01Controller
Dubai Silicon Oasis
Dubai, United Arab Emirates
Further details can be found in the legal notice. For privacy inquiries, an email to the address above is sufficient.
We treat personal data according to the standard of the EU General Data Protection Regulation (GDPR), even though our company is based in the United Arab Emirates.
02Cookies for advertising and usage measurement
This website sets a technically necessary language cookie named hh_lang. It stores the language in which you want to view the website. It is set when you choose a language in the language menu or when we redirect you to another language version based on the country from which you access the site. It contains only the language code (for example “en”), is deleted automatically after 180 days, is not used for tracking and is not passed on to third parties.
Legal basis: Section 25(2) No. 2 TDDDG (German Telecommunications Digital Services Data Protection Act; strictly necessary storage) and Art. 6(1)(f) GDPR (legitimate interest in showing you the website in your language). Retention: 180 days. You can delete the cookie in your browser at any time.On public marketing pages, the Meta Pixel loads when you open the page unless you have switched off advertising cookies using the link below. No cookie banner is displayed; we do not request consent through a cookie notice before loading it. The pixel from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (ID 1819251052753323) measures page views and successfully submitted applications. Applications also work with advertising cookies switched off.
Meta receives information including your IP address, browser and device details, the page visited and the event. Meta may associate this information with an existing Meta account and use it for advertising attribution and personalisation. We do not send names, email addresses, telephone numbers or form answers through the pixel. Advanced matching and automatic events are disabled; technical and customer pages are not tracked.
The pixel may set _fbp and, after an advertising click, _fbc, normally for up to 90 days. The link below switches off advertising cookies in this browser: future pixel events are stopped and existing Meta cookies are deleted. We store this setting locally as hh_cookies_optout_v1 until you switch it back on or clear your browser data. This does not retrieve data already sent to Meta.
Further information: Meta Privacy Policy · Meta Business Tools · Joint controller agreement
We also use PostHog (PostHog Inc., USA; data stored in the EU, Frankfurt data centre) on public pages to understand how the website is used and where it needs improving. PostHog records page views, clicks, scroll depth and mouse movements (as a heatmap) as well as recordings of how a visit unfolds (session replay). Entries in form fields are always hidden in recordings. PostHog does not store IP addresses; we do not create personal profiles and do not link the data to names or email addresses. Internal pages are not recorded.
For this, PostHog stores a random identifier as a cookie or in your browser’s local storage (ph_…_posthog), usually for up to 365 days. The link below switches PostHog off together with the advertising cookies and deletes the stored identifier.
This section describes actual technical operation. Switching cookies off does not replace any legally required prior consent; your statutory data protection rights remain unaffected.03Hosting and Server Log Data
This website is served via Cloudflare Pages (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). Cloudflare acts as our data processor and delivers the pages through a worldwide network.
When you access the website, technically necessary access data is processed:
- IP address of the requesting device
- Date and time of access
- Requested address and transferred data volume
- Browser type, operating system and referrer
This data is necessary to deliver the site at all, fend off attacks and detect disruptions. It is not combined with other data and not used to identify individual persons.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, stable operation). Retention: short-term within Cloudflare's security and operations logs.04Application Form and Live Demo
When you apply for an AI employee via the form on the live demo page, we process the details you enter there yourself:
- Name
- Company and, if provided, website
- Email address
- Phone or WhatsApp number
- Your statements on which tasks cost time, which task should be taken over first, which programs you use, plus voluntary remarks
The sole purpose is processing your application: review, feedback, setup and execution of your 24-hour test phase, and the subsequent contract initiation. We need your WhatsApp number because that is exactly where the test takes place.
Transmission is encrypted (TLS). The details are stored in a Cloudflare D1 database and processed via a Cloudflare Worker.
Legal basis: Art. 6(1)(b) GDPR (initiation and performance of a contract). Retention: until your inquiry is resolved; after that we delete the data unless statutory retention obligations apply. Without these details we cannot process your application.05Book campaign “Lass KI machen” and online seminar
On the pages of the book campaign “Lass KI machen” you can order the book (you only pay the shipping costs), give it to people you know personally and register for our free AI online seminar. You get there via the book, QR codes, advertising or links from our sales partners. The pages are delivered by Cloudflare Pages; a Cloudflare Worker at buch.hundredhands.io receives your entries and stores them in a Cloudflare D1 database. All details are in the privacy policy of the book campaign (in German); here are the main points.
What data we process
- Ordering the book: first and last name, email address and delivery address; optionally your mobile number if you also want to receive the seminar access via WhatsApp. As proof of the order we store the time of your click on “Zahlungspflichtig bestellen” (order with obligation to pay), the summary shown at that moment, amount, payment method, version of the legal texts, IP address and browser identifier.
- Giving the book as a gift: your name, your email address, optionally your mobile number, name and delivery address of the recipients and your confirmation that you know the recipients personally.
