Privacy notice

HLT is the controller for its own purposes: this website, business contacts, account administration, service security and accounting.

For audit content, such as audits, remarks, photos, findings and reports, the customer organization is normally the controller. HLT processes that content as a processor on the customer’s instructions. Each organization publishes its own privacy contact inside HLT Cloud under Account privacy.

The public website is a set of static pages. It uses no analytics, advertising, fingerprinting or session replay, and its only cookies are the two preference cookies described below. Fonts are served from our own domain. The only third-party component is the Cloudflare Turnstile spam check on the contact page (see “When you contact us”).

When you open a page, Cloudflare processes technical data such as your IP address, the requested address and the browser type to deliver the page and protect it against attacks. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). Operational logs are kept for at most 30 days by default.

When you choose a language or switch between light and dark appearance, two first-party preference cookies remember that choice so that every HLT Cloud page and app opens the way you chose: hlt_locale (the language code, for example “de”) and hlt_theme (“light” or “dark”). Without a choice, every page and app simply follows your browser language on each visit; nothing is stored for that. They contain nothing but that language or appearance, apply to the HLT Cloud domain hlt.cloud and its subdomains (such as app.hlt.cloud) and expire after one year. A copy may also be kept in your browser’s local storage. They are not used for tracking or analytics; your browser sends them along with requests to HLT Cloud, but our servers do not evaluate them. Legal basis: storing them is strictly necessary to provide the setting you asked for (§ 25(2) no. 2 TDDDG). You can delete them in your browser at any time; the pages then follow your browser language and system appearance again.

We process your name, contact details and message to answer you and, where relevant, to prepare or perform a contract. Legal basis: Art. 6(1)(b) GDPR for contract-related requests, otherwise our legitimate interest in answering business enquiries (Art. 6(1)(f) GDPR).

If you use the contact form, your message is sent to HLT by email, with your address as the reply address. HLT Cloud keeps no copy beyond the delivery record, and the form never creates an account. To keep automated spam out, the contact page loads Cloudflare Turnstile: Cloudflare processes your IP address, browser and device characteristics and interaction signals only to tell people from bots, and may store data needed for that check in your browser. Legal basis: our legitimate interest in protecting the form from abuse (Art. 6(1)(f) GDPR). Optional details you choose on the form (problem area or request type) travel with the message.

The email address you type into a “Schedule a demo” field only fills in the contact form; nothing reaches us until you send that form. Your browser passes the address to the contact page locally. Without JavaScript it travels in the page address and can then appear in the operational logs described under “Visiting this website”.

For each user we process name, email address, password hash, two-factor settings, memberships and roles, preferences and security events such as sign-ins. We use this data to provide accounts, secure the service and prevent misuse.

To detect misuse such as automated sign-in attempts, attempts to reach other organizations’ data or floods of requests, we record security signals: the kind of event, the account and organization involved, the operation, a shortened IP address (network part only) and a keyed hash of the full address whose key changes every 30 days. They contain no content and only HLT operators see them. When HLT support uses the app as a member of your organization to help, the start, the end, the reason and every change are recorded in your organization’s activity log; HLT support never sees or changes your password, second factor, passkeys or sessions.

Security records: we record successful sign-ins and changes to passwords, second factors, passkeys and sessions (with a shortened IP address); counters of sign-in, password-reset and verification attempts per email address and per IP address, which slow down guessing; incidents that our automatic checks open when activity looks like an attack (the rule, the account or shortened IP address, and counts); and every access by HLT operators, including support sessions in which HLT uses the app as a member. We keep them to protect accounts and the service and to investigate misuse. Legal basis: our legitimate interest in a secure service (Art. 6(1)(f) GDPR). Attempt counters are deleted one day after they started, incidents 90 days after they are closed, and the other records after 12 months. Only HLT operators see them; your organization’s administrators see operator access and support sessions in the organization’s activity log.

If you link a Microsoft or Google account under Account security, we store the account identifier that provider gives us so it can sign you in; we keep no access tokens from it, and it never creates an account. For passkeys we store the public key, a device type and the name you choose; your fingerprint, face or device PIN never leaves your device. If the linked account has a profile picture, we copy it once into our private image storage in the EU as your HLT Cloud profile picture; you can replace or remove it under Account. A picture you upload yourself is stored there the same way, without its original metadata.

• Legal basis: performance of the contract with the customer organization and our legitimate interest in a secure service (Art. 6(1)(b) and (f) GDPR).
• Emails we send are limited to invitations, recovery, security and the notifications you choose. They contain no audit content.
• We do not use customer content to train AI models, sell personal data or create profiles across customers.

We use the providers listed on the subprocessors page: Cloudflare for hosting, files, email and processing; Neon for the database in Frankfurt; and, only where a customer enables AI features, OpenRouter. Some of these providers or their affiliates are located outside the EU. Transfers rely on the mechanisms of Chapter V GDPR, such as the EU Standard Contractual Clauses, as set out in their agreements.

Retention of audit content is set by each customer organization; HLT proposes 24 months for recurring comparisons. After an agreement ends, customer data is deleted after a 30-day export period.

You have the right to access, rectification, erasure, restriction of processing, data portability where applicable, and to object to processing based on legitimate interests. Requests are free of charge and do not require an account or a subscription. To exercise your rights, send us an email.

For audit content, please contact the organization that created it; we forward requests that reach us to that organization promptly and support it in answering.

You also have the right to lodge a complaint with a data protection supervisory authority.

We update this notice when our processing changes. The date of the current version is shown at the top of the page.