Privacy Policy

1. Who We Are

HatadX ("HatadX", "we", "us", or "our") is a business systems and automation service legally registered in the Philippines (Business Number 4237572) and operated by its founder as a sole proprietor, with operations in Belgium and across the European Union. We provide AI-assisted growth blueprints, GoHighLevel implementation, workflow automation, and virtual assistant services to businesses worldwide through our website at www.hatadx.com (the "Site").

For the purposes of the EU and UK General Data Protection Regulation ("GDPR"), the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data, and the Data Privacy Act of 2012 (Republic Act No. 10173) of the Philippines (the "DPA"), HatadX is the controller of the personal data described in this policy. Because we offer our services to individuals and businesses in the European Union, the GDPR applies to that processing in full. You can reach us at any time at info@hatadx.com.

2. Scope of This Policy

This Privacy Policy explains what personal data we collect, why we collect it, how we use, share, store, and protect it, and the rights you have over it. It applies to visitors of the Site, people who submit our forms, subscribers to our newsletter, prospective clients, and clients whose engagements we manage.

Where we process personal data on behalf of a client in the course of delivering services (for example, contact records inside a client's own GoHighLevel account), we act as a personal information processor on that client's instructions, and the client's own privacy policy governs that data. This policy governs the data we collect for our own purposes.

3. Information We Collect

We collect only the information we need to respond to you and deliver our services:

• Identity and contact data: your name, email address, phone number (optional), and company name, provided through our contact form, blueprint form, newsletter signup, or direct correspondence.
• Business profile data: information you share in our free AI Growth Blueprint form, including your industry, annual revenue range, team size, business challenges, and goals.
• Communications data: the contents of messages you send us by form, email, or scheduling notes.
• Booking data: when you book a call through our Calendly link, Calendly collects your name, email, and selected time slot under its own privacy policy and shares the booking details with us.
• Technical and usage data: our hosting and performance tooling (Vercel, including Vercel Speed Insights) collects aggregated, privacy-preserving performance metrics such as page load times and general device categories. We do not run advertising trackers on the Site.

We do not intentionally collect special categories of personal data (such as health, biometric, or political information), and we ask that you do not include such information in free-text form fields.

4. How and Why We Use Your Data (Legal Bases)

We process personal data for the following purposes, relying on the legal bases required by the GDPR and the criteria for lawful processing under the DPA:

• To respond to your inquiries and deliver the free Growth Blueprint you request (legal basis: performance of a contract, or steps taken at your request prior to a contract).
• To provide, administer, and invoice our paid services (legal basis: performance of a contract).
• To send our newsletter and occasional service updates you have signed up for (legal basis: your consent, which you may withdraw at any time).
• To operate, secure, and improve the Site (legal basis: our legitimate interests in running a functional, safe website).
• To keep business and accounting records and comply with Philippine tax and regulatory obligations (legal basis: compliance with legal obligations).
• To establish, exercise, or defend legal claims (legal basis: our legitimate interests).

5. AI-Assisted Processing

Our free Growth Blueprint combines automated (AI-assisted) analysis of the business information you submit with human review by our team. Every blueprint is reviewed and finalized by a person before delivery. We do not make decisions producing legal or similarly significant effects about you based solely on automated processing.

6. Cookies and Analytics

The Site is designed to be light on tracking, consistent with the EU ePrivacy Directive as implemented in Belgian law. We use strictly necessary functionality provided by our hosting platform and privacy-preserving performance analytics (Vercel Speed Insights) that measure how fast pages load without building advertising profiles or storing identifying cookies. We do not use third-party advertising cookies, which is why the Site does not present a cookie consent banner. Embedded third-party services you choose to interact with (such as Calendly) may set their own cookies under their own policies, and we will introduce a consent mechanism before ever adding non-essential cookies of our own.

7. Who We Share Data With

We never sell or rent your personal data. We share it only with service providers who help us run HatadX, under contracts that limit what they can do with it:

• Supabase: secure database hosting for form submissions (such as blueprint requests).
• Vercel: website hosting and performance analytics.
• Calendly: call scheduling, when you choose to book a call.
• Email and productivity providers we use to correspond with you and deliver your blueprint.
• Professional advisers (such as accountants) and authorities, where required by law.

If HatadX is ever reorganized, merged, or sold, personal data may be transferred as part of that transaction, subject to this policy.

8. International Data Transfers

HatadX is based in the Philippines, and our service providers store data in various regions, including the United States and the European Union. Wherever your data travels, we take steps to ensure it remains protected to the standards described in this policy, including using providers that offer recognized transfer safeguards such as the European Commission's Standard Contractual Clauses, and complying with the DPA's requirements on cross-border transfers of personal data.

