Privacy Policy – Batalyse GmbH

Effective date: 2026-10-13

At Batalyse, we value your privacy. This Privacy Policy explains how we handle your personal data when you use our website and software products.

This Privacy Policy should be read in conjunction with our End User License Agreement (EULA) and our Terms and Conditions, which provide additional details on data handling for Software users.

This Privacy Policy forms part of the Agreement between you and Batalyse GmbH, as defined in the End User License Agreement (EULA). In case of conflicts regarding data processing and personal data handling, this Privacy Policy prevails to the extent permitted by applicable law.

All references to “EULA Section X” refer to the https://www.batalyse.com/eula.

1. What Data We Collect

We may collect the following types of data:

1.1 Personal Data

Information that identifies you, such as your name, address, email, and phone number. We collect this when you provide it directly (e.g., contacting us, subscribing to our newsletter, or requesting a trial license).

1.2 General Data

Technical information about your browser, operating system, IP address (anonymized), Origin serial number, MAC address, server fingerprint, and website usage.

1.3 Usage Data

For the Data Analysis module, we collect details on how often you use our software for license management and software improvement purposes.

1.4 Test/Analysis/Raw/Result Data (User Content)

Only if you actively mail or upload this data either directly to us or to a Collect or Mind demo server not installed at your site. Batalyse otherwise has no access to this information.

For complete details on User Content handling, see EULA Section 5.1.

1.5 Bug Reports and Log Files

Data Analysis Module:

Automated bug reporting is enabled by default (opt-out available)
When an error occurs, the software automatically sends error details, software version, timestamp, filename (not contents), and your contact information
You can disable this feature at any time through software settings
No test data, analysis results, or file contents are transmitted
See EULA Section 5.2.3 for complete details

Collect and Mind Modules:

Optional telemetry (opt-in required)
You must explicitly enable log file transmission through software settings
When enabled, system log files and technical diagnostics are sent
No user content or test data is transmitted
See EULA Section 5.2.2 for complete details

Manual Provision:

You may manually provide log files or diagnostic information when requesting technical support
See EULA Section 5.2.4 for details

2. How We Collect Data

We collect data:

When you visit our website
When you subscribe to our newsletter
When you contact us via email, phone, or contact forms
When you actively mail, send, or upload test/analysis/raw/result data or bug reports
Through local aggregate website counters and hosting logs (see Section 10.1)
Through HubSpot for newsletter management and tracking (see Section 10.2)
When you use the “Ask batalyse” chat on our website (see Section 10.3)
When you use our software products as described below

2.1 Software Data Collection

Batalyse offers both online and offline licensing options. Data collection varies by module and license type:

On-Premise Operation:

The Software operates on your own infrastructure
Batalyse does not have access to your analysis, test, or result data
Your scientific work and User Content remain on your own systems
See EULA Section 5.1 for complete on-premise data handling details

License Validation:

For online licenses, connection to our license server transmits only information necessary for validating and managing the license (hardware fingerprints, license status, usage counts)
License server communication never includes the content of your analysis or test data
See EULA Section 3 for license activation details

Optional Data Transmission:

Batalyse only accesses your data if you choose to manually send or upload analysis/test data or log files for technical support, troubleshooting, or optional demo purposes
Automated bug reporting and telemetry are opt-in (Collect/Mind) or opt-out (Data Analysis) as described in Section 1.5 and EULA Section 5.2
In specific cases, Batalyse can offer non-anonymized usage counts or similar identifying data exchange as part of the licensing process, but this will only be enabled if explicitly authorized by you with your written consent

Offline Licenses:

Operate without any data transfer to or from Batalyse servers unless you proactively initiate such contact
See EULA Section 3.2 for offline license details

For comprehensive information on data access, telemetry features, and user control mechanisms, please refer to EULA Section 5.2.

