§privacy

Privacy.

This is a short, honest description of what data I collect through this site and my business, why, and what your rights are. The site is operated by Hypersonic Machine Intelligence Services F.Z.E, Ajman Free Zone, United Arab Emirates, represented by Andreas Krassnitzer (full address in the legal notice). It is the controller for the data described here.

This policy is written for the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). For visitors from the EU and Switzerland, it also covers the EU GDPR and the Swiss Federal Act on Data Protection (FADP).

Newsletter and live-call signup

When you sign up for the weekly live call, I collect your email address. As proof of your consent, the timestamp of signup, your IP address and the page you signed up from are stored too.

Purpose: to send you the invite to the weekly live call and the related emails you signed up for. Nothing else.

Legal basis (GDPR): your consent, Art. 6(1)(a). You give it by submitting the form and confirming the link in the follow-up email (double opt-in). You can withdraw it at any time with the unsubscribe link in any email or by writing to me. Withdrawal does not affect processing that happened before.

Booking a call

Consultation calls are booked through Calendly. When you book, Calendly collects your name, email address, your answers to the booking questions, the time you choose and your time zone. The call runs on Google Meet, and the booking lands in my Google Calendar (Google Workspace).

Purpose: scheduling and preparing the consultation.

Legal basis (GDPR): steps taken at your request before entering a contract, Art. 6(1)(b), and my legitimate interest in preparing a useful conversation, Art. 6(1)(f).

Customer relationship management

Booking and contact data are stored in Close, a CRM, so I can manage the conversation and follow up.

Legal basis (GDPR): legitimate interest, Art. 6(1)(f), in organising my business conversations.

Business prospecting

I contact companies directly, by phone, on LinkedIn and by email. For that I process business contact data: name, role, company, business phone number and business email address. This data comes from publicly available sources (such as company websites and LinkedIn) and from the B2B data provider Apollo.io.

Purpose: business-to-business outreach about my services.

Legal basis (GDPR): legitimate interest, Art. 6(1)(f), in offering my services to companies.

You can object at any time by emailing andreas@andreaskra.com. I then delete your data and keep only a minimal entry on a suppression list, so you are not contacted again.

If I contacted you and you did not give me your data yourself, this section is the information I owe you under Art. 14 GDPR. The recipients, transfers, retention and your rights are described below.

Statistics

I use Matomo, running on my own server, to see which pages are read, where visitors come from and where they leave. The data stays on that server. No analytics company receives it.

Basic statistics, without cookies (on unless you switch them off): the pages you view, time on page, how far you scroll, clicks on the booking buttons and on links to other sites, the page you came from (referrer) and campaign tags in the link (UTM), browser, operating system and device type from your browser's user agent, and your approximate country. Your IP address is shortened by two bytes before it is stored. Nothing is stored on your device, and you are not recognised from one day to the next.

Legal basis: my legitimate interest, Art. 6(1)(f) GDPR, in knowing which content is useful and where the site loses people. You can object at any time by switching off “Basic statistics” under “Cookie settings” at the bottom of every page. If your browser sends Do Not Track or Global Privacy Control, nothing is recorded at all.

Statistics with cookies (only with your consent): Matomo also sets the cookies listed below, so a returning visit is recognised as the same visitor and I can see journeys across several visits. It then also records your screen size and basic browser features. Legal basis: your consent, Art. 6(1)(a) GDPR. Withdrawing it deletes the cookies.

On the booking page I also record the booking steps: calendar shown, time picked, call booked. Not the time you picked or any of your details.

Cookies and storage

This site sets no cookies unless you allow statistics cookies. It runs no advertising code and no tracking pixels. This is everything it stores in your browser:

The Calendly calendar on the booking page loads only after you click “Show calendar”, or straight away if you allowed it in the cookie settings. Calendly then sets its own cookies. The legal basis is your consent, Art. 6(1)(a) GDPR.

See Calendly's privacy notice and how Calendly uses cookies.

You can change your choices at any time with “Cookie settings” at the bottom of every page.

Server logs

The website runs on a server I operate, rented from Hostinger. The server keeps short-lived access logs (IP address, user agent, requested URL, timestamp) for security and debugging, rotated regularly. These logs are not used for analytics or shared with anyone.

Who processes the data

These providers process data on my behalf, under data processing agreements:

Statistics run on my own server (Matomo, open source), so no analytics provider appears here.

Buttondown's sub-processors include Postmark (ActiveCampaign LLC) for email delivery and AWS for infrastructure.

International transfers

Data is processed in the UAE and, through the providers above, mainly in the United States. For visitors from the EU and Switzerland, these transfers are protected as follows:

• Calendly, Google and Apollo.io are certified under the EU–US Data Privacy Framework and its Swiss–US extension, and also use Standard Contractual Clauses.
• Buttondown and Close use the EU's Standard Contractual Clauses in their data processing agreements.
• Hostinger is based in the EU and uses Standard Contractual Clauses for its own transfers outside the EU.

Retention

• Newsletter: your email address stays on the list until you unsubscribe. After that, a minimal record is kept on a suppression list for up to 30 days, so you aren't added again by mistake, and then deleted.
• Booking and CRM data: kept while there is an active business conversation, and deleted no later than 24 months after the last contact, unless we have a client relationship.
• Prospecting data: deleted when you object. Otherwise I review it once a year and delete what is no longer needed.
• Statistics: individual visits are deleted after 180 days. Only aggregated reports without individual visits are kept.
• Server logs: short-lived and rotated regularly.

Your rights

Under the UAE PDPL, the GDPR and the Swiss FADP, as they apply to you, you have the right to:

• Access: request a copy of the data held about you.
• Rectification: have it corrected.
• Deletion: have it removed.
• Portability: get it in a portable format.
• Objection: stop processing based on legitimate interest, and always stop direct marketing (for the newsletter, that is the unsubscribe link).
• Withdrawal of consent, at any time.
• Complaint: in the UAE with the UAE Data Office, in the EU or Switzerland with the data protection authority of your country.

Wherever you are, including the United States, you can ask me what data I hold about you and have it deleted.

To exercise any right, email andreas@andreaskra.com. I respond personally.

Changes

If this policy changes, the date below is updated. Subscribers will be told about material changes in a letter.

Last updated: 2026-09-25