Privacy notice
hexalion.ai
| Version | 1.1 |
| Effective from | 12 October 2026 |
| Controller | Tewelon GmbH |
1. Introduction
This notice explains how data is processed in connection with hexalion.ai (the Website). We process your data in accordance with the GDPR, the Austrian Data Protection Act (DSG) and TKG 2021.
2. Controller and contact details
| Controller | Tewelon GmbH |
| Registered office | Humboldtgasse 28/14, 1100 Vienna, Austria |
| Company registration number | FN 420303 v, register court: Handelsgericht Wien |
| info@hexalion.ai | |
| Phone | +36 70 218 6633 |
InstaPrice and Hexalion are brands of Tewelon GmbH’s AI business. Wherever the Website or this notice refers to InstaPrice or Hexalion, the controller is always Tewelon GmbH.
3. Individual processing activities
3.1 Visiting the Website — server logs
When you visit the Website, the server creates technical log entries. The Website is hosted on servers provided by Hetzner Online GmbH (see section 4).
| Data processed | IP address, timestamp, requested URL, browser identifier (user agent), referring page |
| Purpose | Secure and stable Website operation, troubleshooting and prevention of abuse |
| Legal basis | Legitimate interests — Article 6(1)(f) GDPR (interest in operational security) |
| Retention period | 14 days |
| Recipient | Hetzner Online GmbH as processor (hosting) |
3.2 Storage of your cookie consent choice (local storage)
The Website saves your cookie choice in your browser’s local storage. It is not sent to external providers and prevents the banner from appearing on every visit. Legal basis: Article 6(1)(f) GDPR; storage is strictly necessary under Section 165(3) TKG 2021 and does not require consent. Details are in the cookie policy.
3.2.1 Language selection
We read your browser’s primary language only to select the initial site language; it is not sent to external providers. Your manually selected language and the time of selection are stored in hexalion_language local storage for 12 months. This remembers the language setting you requested and is not used for tracking. Legal basis: Article 6(1)(f) GDPR; storage required for this expressly requested feature falls under the exception in Section 165(3) TKG 2021. You can change the language in the header and delete the entry through your browser’s site data settings.
3.3 Web analytics — Google Analytics 4
To measure visits to the Website, we use Google Analytics 4 (GA4).
Important: these services are loaded only after your express prior consent , which you can give in the cookie banner. Before consent, no analytics code is loaded and no requests are sent to Google.
| Data processed | Analytics cookies (_ga — 2 years; _ga_* — 2 years), pseudonymous visit statistics (no names or email addresses): pages viewed, visit duration, approximate geographical region, device and browser data |
| Purpose | Aggregate measurement of Website visits, improvement of content and user experience |
| Legal basis | Your consent — Article 6(1)(a) GDPR and Section 165(3) TKG 2021 |
| Retention period | Cookie lifetime: 2 years; event and user-level data stored in GA4 is retained for 14 months |
| Not sent to GA4 | Name, email address, the content of the contact form and any text you enter are not sent to Google Analytics. GA4 does not log or store IP addresses. We do not use advertising features (Google Signals, ad personalization). |
| Recipients | Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) as Google’s EU contracting entity; GA4 measurement takes place in Tewelon GmbH’s own Google Analytics account, without engaging any further processor |
| Transfers to third countries | Possible transfer to Google LLC (USA) — see section 5 |
You can withdraw consent at any time without giving a reason by clicking the footer’s “Cookie settings” link. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
3.4 Contact form
The Website’s contact form lets you enter your name, email address and message, and optionally your company name, phone number and topic of interest.