3. How We Use Your Data

We use your data to:

Provide, expand, and improve our website and software
Send newsletters with informational updates
Respond to your service and feature requests
Ensure security and prevent fraud
Analyze how our website and software are used
Optimize our marketing strategies
Communicate and collaborate using Microsoft Teams and Microsoft Office software, which may involve processing your contact information and communication content
Run, host, and manage our software infrastructure
Manage and validate software licenses for our Data Analysis module, which involves storing an Origin Serial Number, anonymized IP address, license start and end date, and license name on our license server hosted by Ionos (Ionos Privacy Policy)
Count your and your team’s number of test data evaluations for the Data Analysis module
Create and manage licenses for our Collect and Mind software modules through Keygen (Keygen Privacy Policy)
Provide demo environments for our Mind and Collect software products, hosted by Contabo (Contabo Privacy Policy)
Answer the questions you ask in the “Ask batalyse” chat and improve our documentation based on them (see Section 10.3)

For detailed information on how we use data provided for technical support and software improvement, see EULA Section 5.3.

4. Data Sharing and International Transfers

4.1 Data Sharing

We do not share your personal data with third parties except when:

Required by law
Necessary to provide our services
Using third-party processors under GDPR-compliant agreements

4.2 Third-Party Processors

We use the following third-party processors:

Ionos: Data Analysis license server hosting (EU-based) – Ionos Privacy Policy
Keygen: Managing Collect and Mind software licenses (US-based with safeguards) – Keygen Privacy Policy
Contabo: Demo environment hosting for Collect and Mind, and hosting of the “Ask batalyse” chat service (EU-based) – Contabo Privacy Policy
Microsoft: Communication and collaboration (Office 365, Teams, Azure), with data primarily stored within the EU/EEA – Microsoft Privacy Statement
IONOS: Website hosting and logs; local aggregate statistics (see Section 10.1)
HubSpot: Newsletter management and email tracking (see Section 10.2)
Anthropic: AI model provider used only for the “Ask batalyse” chat on our website (US-based with safeguards). Anthropic receives only the chat conversation and excerpts from our pages, solely to generate the answer, and is not used for any other purpose (see Section 10.3) – Anthropic Privacy Policy

4.3 International Data Transfers

Where personal data is transferred outside the EU/EEA (for example to service providers such as HubSpot, Microsoft, Anthropic, or Google), such transfers are made under:

EU–U.S. Data Privacy Framework
Standard Contractual Clauses (SCCs)
Other appropriate safeguards ensuring an adequate level of protection in compliance with Article 46 GDPR

For complete details on international data transfers, including all third-party service providers and legal safeguards, see EULA Section 5.5.3.

5. Data Storage and Retention

We retain your data only as long as necessary to fulfill the purposes outlined in this policy or as required by law:

Newsletter subscription data: Kept until you unsubscribe
Demo server data: Purged regularly after testing purposes are completed. Users must maintain their own backups of any data uploaded to demo servers.
Support and diagnostic data: May be retained indefinitely for software testing, quality assurance, and compatibility validation purposes as detailed in EULA Section 5.3.3. You may request deletion at any time by contacting support@batalyse.com. Deleted data will be removed within 30 days.
License and account data: Retained for the duration of your license plus any legally required retention period for accounting and tax purposes
Contact and communication data: Retained for as long as necessary to respond to your inquiries and maintain our business relationship
“Ask batalyse” chat conversations and ratings: Deleted after 30 days (see Section 10.3)

For detailed retention policies, anonymization procedures, and deletion rights, see EULA Section 5.3.

6. Your Rights Under GDPR

Under the General Data Protection Regulation (GDPR), you have the following rights:

Access (Art. 15 GDPR): Request a copy of the personal data we hold about you
Correction (Art. 16 GDPR): Request the correction of inaccurate or incomplete personal data
Deletion (Art. 17 GDPR – Right to be Forgotten): Request the deletion of your data under certain conditions
Restriction of Processing (Art. 18 GDPR): Limit how we process your data
Data Portability (Art. 20 GDPR): Receive your personal data in a structured, commonly used, and machine-readable format
Objection (Art. 21 GDPR): Object to data processing for direct marketing or on grounds related to your situation
Automated Decision-Making (Art. 22 GDPR): Not to be subject to decisions based solely on automated processing

To exercise these rights, please contact us at support@batalyse.com (see Section 12).

Additionally, you have the right to lodge a complaint with a supervisory authority if your data protection rights have been violated.

