Skip to main content
Hexa LogicHexa Logic
Privacy

Privacy policy

Last updated: April 11, 2026

1. Data controller

The entity responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is:

Hexa Logic UG (haftungsbeschränkt)
Albin-Köbis-Str. 12
51147 Köln
Germany
Email: info@hexalogic.io

2. General notes

We take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy. Use of our website is generally possible without providing personal data.

3. Hosting

This website is operated on the edge network of Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) acting as a processor under Art. 28 GDPR. Visitors from the EEA are served from Cloudflare’s EU edge locations. A data processing agreement is in place with Cloudflare; the transfer to the United States is based on the EU Standard Contractual Clauses pursuant to Art. 46 (2)(c) GDPR and Cloudflare’s certification under the EU-U.S. Data Privacy Framework.

Each time our pages are accessed, Cloudflare automatically processes information transmitted by your browser in so-called server log files. These include:

  • Browser type and version
  • Operating system used
  • Referrer URL
  • Hostname of the accessing computer
  • Time of the server request
  • IP address

This data is used exclusively to ensure smooth operation, to defend against attacks (e.g. DDoS), and to investigate incidents affecting our infrastructure. The legal basis is Art. 6 (1)(f) GDPR (legitimate interest in operating a secure and stable website).

4. Cookies and consent

On your first visit we show you a cookie banner. Cookies that require consent are only set once you have explicitly agreed there - as long as you have not made a choice, no consent-based cookie is set and no consent-based script is loaded. You can change your decision at any time via the “Cookie settings” link in the footer of every page.

Strictly necessary cookies

These cookies are required for the operation of the website and are set without consent. The legal basis is § 25 (2) no. 2 TDDDG (strictly necessary cookies).

  • NEXT_LOCALE – stores your language selection (German or English) so that returning visits open in your preferred language.
  • hexa_consent– stores your own decision from the cookie banner so that we can honour it on every further page view and do not show you the banner again. Storage period: 12 months.

Consent-based cookies and services

Only after your explicit agreement do we embed services that are not required for the operation of the website. The banner distinguishes two categories, which you can select and deselect individually:

  • Statistics – Google Analytics 4, which sets the cookies _ga and _ga_<container id> (details in section 6), and the cookieless Cloudflare Web Analytics (details in section 7). The purpose is reach and usage analysis.
  • Marketing – the OpenAI advertising pixel, which stores an identifier on your device in the __obref cookie (details in section 5). The purpose is conversion measurement and attribution.

The legal basis for storing information on your device and reading such information is § 25 (1) TDDDG, and for the subsequent processing Art. 6 (1)(a) GDPR. Your consent is voluntary, separate per category, and can be withdrawn at any time with effect for the future.

5. OpenAI advertising pixel

Once you have given consent, we embed an advertising pixel of OpenAI, Inc. (San Francisco, USA) - a JavaScript file loaded from a server operated by OpenAI. Its purpose is to measure the success of our advertising campaigns: we want to understand whether and which actions on our website (e.g. submitting the contact form) go back to one of our ads (conversion measurement and attribution).

In particular, the following data is transmitted to OpenAI and processed there: your IP address, information about your browser and device, the pages you visit on our website and the actions you take there, as well as an identifier stored on your device in the __obref cookie.

The pixel sends two kinds of event. On every page you open it reports, under the name page_viewed, which page you opened. Once you have successfully submitted the contact form it additionally reports, under the name lead_created, that an enquiry has been made. The content of your enquiry and your name are not transmitted to OpenAI.

The advertising account additionally has automatic advanced matching switched on. With it, the pixel reads the email address you entered in the contact form, derives a SHA-256 hash from it and transmits that hash to OpenAI. This does not only happen when you submit the form: once you have entered your email address, the hash is sent along with every further event for the rest of your visit, including when you open other pages. Your email address itself is not transmitted in clear text. Such a hash nevertheless remains personal data, because it allows OpenAI to recognise you. This transmission, too, only happens if you have consented to the marketing category.

We embed the pixel ourselves and decide on the purpose and means of that integration; to that extent we are responsible for the collection and transmission of the data. The recipient of the data is OpenAI, Inc., which processes it further under its own responsibility.

The legal basis is your consent pursuant to Art. 6 (1)(a) GDPR and § 25 (1) TDDDG, given via the cookie banner. Without your consent the pixel is not loaded and no data is transmitted to OpenAI.

Using the pixel involves a transfer of personal data to the United States (Art. 44 et seq. GDPR). We base this transfer on the EU Standard Contractual Clauses pursuant to Art. 46 (2)(c) GDPR. There is no adequacy decision that covers the transfer by itself. There is therefore a general risk that US authorities may access this data under certain conditions and that you may not have the same legal remedies against this as in the European Union.

