Privacy Notice

1. Who We Are

Hubnix is an AI and technology consultancy operated by Oleksii Panchenko as a Ditta Individuale under Italian law. We provide AI automation, cloud infrastructure, cybersecurity, ICT compliance, system architecture, and digital presence services to small and medium enterprises.

Data Controller: Oleksii Panchenko
Email: [email protected]
Location: Milan, Italy

Data Protection Officer: None appointed. As a micro-enterprise whose core activity does not consist of large-scale systematic monitoring or large-scale processing of special categories of data, the conditions of Article 37(1) GDPR are not met. The data controller above is the point of contact for all data-protection matters.

2. What Personal Data We Collect

We collect and process personal data only when necessary for the purposes described below:

• Identity data: name, company name, job title
• Contact data: email address, phone number
• Business data: project requirements, service requests, contractual terms
• Financial data: P.IVA/fiscal code, IBAN, invoice details (for clients and suppliers only)
• Technical data: IP addresses, browser type, system logs (for website visitors and security monitoring)
• Communication data: email content, contact form submissions, meeting notes
• Platform account data: if you create an account on our self-service platform — your email address (used for passwordless sign-in links), session identifiers, and security audit entries (action, timestamp, IP address)
• Google or LinkedIn sign-in data: if you choose "Continue with Google" or "Continue with LinkedIn" on the My Hubnix client portal (my.hubnixco.com), then — with the permission you give on that provider's consent screen — we receive your name, email address, whether that email address is verified, your profile photo and a provider account identifier. See "Signing in with Google or LinkedIn" below for how we use it
• Card content: the business-card information you choose to enter and publish through the platform (name, role, contact details, photo). You control this content and can edit or unpublish it at any time
• LinkedIn profile import data: if you choose to import from LinkedIn, then — with the consent you give on LinkedIn — we receive your name, professional headline and current position (job title and company) to pre-fill your card. These pre-fill suggestions are editable, are stored solely to populate your card, and you can remove them at any time from the card editor (or by deleting your account)
• Abuse-report data: if you report a published card, the name, email and explanation you submit, so we can assess and respond to the report (DSA notice-and-action)
• EU AI Act Check orders: if you order the full report at euaiact.hubnixco.com: the names of your AI systems and your answers, the report and the passages from your documents it quotes, the versions of the terms and agreement you accepted, and the billing details Stripe collects for the invoice (name, address, VAT number, email). No account is created; the report is reached by a private link only you hold. If you order for a business or organisation, the contents of the documents you add are processed on its behalf, as processor, under the Data Processing Agreement it accepts when ordering. If you order as a consumer, we process the personal data in your documents as controller, only to produce your report: Art. 6(1)(b) for you, Art. 6(1)(f) (our legitimate interest in delivering the report you asked for) for other people named in your documents. The text is not stored; Anthropic deletes it within 30 days

We do not collect special categories of personal data (health, biometric, political opinions, etc.) unless explicitly required by a client engagement, in which case it is processed exclusively on local infrastructure within the EU with no cloud transfer.

Children: Our services are directed at businesses, not children. We do not knowingly collect or process the personal data of individuals under 16. If you believe a minor has provided us personal data, contact us and we will delete it.

Is providing data mandatory? Data needed to deliver a contracted service and to meet our legal obligations (e.g. invoicing data under Italian tax law) is required — without it we cannot provide the service or issue compliant invoices. Contact-form and scheduling data is provided voluntarily; not providing it only means we cannot respond to your enquiry. Website-analytics data is aggregate and contains no personal identifiers.

3. How and Why We Process Your Data

4. AI Processing Disclosure

Hubnix uses artificial intelligence systems in its operations, in compliance with the EU AI Act:

• AI-assisted task management: Client communications may be processed by AI systems to route tasks, draft responses, and manage project workflows. All AI outputs are reviewed and approved by the data controller before external communication.
• Security analysis: Automated security tools analyse system logs and network traffic to detect threats. No personal data profiling or automated decision-making with legal effects occurs.
• Sensitive data handling: Any data classified as confidential or restricted is processed exclusively on local AI models within EU-hosted infrastructure. It is never transmitted to external cloud AI services, with one exception that our customer chooses: when a customer orders an EU AI Act Check full report, the text of the documents it adds is read by Claude (Anthropic) to produce the report; for a business, under the Data Processing Agreement it accepts, which names Anthropic as sub-processor. Anthropic deletes that text within 30 days and does not use it for training. Details: euaiact.hubnixco.com/trust.