7. US Residents – Additional Rights and Clarifications

7.1 GDPR-Level Rights for All Users

Batalyse provides all users—including US residents—the data rights described in Section 6 of this policy, including the rights of access, correction, deletion, restriction, objection, and data portability, as granted under the GDPR.

7.2 No Sale or Sharing of Personal Information

Batalyse does not sell personal information, nor do we share personal information for commercial purposes or cross-contextual behavioral advertising as defined under US state privacy laws (including California’s CCPA/CPRA).

If these practices change, US customers will be notified in advance and provided with opt-out options.

7.3 Additional Rights Under US State Laws

Where US state privacy laws grant additional rights—such as the right to opt out of the sale or sharing of personal information, or enhanced rights regarding sensitive personal information—those rights will apply if and when Batalyse engages in such activities.

7.4 Data Deletion and Portability for US Residents

Upon request or account termination, US residents may request deletion of their personal data or a copy in a portable, commonly used format. Batalyse will comply within 90 days unless a longer or shorter period is required by applicable law.

7.5 How to Exercise US Privacy Rights

US users can exercise these rights in the same manner as described for GDPR rights by contacting support@batalyse.com (see Section 12). If you are a US resident and have any questions about your state-specific rights or wish to exercise them directly, please contact us and specify your state of residence.

7.6 Appeal Process

If you disagree with Batalyse’s response to a data rights request, you may appeal the decision by emailing support@batalyse.com with the subject line “Privacy Appeal.” Your appeal will be reviewed by a senior data protection officer, and a written response will be provided within 45 days as required by U.S. state law.

8. Legal Basis for Processing

We process your data based on:

Your consent (Art. 6(1)(a) GDPR) – when you explicitly agree to data processing, such as enabling telemetry features
Contractual necessity (Art. 6(1)(b) GDPR) – when processing is necessary to fulfill our contractual obligations to you
Legal obligations (Art. 6(1)(c) GDPR) – when we must process data to comply with legal requirements
Legitimate business interests (Art. 6(1)(f) GDPR) – when we have legitimate interests that do not override your rights, such as software improvement and security

9. Contacting Us

If you contact us (via email, Microsoft Teams, or website forms), we store your data to process and respond to your request. This data includes your name, contact information, and the content of your communication.

We retain this data for as long as necessary to respond to your inquiry and maintain our business relationship.

10. Third-Party Tools and Services

10.1 Local aggregate website statistics

We count requests for our website pages, downloads and video files, and playback starts in our website video players. Direct video links remain available; their server requests cannot establish whether a person watched a video. We do not use Google Analytics for new visits.

Our internal statistics store daily totals per published resource, including request counts, delivered bytes, grouped errors and video starts. They contain no visitor identifiers, fingerprints, IP addresses, individual event histories or access tokens. The playback counter sends only a video identifier to our own server, without analytics cookies or browser storage. It does not record viewing progress or follow visitors across pages.

For successful page requests, we also derive daily referral totals from the referring address already present in hosting logs: internal navigation, Google, LinkedIn, other external sources, or direct/unknown. External referring addresses are reduced to these fixed categories; we do not retain their hostnames, paths or query strings in our statistics. Internal references retain only known published page identifiers, allowing aggregate counts between public pages. Unknown internal addresses are discarded. Referrers can be missing, so email and application links may appear as direct/unknown. We do not add campaign identifiers, read browser referrer information with scripts, or reconstruct individual navigation histories.

For request statistics we process IONOS hosting logs, discard IP fields and query strings, and use browser identification strings only transiently to filter recognizable automated traffic. Ordinary hosting and security logs remain separate from these statistics. Our processing of personal information during hosting, security and aggregation is based on our legitimate interests in operating, securing and understanding the use of our website (Article 6(1)(f) GDPR). We minimize the information processed and do not create visitor profiles. You may object to processing based on legitimate interests by contacting contact@batalyse.com.

Daily statistical totals are retained for 24 months and are accessible only to authorized administrators. IONOS retains hosting access logs for up to eight weeks; the host masks visitor IP addresses in those logs. Aggregate statistics cannot be traced back to an individual visitor by our analytics system.