- Online seminar: when your personal seminar link was opened; for registrations via the webinar page first name, last name, email address, date and optionally your mobile number; after the seminar, name, email address and duration of attendance from the Zoom attendee report.
- Payment: amount, payment status, order and transaction number as well as the name and email address that PayPal or Stripe report back to us after payment.
- Withdrawal: your declaration with name, email address, time of receipt, IP address and browser identifier, so that we can confirm and prove receipt.
- Origin: which link, QR code or campaign brought you to us (sales partner ID, campaign parameters such as utm_source, landing page, domain of the previous page), time of page views and clicks on order links and the country the connection comes from. We do not store an IP address for this.
- Later order: if you later order an AI employee from HUNDREDHANDS, we link that order to your book order, via the order link, the email address, the phone number or name and postal code.
What we use the data for
- to send the book and gifts, charge the shipping costs and confirm your order
- to invite you to the online seminar, send you the access link and remind you of the date
- only with your consent: to send you further information and offers from HUNDREDHANDS about AI
- to measure which partners, links and campaigns lead to orders, seminar attendance and later contracts, and to calculate commissions for sales partners from this
- to prevent misuse and automated mass requests
Messages and consent
We send you the order confirmation, seminar link, reminders of your date, shipping information and the confirmation of receipt of a withdrawal by email and, if you have given a mobile number, via WhatsApp. This is part of your order or registration. If you reply “STOPP” to a WhatsApp message, we will no longer write to you that way.
You only receive advertising, meaning further information and offers from HUNDREDHANDS about AI by email and WhatsApp, if you tick the voluntary checkbox. It is not pre-selected, and your order or registration works just the same without it. As proof we store for each channel the time, the exact wording, the email address or mobile number concerned, the page, your IP address and your browser identifier; consents and withdrawals are added as new entries and never overwritten. You can withdraw your consent at any time with effect for the future, for all channels or individually: with “STOPP” in reply to a WhatsApp message or by email to [email protected]. Anything that happened before remains lawful.
Mandatory details
Only the details we need for your order are required: name, email address and delivery address, and for the webinar registration name, email address and date. Without them we cannot send you the book or register you. Mobile number and the advertising checkbox are optional.
Recipients and service providers
- Cloudflare (Cloudflare, Inc., USA) delivers the pages as a processor and runs the Worker and the database (see section 03).
- PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg) and, once this payment method is offered, Stripe (Stripe Payments Europe, Ltd., Ireland) handle the payment of the shipping costs as separate controllers. We give PayPal your name, delivery address, the amount and an internal ID of your order, and Stripe your email address, the amount and this ID. We do not receive account or card details.
- Zoom (Zoom Communications, Inc., USA) provides the online seminar as a processor and processes the details you join with and data on your attendance.
- Email: we write to you from [email protected]. Emails are sent via Postmark (AC PM LLC, USA), alternatively via Resend (Plus Five Five, Inc., USA), Mailgun (Mailgun Technologies, Inc., USA) or directly via our mailbox at Google Workspace (Google Cloud EMEA Limited, Ireland); each email takes only one of these routes. All act as processors and receive your name, your email address and the content of the email. A copy of every email is kept in our mailbox.
- WhatsApp: we send messages from our HUNDREDHANDS number via the WhatsApp Business Platform. The processor is Meta Platforms Ireland Limited (Ireland); processing also takes place at Meta Platforms, Inc. and WhatsApp LLC in the USA, which are certified under the EU-US Data Privacy Framework.
- Sales partners only see masked details in their partner area: first name, initial of the last name, partly masked email address and mobile number, date, origin, progress in the process and the resulting commission.
- Shipping: the shipping service providers (for example DHL) receive name and delivery address as far as necessary for delivery, and for a gift also the name of the giver. For Switzerland the customs declaration also states the contents of the parcel.
- External seminar registration: for some dates we forward you to the registration page of another organiser. We only pass on details about your origin (for example the partner ID), no names or contact details. The organiser’s privacy policy applies to what you enter there.
Browser storage and Meta Pixel on the book pages
The book pages have their own cookie choice; the setting of this website (section 02) does not apply there. “Accept all” and “Necessary only” are equivalent, and you can change your choice at any time via “Cookie settings” at the bottom of every book page. Only the session storage for order, payment and gift (lkm-lead, lkm-order, lkm-pay, lkm-gift; until you close the window) and your choice (lkm-consent, 12 months) are necessary.
Only with your consent do the book pages store the partner assignment (lkm-trk, 30 days) and load the HUNDREDHANDS Meta Pixel. It reports page views, the start of an order and completed orders to Meta, with the shipping costs as value, never names, email addresses, phone numbers or form entries. We and Meta Platforms Ireland Limited are joint controllers for this collection and transfer (Art. 26 GDPR); details are in the privacy policy of the book campaign. The book pages do not load PostHog. The webinar page sets no cookie.