These systems are classified as limited-risk or minimal-risk under the EU AI Act. Transparency obligations are met through this notice. We maintain internal AI Impact Assessments (AIIA) and, where personal-data processing is involved, Data Protection Impact Assessments (DPIA) for our AI-mediated processing.

No solely-automated decisions: we do not take decisions producing legal or similarly significant effects about you based solely on automated processing. Every AI-assisted output that affects an external party is reviewed by the data controller before it is acted on. You may request human review of any such processing under Article 22(3) GDPR.

5. Who We Share Data With

We share personal data only with the following recipients, and only to the extent necessary:

We do not sell, rent, or trade personal data. We do not share data with third parties for marketing purposes.

6. International Data Transfers

Some of our service providers are located outside the European Economic Area, as shown in the table above. Where data is transferred to the United States, we rely on the EU-US Data Privacy Framework adequacy decision (European Commission Implementing Decision 2023/1795, 10 July 2023) where the recipient is DPF-certified, and in every case on the EU Standard Contractual Clauses (Implementing Decision 2021/914) as the contractual transfer mechanism — with supplementary measures (encryption in transit and at rest, client-side encryption for backups, and content-redaction discipline for AI services) per EDPB Recommendations 01/2020. Where data is transferred to Switzerland (Migadu) we rely on the Swiss adequacy decision. You may request a copy of the relevant safeguards by contacting us.

For sensitive or confidential workloads, we process data exclusively on EU-hosted infrastructure using local AI models, with no international transfer. The one exception is the EU AI Act Check full report described in §4, which uses Anthropic under the safeguards shown in §5.

7. How We Protect Your Data

• Encryption: TLS in transit for all services; LUKS2 disk encryption for sensitive storage
• Access control: SSH key-only authentication, multi-factor authentication on all administrative accounts, zero-trust mesh network
• Monitoring: 24/7 automated security monitoring (SIEM, IPS, honeypots, vulnerability scanning)
• Data minimisation: We collect only what is necessary for each stated purpose
• Retention limits: Data is deleted or anonymised when the retention period expires
• Incident response: Documented incident management procedures with breach notification within 72 hours per Art. 33 GDPR

8. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Access (Art. 15): Request a copy of the personal data we hold about you
• Rectification (Art. 16): Request correction of inaccurate personal data
• Erasure (Art. 17): Request deletion of your personal data (subject to legal retention obligations)
• Restriction (Art. 18): Request restricted processing in certain circumstances
• Data portability (Art. 20): Receive your data in a structured, machine-readable format
• Objection (Art. 21): Object to processing based on legitimate interest; objection to direct marketing is absolute and honoured immediately
• Automated decisions (Art. 22): Not be subject to a decision based solely on automated processing producing legal or similarly significant effects, and to obtain human intervention (we do not make such solely-automated decisions — see §4)
• Withdraw consent (Art. 7): Where processing is based on consent, withdraw it at any time

To exercise any of these rights, use our data-rights intake form — it routes directly to our DSAR handling process and issues a tracking ID. You may also write to [email protected] with the subject line "GDPR Request".

We will respond to your request within 30 days, free of charge. For complex or numerous requests this period may be extended by up to a further 60 days, in which case we will inform you within the first 30 days and explain why (Art. 12(3)).

9. Cookies & Consent

hubnixco.com sets no advertising or profiling cookies and loads no analytics or advertising tracker before you consent. By default — and for every visitor who does not opt in — we only count visits anonymously on our own server: when your browser requests a page, our server adds one to a daily total for that page, its language, the source of the visit (for example a search engine, an ad or a link from another site, as a group, never the full address) and your country. Nothing runs in your browser for this, nothing is stored on or read from your device, and we keep no IP address, identifier or browser details, so it requires no consent. The same anonymous counting runs on euaiact.hubnixco.com, where your answers in the check still never leave your device.

Consent-based advertising measurement (Google Ads). If you opt in through our consent banner, we load Google's gtag.js tag (Google Ads ID AW-18275195906) for the sole purpose of measuring advertising conversions — that is, recognising when a visit originated from one of our ads. We use Google Consent Mode v2 with all four signals (ad_storage, analytics_storage, ad_user_data, ad_personalization) set to denied by default; nothing ad-related is loaded into storage or sent until you accept. Your choice is recorded only in your browser's local storage under the key hubnix-consent-v2 — this is a local preference, not a cookie, and is never transmitted to a server. You can change or withdraw your consent at any time using the "Cookie settings" link in the footer; on withdrawal we instruct Google to revoke the consent signals. This advertising measurement is separate from, and additional to, the anonymous visit counts described above.

