Privacy policy

1. Who is responsible

The controller under the General Data Protection Regulation (GDPR) for this website and for every request sent through it is:

Projects for businesses in Poland are handled by our sister company:

If your business is in Poland, we pass your request (contact form, free check, quiz, Website Scan or booking) to HADRON FOR BUSINESS sp. z o.o., which follows it up and may offer you a project. We recognise a request from Poland by the country you give in the form, by the Polish dialling code of your telephone number (+48) or, for the Website Scan, by the country derived from your IP address when you send the form and, as a last resort, by the domain of your website (.pl). Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in having requests from Poland followed up by the company that serves businesses in Poland. Both companies work with the same CRM in Odoo. You can reach both companies at the e-mail address above.

Joint controllers

Leppich Investments und Consulting GmbH and HADRON FOR BUSINESS sp. z o.o. are joint controllers (Art. 26 GDPR) for the personal data in the CRM they share in Odoo: requests sent through this website and the contacts, leads and projects that follow from them. They have agreed the following:

• Leppich Investments und Consulting GmbH provides the information in this privacy policy and is your contact point for everything about your data.
• You can exercise your rights (section 15) against either company. The company you contact deals with your request and involves the other one where needed.
• Each company uses only the data it needs for its own tasks: Hadron for requests and projects from businesses in Poland, Leppich Investments und Consulting GmbH for everything else described in this policy.
• Both companies protect the shared database together, including the data processing agreement with Odoo S.A., and inform each other without delay of any data breach and of any enquiry from a supervisory authority.

2. Visiting the website

This website runs on Odoo, a platform of Odoo S.A. (Belgium), hosted in data centres in the European Union. When you open a page, the server processes the technical data your browser sends: IP address, date and time, the page requested, the referring page, browser and operating system. We need this data to deliver the pages and to keep the website secure. Odoo processes it on our behalf under a data processing agreement (Art. 28 GDPR).

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a secure, working website.

3. Cookies and your consent

Cookies the website needs in order to work are set without consent: session_id (session and form security, 7 days), frontend_lang (language choice, 1 year), tz (time zone, until you close the browser) and website_cookies_bar (stores your cookie choice, 400 days). Legal basis: Art. 6(1)(f) GDPR together with the exemption for strictly necessary storage (in Germany § 25(2) TDDDG).

The analytics and marketing tools in section 4 load only after you click “I agree” in the cookie bar. If you click “Only essentials”, they stay switched off. You can change your decision at any time on our Cookie Policy page, which also lists every cookie.

4. Analytics and marketing, only with your consent

Microsoft Clarity

Microsoft Ireland Operations Limited (Ireland). Clarity shows us how visitors use our pages, for example clicks, scrolling and where a form is abandoned, so that we can fix usability problems. We do not use it to identify you.

Meta Pixel

Meta Platforms Ireland Limited (Ireland). The pixel measures whether visits and enquiries come from our adverts on Facebook and Instagram and helps us show adverts to relevant audiences. We and Meta are joint controllers for collecting and transmitting this data (Art. 26 GDPR); Meta alone is responsible for what happens to it afterwards. Meta's privacy policy: facebook.com/privacy/policy.

Legal basis for both tools: your consent, Art. 6(1)(a) GDPR (in Germany also § 25(1) TDDDG). You can withdraw it at any time with effect for the future. Microsoft and Meta may transfer data to their parent companies in the USA; both are certified under the EU-US Data Privacy Framework, for which an adequacy decision under Art. 45 GDPR applies.

5. Statistics without cookies

Odoo's built-in visitor statistics use Plausible Analytics. It sets no cookies and builds no profiles; it counts page views, referring pages, country and device type in aggregated form. The script is provided by Odoo S.A. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in knowing how the website is used.

6. Fonts

Our pages load the typefaces Inter and Source Serif 4 from Google Fonts (Google Ireland Limited). For this, your browser connects to Google servers and transmits your IP address. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a consistent, readable presentation. Google may transfer data to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework.

7. Contact form, free check and quizzes

When you use the contact form, the free check or a funding quiz, we store what you enter (for example name, e-mail address, company, industry, country, your answers and your message) in our CRM in Odoo, together with the page the request came from. We use this data to answer you, to send you the result you asked for and to follow up on your enquiry.

Legal basis: Art. 6(1)(b) GDPR (steps taken at your request before a possible contract) and Art. 6(1)(f) GDPR (our legitimate interest in answering business enquiries). If no business relationship follows, we delete the data once it is no longer needed for your enquiry.

8. Website Scan

When you request the Website Scan, we store what you enter in the form (website address and e-mail address and, if you answer the optional questions in the second step: what customers should do on your website, the search term you want to be found with and the interests you tick) in our CRM in Odoo, together with the page the request came from. If you add the personal review, we also store your company name, your country and, if you give it, your VAT ID. We use this data to carry out the scan, to send you the report and, for the add-on, to handle your order. Legal basis: Art. 6(1)(b) GDPR. How long we keep the data: as in section 7; for orders, section 11.

Which company handles your request

Leppich Investments und Consulting GmbH carries out every Website Scan and sells the personal review to businesses in every country, including Poland. If your business is in Poland, we also pass your request to HADRON FOR BUSINESS sp. z o.o. as described in section 1.