The data entered is received and recorded by the Website’s own server, operated by the controller (Hetzner Online GmbH, see section 4). An email notification of the message is sent to the controller’s info@hexalion.ai mailbox (Google Workspace).
| Data processed | Name, email address, message; optionally company name, phone number and topic of interest |
| Purpose | Receiving and responding to your enquiry; preparing a quotation if requested |
| Legal basis | If you are the prospective contracting party: steps prior to entering into a contract (Article 6(1)(b) GDPR). If you contact us as a business representative or with a general question: legitimate interests in receiving and responding to the enquiry (Article 6(1)(f) GDPR). The checkbox next to the form confirms acknowledgement of the privacy notice. |
| Retention period | Until discussions conclude; if no collaboration results, or no discussion takes place, we delete the data within 30 days of the last substantive contact, unless it is still needed for legal claims or statutory retention duties. If collaboration proceeds, processing continues under a separate agreement. |
| Recipients | Hetzner Online GmbH as processor (hosting); Google Ireland Limited as processor (Google Workspace, email notification) |
| Transfers to third countries | Possible transfer to Google LLC (USA) — see section 5 |
Providing data is voluntary; without the required fields, we cannot accept your enquiry. If you contact us directly by email, we process your data in the same way described above.
3.5 Subsequent professional and business communications — separate consent
A separate, unticked checkbox lets you agree to receive future emails from Tewelon GmbH about Hexalion’s professional updates and services. This is not a condition for us to respond to your enquiry.
| Data processed | Name, email address, optional company name; wording version, time, source and withdrawal of consent |
| Legal basis | Consent under Article 6(1)(a) GDPR, taking account of the rules on electronic communications |
| Retention | Until consent is withdrawn, but no longer than 24 months from consent. This applies to the separate contact register; the original message content is processed as described in section 3.4. |
| Withdrawal | At any time, free of charge: email info@hexalion.ai or use the unsubscribe option in the communication. Withdrawal does not affect the lawfulness of prior processing. |
| Recipients | Hetzner Online GmbH (hosting), Google Ireland Limited (Google Workspace, email) |
4. Processors
The controller uses the following processors under data processing agreements in accordance with Article 28 GDPR:
| Processor | Registered office | Activity |
|---|---|---|
| Hetzner Online GmbH (data centre: Hetzner Finland Oy, Helsinki, EU) | Gunzenhausen, Germany | Hosting, server operation |
| Google Ireland Limited | Gordon House, Barrow Street, Dublin 4, Ireland (EU) | Google Workspace (email), web analytics (GA4) |
5. Transfers to third countries
Google services may involve transferring data to the United States. Transfers rely on the EU–US Data Privacy Framework adequacy decision where applicable to the Google service concerned; otherwise, on the European Commission’s standard contractual clauses and necessary supplementary safeguards. Further information is provided in the Google data processing terms .
We do not carry out decision-making with legal effects based solely on automated processing, or profiling for that purpose, within the meaning of Article 22 GDPR.
6. Your rights
Objection: you may object at any time to processing based on legitimate interests (Article 21 GDPR).
You may exercise the following rights regarding data processing at any time, free of charge:
| Right | Description |
|---|---|
| Access (Article 15 GDPR) | You may ask whether we process your personal data and, if so, request a copy |
| Rectification (Article 16) | You may request correction of inaccurate data and completion of incomplete data |
| Erasure (Article 17) | You may request erasure of your data (the right to be forgotten) if there is no remaining legal basis for processing |
| Restriction (Article 18) | You may request restriction of processing in the cases specified by the Regulation |
| Data portability (Article 20) | You may request the data you provided in a machine-readable file or ask us to transfer it directly to another provider |
| Objection (Article 21) | You may object at any time, on grounds relating to your particular situation, to processing based on legitimate interests |
| Withdrawal of consent (Article 7(3)) | You may withdraw consent at any time without giving reasons; withdrawal does not affect the lawfulness of prior processing |
You can submit your request using the contact details in section 2. We normally respond within one month. For complex or numerous requests, this may be extended by a further two months; we will inform you of the extension and the reasons within the first month.
7. Remedies
If you believe that the processing of your data infringes the GDPR, you may lodge a complaint with a supervisory authority, particularly in the Member State of your habitual residence, place of work or the alleged infringement. The authority at the controller’s registered office is: Österreichische Datenschutzbehörde (DSB), Barichgasse 40–42, 1030 Vienna, Austria — www.dsb.gv.at.
8. Changes to this notice
We update this notice as needed; the current version is available on the adatvedelem.html page.