Cloudflare may also set strictly-necessary security cookies for DDoS protection and bot detection. If you book a meeting on our contact page, the embedded Calendly scheduler may set cookies necessary to operate the booking widget. If you sign in to our self-service platform, we set strictly-necessary, secure session cookies (__Host- prefixed, HttpOnly) solely to keep you signed in — these are exempt from consent requirements and are never used for tracking.

10. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

1. Notify the Italian Data Protection Authority (Garante per la protezione dei dati personali) within 72 hours of becoming aware of the breach
2. Notify affected individuals without undue delay if the breach poses a high risk
3. Document the breach, its effects, and remedial actions taken

11. Supervisory Authority

You have the right to lodge a complaint with a supervisory authority. The competent authority for Hubnix is:

Garante per la protezione dei dati personali
Piazza Venezia 11, 00187 Roma
Website: garanteprivacy.it
Email: [email protected]

12. Changes to This Notice

We may update this privacy notice from time to time. Material changes will be communicated via our website. The "last updated" date at the top of this notice indicates the most recent revision.

• 26.10.2026: Website contact form — the legal basis for replying to your enquiry is now Art. 6(1)(b) (steps taken at your request prior to a contract) instead of consent, so the form no longer asks you to tick a consent box; a short notice under the form links to this page. The newsletter remains consent-based.
• 22.10.2026: Website measurement — the cookieless default measurement is now anonymous visit counts made on our own server from the page request (daily totals per page, language, source group and country; no IP address, identifier, browser details or script; kept 25 months), on hubnixco.com and euaiact.hubnixco.com. This replaces the earlier Cloudflare Web Analytics description in §3 and §9.
• 19.10.2026: EU AI Act Check full report (euaiact.hubnixco.com) — added the order data to §2, a contract-based (Art. 6(1)(b)) processing/retention row to §3 (order and report 30 days, invoice records 10 years), the exception in §4 and §6 for the documents a customer adds to its report (read by Claude; for businesses under the Data Processing Agreement they accept, Anthropic as sub-processor; for consumers with Hubnix as controller), and the matching purposes for Anthropic and Stripe in §5.
• 24 September 2026: Google and LinkedIn sign-in to the My Hubnix client portal — added sign-in data to §2 with a dedicated "Signing in with Google or LinkedIn" section (data received, use, storage, protection, sharing, retention and deletion, and our adherence to the Google API Services User Data Policy including Limited Use), a contract-based (Art. 6(1)(b)) processing/retention row to §3, and Google (as sign-in provider) plus LinkedIn sign-in to the §5 recipient list. Sign-in with Google or LinkedIn is optional and receives only basic profile data (name, email, email-verified status, profile photo, account identifier).
• 27 June 2026: Introduced opt-in advertising conversion measurement — added Google Ads (gtag.js, ID AW-18275195906) behind a Google Consent Mode v2 banner that defaults all four signals to denied, with the consent choice stored locally (localStorage key hubnix-consent-v2, not a cookie) and withdrawable at any time via the footer "Cookie settings" link. Rewrote §9 (Cookies & Consent) accordingly, added an opt-in advertising row to §3 (Art. 6(1)(a) consent) and Google (Google Ireland Limited / Google LLC) to the §5 recipient list. This is separate from, and additional to, the existing cookieless Cloudflare Web Analytics.
• 16 June 2026: Optional LinkedIn profile import for digital business cards — added LinkedIn-import profile data to §2, a consent-based (Art. 6(1)(a)) processing/retention row to §3, and LinkedIn (LinkedIn Ireland, EU/EEA) as the import source in §5. The import is entirely optional, requires your consent on LinkedIn, pre-fills editable card fields only, and can be withdrawn at any time from the card editor or by deleting your account.
• 4 June 2026: Self-service platform launch coverage — added platform account data and published card content to §2, processing/retention rows for platform accounts, cards and payments to §3, Stripe and Resend to the recipient list in §5 (with the platform database and media noted as stored in Cloudflare's EU jurisdiction), and the strictly-necessary platform session cookie to §9.
• 24 May 2026: Recipient list reconciled with our internal records of processing — added Microsoft 365, Backblaze B2, GitHub, and Atlassian; per-recipient countries and transfer mechanisms now shown. Added an AI impact-assessment and Article 22 (no solely-automated decisions) disclosure, a Data Protection Officer statement, a children's-data statement, and clarification of which data is mandatory. Cookie/analytics section corrected to accurately describe Cloudflare Web Analytics (cookieless).
• 13 April 2026: Initial publication.

13. Contact

For any questions about this privacy notice or our data processing practices:

Oleksii Panchenko
Email: [email protected]
Location: Milan, Italy