual clauses for any third-country access) for the database, and Zoho Mail (Zoho Corporation B.V., the Netherlands) for sending email. GitHub processes only source code and no visitor data.

9. Data from professional sources

Where a person makes contact in a business context or a permissible business relationship exists, we may process professional contact data, function, company, communication history and publicly available business information. The purpose is handling the specific business matter and relationship management. The legal basis is Art. 6(1)(b) or (f) GDPR. Promotional contact takes place only within the additional limits of § 7 UWG. In so far as data have not been collected directly from you, we provide the information pursuant to Art. 14 GDPR within the statutory period, unless an exception applies.

10. Retention period

We store personal data only for as long as is necessary for the respective purpose. Thereafter we erase or anonymise them, unless statutory retention obligations, the assertion of or defence against claims, or a documented suppression list against renewed advertising justify limited further storage. Specific periods are set out in the respective sections and in the internal erasure concept.

11. Your rights

Under the GDPR you have rights to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). You may withdraw consent pursuant to Art. 7(3) at any time with effect for the future. You may lodge a complaint pursuant to Art. 77 with a data protection supervisory authority; for non-public undertakings in Bavaria the Bayerisches Landesamt für Datenschutzaufsicht (Bavarian Data Protection Supervisory Authority) is regularly competent.

Objection to direct marketing: You may object at any time to the processing of your personal data for direct marketing. Thereafter we will no longer use the data for this purpose.

12. Security and updating

We take appropriate technical and organisational measures pursuant to Art. 32 GDPR. This policy will be amended if services or the legal situation change. As at: 27 September 2026.