You can withdraw your consent at any time with effect for the future - via the “Cookie settings” link in the footer of every page. After withdrawal the pixel is no longer loaded on further page views and no further data is transmitted to OpenAI; the lawfulness of the processing carried out up to the withdrawal remains unaffected.

For the retention period of the data processed by OpenAI and for your rights towards OpenAI, please refer to their privacy policy: openai.com/policies/privacy-policy. You can also delete the identifier stored on your device at any time via your browser settings.

6. Google Analytics 4

After your consent for the “Statistics” category we use Google Analytics 4, a web analytics service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Its purpose is reach and usage analysis: we want to understand how our website is used, which content is in demand, and where we can improve it.

The data processed includes in particular your IP address, information about your browser and device, the pages you view, your interactions on the website, and an approximate location. We have enabled IP anonymisation (anonymize_ip): your IP address is truncated by Google before any further processing.

Google Analytics sets cookies for this, in particular _ga and _ga_<container id>, each with a storage period of roughly two years. You can delete these cookies at any time via your browser settings.

We use Google Consent Mode v2: all consent signals default to “denied” for as long as you have not made a choice. Before your agreement, no cookies are set and no measurement data is transmitted to Google.

Our contracting entity is Google Ireland Limited; the data may be passed on to Google LLC in the United States (Art. 44 et seq. GDPR). We base this transfer on the EU Standard Contractual Clauses pursuant to Art. 46 (2)(c) GDPR; Google LLC is additionally certified under the EU-U.S. Data Privacy Framework. Even so, access to this data by US authorities cannot be entirely ruled out.

The legal basis is your consent pursuant to Art. 6 (1)(a) GDPR and § 25 (1) TDDDG. You can withdraw it at any time with effect for the future via the “Cookie settings” link in the footer of every page; the lawfulness of the processing carried out up to the withdrawal remains unaffected.

For details of the processing by Google, please refer to their privacy policy: policies.google.com/privacy. Independently of our banner, you can additionally prevent collection by Google Analytics with Google’s browser add-on: tools.google.com/dlpage/gaoptout.

7. Cloudflare Web Analytics

Also only after your consent for the “Statistics” category, we use Cloudflare Web Analytics of Cloudflare, Inc. acting as a processor. Its purpose is aggregate reach measurement: how often our pages are requested and how quickly they are delivered. The data processing agreement with Cloudflare named in section 3 covers this processing as well.

Cloudflare Web Analytics is cookieless: no identifier is stored on or read from your device, and no cross-site profile is built. A small script (the beacon) transmits the page URL requested, the referrer URL, page timing measurements, and coarse information about your browser and device. Your IP address is processed only transiently and is not stored for the analysis.

The legal basis is your consent pursuant to Art. 6 (1)(a) GDPR. We obtain it voluntarily: because the measurement works without cookies and without an identifier on your device, using it without consent would be arguable - we nevertheless leave it to your decision. Without your agreement the beacon is not loaded. You withdraw your consent as described above, via the “Cookie settings” link in the footer of every page.

8. Contact form

When you send us inquiries via the contact form, the data you provide (name, email address, optionally company, phone, and your message) is stored for the purpose of processing the request and in case of follow-up questions.

Messages are delivered via the transactional email service of Mailjet SAS (4 rue Jules Lefebvre, 75009 Paris, France), a Sinch company, acting as a processor. Processing takes place within the European Union; a data processing agreement pursuant to Art. 28 GDPR is in place with Mailjet. After submitting, you automatically receive a confirmation email at the address you provided. The data is not passed on to any further third parties. The only exception is the case described in section 5: if you have consented to the marketing category, the advertising pixel transmits a hash of your email address to OpenAI. Without that consent this does not happen. The legal basis is Art. 6 (1)(b) GDPR (performance of pre-contractual measures) or Art. 6 (1)(a) GDPR (consent, via the checkbox).

The data you enter in the contact form remains with us until you request its deletion, revoke your consent, or the purpose for data storage no longer applies.

9. Fonts

To ensure consistent typography we use the “Inter” and “Space Grotesk” fonts, served self-hosted from our own server. There is no connection to Google Fonts or any other CDN provider.

10. Your rights

You have the right at any time:

  • under Art. 15 GDPR, to obtain information about your personal data,
  • under Art. 16 GDPR, to request the correction of inaccurate data,
  • under Art. 17 GDPR, to request the deletion of your personal data,
  • under Art. 18 GDPR, to request the restriction of processing of your personal data,
  • under Art. 20 GDPR, to receive your personal data in a structured, common, machine-readable format,
  • under Art. 21 GDPR, to object to processing, and
  • under Art. 77 GDPR, to lodge a complaint with a supervisory authority. You can usually contact the supervisory authority of your usual place of residence or our company headquarters.

11. Validity of this statement

This privacy policy is currently valid. Due to further development of our website or changes in legal or regulatory requirements, it may become necessary to amend this statement.