Local consent for external services

Calendly and hCaptcha load only after you enable the respective service beside the calendar or protected form, or, for hCaptcha, when you start a conversation in the “Ask batalyse” chat without being logged in. Permission for one does not enable the other. We remember each choice for 30 days using the functional __Host-batalyse_services cookie, containing service choices, expiry times and the version of the consent text, without a unique visitor ID. You can withdraw permission through Privacy settings in the footer. Withdrawal stops future loading on this site, but cannot reverse previous transfers or remove cookies controlled by another provider.

Calendly: If enabled, Calendly displays our booking calendar and processes browser/network information and the booking details you enter. Its supporting services may include anti-abuse, diagnostics and payment components. Optional provider cookies remain subject to Calendly’s own controls. Processing initiated by this optional embed is based on your consent (Article 6(1)(a) GDPR and, where applicable, section 25(1) TDDDG). Alternatively, use our ordinary Calendly link or contact us directly. See Calendly’s privacy notice.

hCaptcha: If enabled, the security service operated by Intuition Machines, Inc. (USA) evaluates browser, network and interaction information, such as IP address and mouse movements, to prevent automated abuse. It may use security cookies and transmit data to its service providers. We obtain your consent before loading it (Article 6(1)(a) GDPR and, where applicable, section 25(1) TDDDG). Protected forms and the “Ask batalyse” chat for visitors who are not logged in require successful verification; declining does not disable security. You can contact us by email or telephone instead. See hCaptcha’s privacy policy for processing, retention and international-transfer safeguards.

These providers may process data in the United States. Their applicable transfer arrangements, including participation in the EU–US Data Privacy Framework and contractual safeguards, are described in their privacy notices. Consent to load an embed does not replace the safeguards required for international transfers.

10.2 HubSpot

We use HubSpot to send newsletters and track engagement (e.g., email opens and link clicks). HubSpot may collect IP addresses for statistical analysis. Batalyse itself does not store IP addresses related to newsletter tracking.

HubSpot may process data in the United States. HubSpot participates in the EU-U.S. Data Privacy Framework and uses Standard Contractual Clauses (SCCs).

You can opt out by unsubscribing from our newsletters at any time. More details are available in the HubSpot Privacy Policy.

10.3 “Ask batalyse” chat

Our website offers the optional “Ask batalyse” chat. It answers questions about our products from our published website pages and, for logged-in customers, also from our product guides. The answers are generated by an AI model and can be wrong or incomplete: please check important information against the linked sources or ask our team. Please do not enter personal data, confidential information or User Content into the chat. Using the chat is voluntary; you can always contact us by email or telephone instead.

What is processed: the questions you type, the answers, the pages cited, and any thumbs up/down rating you give. Each conversation is identified only by a random session ID; the chat itself sets no cookies. Visitors who are not logged in first pass an hCaptcha check (see Section 10.1), after which our website issues a short-lived token to the chat without passing on any personal data. For logged-in customers, our website instead issues a short-lived token containing a pseudonymous identifier derived from the account, not your name or email address, to give access to the product guides and to apply usage limits. The chat service uses your IP address only temporarily to apply usage limits and does not store it with your conversation.

Service providers: The chat service runs on our own server at ask.batalyse.com, hosted by Contabo in the EU. To generate an answer, your question and the conversation so far are sent, together with excerpts from our pages, to Anthropic, PBC (USA), which provides the AI model. Anthropic receives no IP address or account information from us, and under its commercial terms does not use this data to train its models. Transfers to Anthropic are based on the Standard Contractual Clauses in its data processing addendum. See Anthropic’s privacy policy.

Retention: Conversations and ratings are deleted from the chat service after 30 days. To improve our documentation, we review each week the questions the chat could not answer from our sources and those whose answers received a thumbs down. The text of these questions, without a session ID or other identifier, is kept in our internal, self-hosted issue tracker for as long as it is needed for this purpose. Our operational logs record technical details such as the session ID, the model used and the processing time, but not the questions, the answers or IP addresses.

Legal basis: We operate the chat based on our legitimate interest in answering product questions and improving our documentation (Article 6(1)(f) GDPR); for logged-in customers, it also serves our contract with you (Article 6(1)(b) GDPR). hCaptcha is loaded only with your consent (Article 6(1)(a) GDPR). You may object to this processing by contacting contact@batalyse.com. Because conversations are not linked to your identity, we can only find a conversation for an access or deletion request if you describe its content (Article 11 GDPR).