Note for gift recipients
If someone gave you the book via our site, we received your name and delivery address from that person. They confirmed that they know you personally and that we send you the book in their name and name them as the sender. We use your details to send you the book and, should you later order from HUNDREDHANDS yourself, to link that order to the book campaign (via name and postal code). We do not ask for the recipients’ email address or phone number, so you will not receive any messages from us. The parcel contains a short note saying who is giving you the book and what we used your address for. You can object to the processing at any time; an email to [email protected] suffices.
Retention
- Abandoned orders (only step 1, order click without payment, unpaid gift order): 90 days after the last activity
- Order, payment, shipping and withdrawal data with the proof of order: until the order is completed, then restricted for as long as statutory retention obligations require; then we delete them
- Seminar, webinar registrations without an order, page views and clicks: 13 months
- Sent emails and WhatsApp messages in our outbox: 13 months after sending
- Proof of consent: until withdrawal, then another 3 years as proof
- After deletion at your request: only a log without plain text, 3 years
- Protection against misuse: a shortened hash of the IP address that expires after two minutes and is deleted by the next day at the latest
An automatic run checks these periods every day and deletes what has expired. It leaves data we are required to keep untouched; we delete it when the retention obligation ends.
Legal bases: Art. 6(1)(b) GDPR for the order, gift shipping, payment of the shipping costs, seminar, webinar registration and the related messages; Art. 6(1)(a) GDPR, for advertising by email and WhatsApp also as express consent within the meaning of Section 7(2) of the German Act against Unfair Competition (UWG); Section 25(1) TDDDG with Art. 6(1)(a) GDPR for the partner assignment in the browser and the Meta Pixel; Section 25(2) no. 2 TDDDG for the necessary storage; Art. 6(1)(c) GDPR for statutory retention and documentation obligations and the confirmation of receipt of a withdrawal; Art. 6(1)(f) GDPR for proof of order and withdrawal, origin measurement, partner commissions, linking later orders, protection against misuse, the data of gift recipients and proof of consent.06Contact by Email
Some buttons on this website open your email program with a prepared message to [email protected]. When you write to us, we process your email address and the content of your message in order to reply. Please do not send us particularly sensitive data by email.
Legal basis: Art. 6(1)(b) or (f) GDPR. Retention: for the duration of the matter, then within statutory periods.07Email Delivery
For sending confirmation and access emails we use Resend (Resend, Inc., USA) as a data processor. Your email address and the content of the respective message are transmitted. Open and click tracking is disabled in our account: we do not measure whether or when you open an email.
Legal basis: Art. 6(1)(b) GDPR.08Communication via WhatsApp
The test phase and ongoing operation of your AI employee take place, at your request, via WhatsApp (WhatsApp Ireland Ltd., a Meta group company). If you choose this channel, WhatsApp's privacy terms additionally apply to the transmission and storage of messages; we have no control over them. On request, we communicate exclusively by email instead.
Legal basis: Art. 6(1)(b) GDPR or your consent through actively choosing this channel.09Fonts and Scripts
General fonts and script libraries are served locally. The Meta Pixel is an exception: its script loads from connect.facebook.net and sends events to Meta unless advertising cookies are switched off (section 02). PostHog is also an exception: its script loads from eu-assets.i.posthog.com and sends usage data to PostHog in the EU unless cookies are switched off (section 02).
10Data Transfers to Third Countries
Our company is based in the United Arab Emirates. The service providers named above (Cloudflare, Resend, Postmark, Mailgun, Meta, PostHog, Google, Zoom, PayPal, Stripe) process data in the USA, among other places. PostHog stores this website’s data in the EU; as a US company, access from the USA cannot be ruled out. Transfers are based on the EU Commission's standard contractual clauses or (where applicable) the respective provider's certification under the EU-US Data Privacy Framework. A level of protection fully equivalent to the European one cannot be guaranteed in every case for third-country transfers.
Legal basis for the transfer: Art. 44 et seq. GDPR.11Your Rights
You have the right at any time to:
- Access to the data we process about you (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure of your data (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability in a common format (Art. 20 GDPR)
- Objection to processing based on legitimate interest (Art. 21 GDPR)
- Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)
An email to [email protected] is sufficient. We respond without undue delay, at the latest within one month. In addition, you have the right to lodge a complaint with a data protection supervisory authority, usually the authority of your place of residence.
12No Automated Individual Decisions
A person decides on your application. The decision is not solely automated under Art. 22 GDPR and does not rely on profiles from advertising measurement.
13Data Security
This website is delivered exclusively over an encrypted HTTPS connection. Only the people in our company who need application data or data from the book campaign for processing have access to it; access is protected by keys and, for the book campaign, additionally by a personal login with a one-time code (Cloudflare Access). Sales partners only see the masked details described in section 05.
14Changes to This Policy
We adapt this privacy policy when the website or the legal situation changes. The version published here applies in each case.