9. How Long We Keep Your Data

We keep personal data only as long as we need it for the purposes described above:

• Inquiry and blueprint submissions: up to 24 months from our last interaction, so we can follow up and reference prior recommendations, unless you ask us to delete them sooner.
• Client records and contracts: for the duration of the engagement plus the period required by Philippine tax and accounting law (generally up to 10 years).
• Newsletter data: until you unsubscribe, after which we retain only the minimum needed to honor your opt-out.

When data is no longer needed, we delete it or irreversibly anonymize it.

10. How We Protect Your Data

We apply organizational, physical, and technical security measures appropriate to the risk, as required by the DPA and GDPR. These include encrypted connections (HTTPS) across the Site, access controls and role separation on our databases, use of reputable providers with strong security practices, and limiting access to personal data to those who need it to serve you. No method of transmission or storage is completely secure, but if we become aware of a personal data breach that is likely to harm you, we will notify you and the relevant authorities as required by applicable law, including the 72-hour notification requirements of the Philippine National Privacy Commission and GDPR supervisory authorities.

11. Your Rights Under the GDPR (EU, EEA, and UK)

If you are in the European Union, European Economic Area, or United Kingdom, you have the right to:

• Access the personal data we hold about you and receive a copy.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten") where there is no overriding reason to keep it.
• Restrict or object to our processing, including any processing based on legitimate interests.
• Data portability: receive your data in a structured, commonly used, machine-readable format.
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
• Lodge a complaint with your local supervisory authority.

We respond to rights requests within one month, extendable by two further months for complex requests as the GDPR permits, and free of charge except where requests are manifestly unfounded or excessive. Where Article 27 GDPR requires the appointment of a representative in the Union for our processing activities, we will maintain one; contact us for current representative details.

12. Belgium: Your Supervisory Authority

Given our operations in Belgium, the supervisory authority most relevant to our EU processing is the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit). You can contact it at Rue de la Presse 35, 1000 Brussels, Belgium, via www.dataprotectionauthority.be, or by email at contact@apd-gba.be. You always retain the right to complain to the supervisory authority of your own EU member state instead, and doing so never affects your other legal remedies.

13. Your Rights Under the Philippine Data Privacy Act (RA 10173)

If you are in the Philippines, or your data is processed by us as a Philippine entity, you have the rights of a data subject under the DPA and its Implementing Rules and Regulations:

• The right to be informed about how your personal data is processed.
• The right to access your personal data.
• The right to object to processing, including for direct marketing.
• The right to rectification of inaccurate data.
• The right to erasure or blocking of data that is unlawfully processed or no longer necessary.
• The right to damages for violations of your data privacy rights.
• The right to data portability.
• The right to file a complaint with the National Privacy Commission (NPC) at privacy.gov.ph.

14. Your Rights as a United States Resident

We do not sell or share personal information for cross-context behavioral advertising as defined by the California Consumer Privacy Act (CCPA/CPRA), and we have not done so in the preceding 12 months. If you are a resident of California or another US state with a comprehensive privacy law (such as Virginia, Colorado, Connecticut, or Texas), you may request access to, correction of, or deletion of your personal information, and you will not be discriminated against for exercising those rights. Submit requests to info@hatadx.com; we will verify your identity and respond within the timeframe your state law requires.

15. Marketing Communications

We only send marketing emails to people who have signed up for them. Every marketing email includes an unsubscribe link, and you can also opt out any time by emailing info@hatadx.com. Transactional emails (such as delivering a blueprint you requested or responding to your inquiry) are not marketing and are sent as needed.

16. Children's Privacy

Our services are for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.

17. Third-Party Links

The Site links to third-party websites and services (for example, Calendly and our social media profiles). We are not responsible for their privacy practices, and we encourage you to read their policies before providing them personal data.

18. Changes to This Policy

We may update this policy as our services, providers, or legal obligations change. The "Last updated" date at the top reflects the latest revision. For material changes, we will post a prominent notice on the Site or email you where appropriate. Continued use of the Site after changes take effect means the updated policy applies.

19. How to Contact Us or Complain

To exercise any of your rights, ask a question, or raise a concern about how we handle personal data, email info@hatadx.com. We will respond as soon as we can and always within the timelines required by applicable law. If you are unsatisfied with our response, you may complain to the Philippine National Privacy Commission, the Belgian Data Protection Authority, any other EU/UK supervisory authority competent for you, or your state attorney general, as applicable to you.