11. Technical and Organizational Security Measures

We implement security measures to protect your data, including:

11.1 Technical Safeguards

Encryption in transit (TLS/SSL)
Encryption at rest for sensitive data
Secure servers and infrastructure
Regular security assessments and updates
Access logging and monitoring

11.2 Organizational Measures

Access controls limiting data access to authorized personnel only
Employee training on data protection and confidentiality
Data processing agreements with all third-party processors
Regular review and update of security practices

For information on security measures specific to the Software and user responsibilities for on-premise security, see EULA Section 5.6.

12. Data Protection Officer

For privacy-related inquiries, to exercise your data rights, or to contact our Data Protection Officer, please contact:

Batalyse GmbH
Sattlerstr. 5
75045 Walzbachtal, Germany

Data Protection Officer: Eran Nave
Phone: +49 (176) 789 814 63
Email (Data Protection Officer): eran@batalyse.com
General Privacy Inquiries: support@batalyse.com
Website: www.batalyse.com

13. Definitions

For your convenience, here are simplified definitions of key terms:

Personal Data: Information that identifies you
Data Subject: You, the individual whose personal data is processed
Processing: Any operation performed on your data (e.g., collection, storage, use, transmission, deletion)
Processor: Third parties that process data on our behalf (e.g., Ionos, Keygen, Microsoft)
Controller: Batalyse, responsible for determining how and why your data is processed
Consent: Your explicit permission for data processing
User Content: Your data, files, analysis results, and outputs created or processed using the Software (see EULA Section 5.1)

14. Collection of General Data and Information

We automatically collect general data when you visit our website, such as:

Browser type and version
Operating system
IP address (anonymized)
Referring website
Date and time of access
Pages visited

We use this data to:

Deliver website content correctly
Optimize website content and user experience
Ensure IT system security and functionality
Provide information for criminal prosecution in case of cyber-attacks
Understand aggregate website and video usage without visitor profiles (see Section 10.1)

15. Changes to this Privacy Policy

We may update this policy to reflect changes in legal requirements or data processing practices.

Notification of Changes:

Minor changes will be posted on our website
Significant changes will be notified through our website and by email
If changes materially affect your rights, Batalyse will notify you by email or on our website at least 14 days before the new version takes effect

Changes to data handling practices related to the Software are governed by EULA Section 10.

16. Children’s Privacy

Batalyse products and services are intended for professional and research use only and are not directed at children under 16 years of age.

We do not knowingly collect personal data from minors. If we become aware that personal data from a child under 16 has been provided to us, it will be deleted immediately.

If you believe we have inadvertently collected data from a minor, please contact us immediately at support@batalyse.com.

17. Data Breach Notification

In the unlikely event of a personal data breach that is likely to result in a risk to your rights and freedoms, Batalyse will:

Notify affected users within 72 hours of becoming aware of the breach (where feasible), in compliance with GDPR Article 33
Notify the competent supervisory authorities in accordance with GDPR Articles 33–34
Comply with relevant U.S. state data breach notification laws where applicable

Notifications will include:

The nature of the breach
The categories and approximate number of data subjects affected
The likely consequences of the breach
The measures taken or proposed to address the breach
Contact information for further inquiries

18. Data Processing Agreement (DPA)

Institutional or enterprise customers who process personal data using our Software may request a Data Processing Agreement (DPA) under Article 28 GDPR.

The DPA ensures contractually regulated handling of personal data in accordance with EU and U.S. legal standards.

To request a DPA, please contact support@batalyse.com.

For information on when a DPA is required and the relationship between User data processing and Batalyse support services, see EULA Section 5.5.2.

19. Contact Information

Batalyse GmbH
Sattlerstr. 5
75045 Walzbachtal, Germany

Support: support@batalyse.com
Data Protection Officer: eran@batalyse.com
Phone: +49 (176) 789 814 63
Website: www.batalyse.com

Related Documents

EULA (End User License Agreement): www.batalyse.com/eula
Terms and Conditions: www.batalyse.com/terms
Data Processing Agreement (DPA): Available upon request at support@batalyse.com

END OF PRIVACY POLICY