Privacy notice
Who is responsible
HACOY GmbH, Oberföhringer Straße 26c, 81925 München, Germany, is the controller for personal data processed on this site. Reach us at [email protected].
HACOY Partners runs on a server in Munich, Germany, operated by HACOY GmbH. It runs without analytics, advertising or tracking pixels. The typefaces are the one external resource, see below.
What is stored and why
Visiting the site
The web server processes your IP address and the technical data your browser sends in order to deliver pages. Public forms store a salted hash of the IP address, never the address itself, to limit abuse. Those hashes are deleted after two days. Legal basis: legitimate interest in running a secure service, Art. 6 (1) f GDPR.
Typefaces
The typefaces Domine and Quicksand are served from this site itself. Your browser asks no outside service for them.
Cookies
Three cookies are used, all strictly necessary: a session cookie that keeps you logged in, a token that protects forms against cross site requests, and the language you chose. They serve only to run this site, so they need no consent banner. The session and the token expire when you log out or the session ends, the language after a year or when you change it.
Applying to join
Your name, email address, location and your answers to the application questions are stored so the application can be reviewed. A decision is sent to the address you gave. Legal basis: steps taken at your request before entering into an agreement, Art. 6 (1) b GDPR. Applications that are not accepted are kept for up to twelve months, so a later application can be read in context, and are then deleted. You can ask for earlier deletion at any time.
Being a partner
For as long as you are a partner here, we store your profile and the projects you work on, with their order sheets, sample photos, questions and updates, and the sections your role opens. They are seen by the people on the same project and by HACOY, never by the public and never by search engines. Your email address is not shown to other partners. Legal basis: performance of the agreement with you, Art. 6 (1) b GDPR.
Statements and bank details
If you sell HACOY on commission or receive credits as an ambassador, we store your store or billing details, whether you are a small business under § 19 UStG, your VAT number if you have one, the version of the contract you accepted with its time, your sales reports and your monthly statements. Your bank account number is stored encrypted, HACOY sees it only shortened, and it is used for nothing but paying you. Legal basis: performance of the agreement with you, Art. 6 (1) b GDPR, and the retention duties of commercial and tax law, Art. 6 (1) c GDPR, which keep statements for up to ten years.
Emails
HACOY Partners sends only messages that belong to your own matter: the decision on an application and the invitation that follows an acceptance. Each one is written or approved by HACOY and sent to the address on file. There is no newsletter here.
Cloudflare
Traffic to this site passes through Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, which connects the public address to the server in Munich and protects it against attacks. Cloudflare processes connection data such as your IP address for this purpose, under a data processing agreement and the EU standard contractual clauses. Legal basis: legitimate interest in a secure and available service, Art. 6 (1) f GDPR.
Your rights
You have the right to access the data stored about you, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, and to object to processing based on legitimate interest. To exercise any of these, write to [email protected]. You also have the right to complain to a supervisory authority, for Bavaria the Bayerisches Landesamt für Datenschutzaufsicht.