What the scan analyses

The scan runs automatically and analyses only publicly accessible information about the website you submit and the business behind it: the website itself, Google search results, positions in Google Maps and public reviews. This information can include personal data, for example the owner's name in the legal notice or the names of reviewers. We use it only for your report. The free report is generated and checked automatically; nobody reads it by hand. With the personal review, Tomasz Leppich reads and checks it himself. Legal basis: Art. 6(1)(b) GDPR towards you and, for personal data of other people in this public information, Art. 6(1)(f) GDPR, our legitimate interest in providing the analysis you asked for.

The same website within 30 days

If you request the same domain again within 30 days from the same e-mail address, we do not run a new scan but send your existing report again. For this, we keep the report with your first request. A request from a different e-mail address gets its own scan, so a report only ever goes to the person who requested it.

Did the report arrive?

The link to your report in our e-mail runs through our own link tracker in Odoo. When you click it, we record the time of the click, your IP address and the approximate country derived from it, and link them to your request. We use this to know whether the report arrived and was opened, and to choose a good moment to contact your business about the report: the first click notifies Tomasz Leppich. We set no cookies for this. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in knowing that the report has reached you and in following it up at a suitable time. We keep this information as long as your request (section 7). You can object to it at any time (section 15).

Tips by e-mail and payment

We send you tips by e-mail after the report only if you tick the box for this in the form (section 9). How the personal review is paid for is described in section 11.

9. Occasional e-mails from us

If you tick the box in the free check to receive the occasional useful note from Hadron, we send such e-mails to the address you gave. If you tick the box in the Website Scan form, the company that handles your request (section 1) sends you up to 3 short tips by e-mail after the report; without the tick, you receive only the e-mails about your request. Legal basis: your consent, Art. 6(1)(a) GDPR. You can withdraw it at any time by replying to one of these e-mails or by writing to info@hadronforbusiness.com, and for the Website Scan tips also through the unsubscribe link in each e-mail; we then stop sending them.

10. Booking a consultation

You can book a video consultation in our online calendar (Odoo Appointments). We process your name, e-mail address, your telephone number if you give it, the time you chose and your answers to the booking questions, send you the calendar invitation and hold the call in Odoo's video tool. Legal basis: Art. 6(1)(b) GDPR.

11. Orders and payment

If you add the personal review to the Website Scan, we process your billing details (name, company, country, address, VAT ID, e-mail address), the website address you give us and the order itself. You pay on a secure payment page of our order system in Odoo. Payments by card or Revolut Pay and, for payments in złoty, by BLIK are handled by Stripe Payments Europe, Limited, Dublin, Ireland, as payment service provider of Leppich Investments und Consulting GmbH. Your card and payment details go directly to Stripe; we do not store them. Stripe's privacy policy: stripe.com/privacy.

Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (tax and accounting obligations). Leppich Investments und Consulting GmbH keeps invoices and accounting records for up to 10 years, as German commercial and tax law requires (§ 147 AO, § 257 HGB). For projects invoiced by HADRON FOR BUSINESS sp. z o.o., that company keeps them for 5 years after the end of the year in which they were issued, as Polish tax and accounting law requires.

12. Projects and funding applications

For audits, implementations and support we process the contact details of the people we work with and the business data you give us access to, as far as the project requires. Legal basis: Art. 6(1)(b) and (f) GDPR.

If your company applies for funding, for example BAFA in Germany or Dig.IT in Poland, we prepare the information the application needs. It reaches the funding body or the programme operator only through you or at your request.

13. E-mail

We use Google Workspace (Google Ireland Limited) for e-mail, so messages you send us are processed there. Legal basis: Art. 6(1)(b) or (f) GDPR.

14. Who receives data

• Odoo S.A.: hosting, CRM, order system and payment pages, appointments, the report link tracker and e-mails sent from the website
• Stripe: payment processing
• Google: e-mail and fonts
• Microsoft and Meta: only if you agreed in the cookie bar
• HADRON FOR BUSINESS sp. z o.o.: as joint controller, for requests and projects from businesses in Poland (section 1)
• accounting and legal advisers, courts and authorities, where the law requires it

15. Your rights

• access to your data (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing based on our legitimate interest, and to direct marketing at any time (Art. 21 GDPR)
• withdrawal of consent at any time, with effect for the future (Art. 7(3) GDPR)

An e-mail to info@hadronforbusiness.com is enough. You also have the right to lodge a complaint with a supervisory authority. For Leppich Investments und Consulting GmbH, the competent authority is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit) in Wiesbaden, Germany. For HADRON FOR BUSINESS sp. z o.o., it is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland. You can also contact the authority in your own country.

16. Do you have to provide data?

No, providing data is voluntary. Without the fields marked as required, we cannot answer your enquiry or carry out an order.

17. Automated decisions

We do not make decisions based solely on automated processing within the meaning of Art. 22 GDPR. The free check calculates a score from your answers to point to a likely bottleneck; this has no legal or similarly significant effect on you. The Website Scan report is also created automatically; it assesses your website, not you, and has no such effect either.

18. Changes

We update this policy when our website or our processing changes. The date at the top shows the current version.

See also: Legal notice · Terms and Conditions · Cookie Policy