Privacy policy
Last updated: October 2026
1. Controller
Hyca Heat GmbH, Marie-Curie-Straße 4, 52428 Jülich, Germany Email: contact@hycaheat.com Represented by the managing directors Dr. Richard Büssow, Dr. Simon Hahn and Henning Hatje. We have not appointed a data protection officer because we are not legally required to. For data protection questions, write to contact@hycaheat.com.
2. Overview
We only process personal data where it is needed to run this website, answer your enquiry or handle an application, or where you have given consent. This website does not load fonts, videos or maps from third parties. Tracking only runs after you consent.
3. Hosting and server logs
This website runs on Google Cloud (Google Cloud Run) in the europe-west10 region (Berlin). Requests pass through a Google Cloud load balancer. The provider is Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland. When you open the website, technical data is processed automatically: IP address, date and time, page requested, amount of data transferred, referrer and browser identifier. We need this data to deliver the website and keep it secure and stable. The legal basis is Art. 6(1)(f) GDPR. Access logs are stored in Google Cloud Logging and deleted after 30 days. Access by Google LLC in the USA cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework; transfers rely on the European Commission's adequacy decision (Art. 45 GDPR); standard contractual clauses also apply. The domain and DNS are managed through Google Cloud DNS, also a Google Cloud service.
4. Contact form and configurator
When you contact us through the contact form or the configurator, we process the details you provide: first and last name, business email address, company, optionally phone number and message, and in the configurator your answers on industry, process temperature, energy sources and installed power. If you wish, you can upload a file with your load curve (CSV, Excel, text or PDF, up to 10 MB). The file is passed through our upload service on Google Cloud (see section 3) directly to HubSpot, where it is stored privately and linked to your enquiry. We use it only to calculate your case. We use this data to answer your enquiry and discuss a possible project with you. The legal basis is Art. 6(1)(b) GDPR where your enquiry aims at a contract, and otherwise our legitimate interest in answering business enquiries under Art. 6(1)(f) GDPR. By submitting the form you also confirm that we may store your details for this purpose. We do not send newsletters or automated email sequences. Your enquiry is stored in our CRM, HubSpot (see section 5). If no contract results, we delete your data 24 months after our last contact, unless statutory retention obligations apply.
5. HubSpot (CRM and forms)
We use HubSpot for forms and to manage enquiries. The provider is HubSpot Ireland Limited, One Sir John Rogerson's Quay, Dublin 2, Ireland. Our HubSpot account is hosted in the EU data centre. We have concluded a data processing agreement with HubSpot under Art. 28 GDPR. Access by HubSpot, Inc. in the USA cannot be ruled out. HubSpot, Inc. is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); standard contractual clauses also apply.
6. Email
When you email us, we process your details to answer your message. Our email runs on Google Workspace, provided by Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland. The legal basis is Art. 6(1)(b) or (f) GDPR. Retention follows section 4.
7. Cookies, consent and tracking
On your first visit we ask whether you agree to tracking. We store your choice in your browser's local storage (localStorage, entry "hyca-consent"). This is technically necessary to respect your choice (§ 25(2) no. 2 TDDDG). Without your consent we set no tracking cookies. Only if you agree do we load: a) HubSpot tracking: HubSpot sets cookies (for example "hubspotutk", "__hstc", "__hssc", "__hssrc") to recognise visits, analyse how the website is used and link a later enquiry to your visit history. For the provider, see section 5. b) LinkedIn Insight Tag: LinkedIn sets cookies so we can measure our LinkedIn campaigns and build audiences. The provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Data may be transferred to LinkedIn Corporation in the USA, which is certified under the EU-US Data Privacy Framework. We are joint controllers with LinkedIn for the data collected through the Insight Tag (Art. 26 GDPR); our respective obligations are set out in an agreement with LinkedIn. You can exercise your rights with us or with LinkedIn. More in LinkedIn's privacy policy: https://www.linkedin.com/legal/privacy-policy The legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw your consent at any time with effect for the future via the "Cookie settings" link at the bottom of every page. c) Google Maps: On the “Company” page we show our sites on Google Maps. The maps only load when you click “Show map”. Your IP address and technical data from your browser are then sent to Google, and Google may set cookies. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework. The legal basis is the consent you give by clicking (Art. 6(1)(a) GDPR and § 25(1) TDDDG). More: https://policies.google.com/privacy
8. Applications
We accept applications by email. We process your documents to decide on an employment relationship. The legal basis is Art. 6(1)(b) GDPR in conjunction with Art. 88 GDPR and § 26 BDSG. If we do not hire you, we delete your documents six months after the process ends, unless you agree to longer storage.
9. Recipients
Only Hyca Heat staff who need your data for the relevant purpose receive it, plus the service providers named in this policy as processors. We do not sell your data.
10. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent with effect for the future (Art. 7(3)). Write to contact@hycaheat.com. Right to object: where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). Our competent authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.
11. Obligation to provide data, automated decisions
You are not obliged to provide any data. Without the required form fields, however, we cannot answer your enquiry. We do not use automated decision-making or profiling under Art. 22 GDPR.
12. Security and changes
The website is transmitted encrypted via HTTPS. We update this policy when our website or the law changes. The version published here applies.