Privacy Policy

This is a courtesy translation. The German version is legally binding.

Last updated: 16 October 2026

1. Controller

The controller responsible for data processing on this website is:

xHeron Solutions GmbH
Hufelandstraße 20
10407 Berlin
Germany
Email: contact@xheron.com

This policy applies to the website xheron.com. Data processing in our products (Service and OS) is governed by the respective contracts with our customers.

2. What personal data is

Personal data is any information that can identify you, for example your name, email address or phone number. We only process it where the law allows it or where you have given consent.

3. Hosting and server log files

This website is hosted by Framer B.V., Rozengracht 207B, 1016 LZ Amsterdam, Netherlands. When you open a page, Framer automatically processes technical data sent by your browser:

  • the page visited and the time of access

  • the amount of data transferred

  • the page you came from

  • browser and operating system

  • IP address

We need this data to deliver the website securely and reliably. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR. We have concluded a data processing agreement with Framer. Framer uses subprocessors, including in the USA. Transfers are based on the EU-US Data Privacy Framework where recipients are certified, and additionally on the European Commission's Standard Contractual Clauses.

4. "Request a conversation" form

When you contact us through the form on the Discovery Call page, we process the information you enter there:

  • name, email address and phone number

  • company, number of your units and your message, if provided

  • the offer you are interested in

  • the page you came to the form from

We use this data to answer your request and prepare the conversation. The legal basis is Art. 6(1)(b) GDPR (request prior to a possible contract). Form data is processed by Framer and delivered to us by email. We also store requests in Google Sheets (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).

So that the thank-you page can summarise your answers and prefill the calendar, the website briefly keeps them in your browser's session storage (sessionStorage). They stay on your device and are deleted as soon as you book a slot or close the tab. This is strictly necessary for the function you requested (Section 25(2) no. 2 TDDDG).

We delete your request once it has been dealt with and no contract follows. If a contract is concluded, we keep the data for as long as statutory retention periods require (up to 10 years under the German Commercial Code and Fiscal Code).

5. Booking with Cal.com

On the thank-you page you can book a slot directly. For this we embed the calendar of Cal.com, Inc., USA. When the calendar loads, your IP address and technical data are sent to Cal.com. The calendar is prefilled with the name, email address and phone number from the form. Company, units and message are passed on as a note. Only when you confirm a slot is this information stored by Cal.com and the booking sent to us. The legal basis is Art. 6(1)(b) GDPR, because you want to arrange a conversation with us. Cal.com processes data in the USA. Transfers are based on the European Commission's Standard Contractual Clauses and, where Cal.com is certified, on the EU-US Data Privacy Framework. More information: https://cal.com/privacy

7. Google Analytics

With your consent we use Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics helps us understand how the website is used, for example which pages are visited and where visitors come from. For this, cookies are set and usage data such as device, browser, approximate location and interactions on the website is processed. Google Analytics 4 does not store IP addresses. Google Analytics is only loaded after you have consented. Advertising features and Google Signals are switched off.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Google may also transfer data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework. We have concluded a data processing agreement with Google. The data is deleted after 2 months.

More information: https://policies.google.com/privacy

8. Your rights

You have the right to:

  • access the data stored about you (Art. 15 GDPR)

  • rectification of inaccurate data (Art. 16 GDPR)

  • erasure (Art. 17 GDPR)

  • restriction of processing (Art. 18 GDPR)

  • data portability (Art. 20 GDPR)

  • object to processing based on our legitimate interest (Art. 21 GDPR)

  • withdraw consent with effect for the future (Art. 7(3) GDPR)

To do so, write to us at contact@xheron.com.

You can also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59-61, 10555 Berlin, Germany.

9. Obligation to provide data

You are not obliged to give us any data. Without your name, email address and phone number, however, we cannot process your request through the form. You can also simply send us an email instead.

10. Changes

We update this privacy policy when the website or the services we use change. The version published here applies.