Soma1. Scope and controller
This notice covers the SomaHQ marketing website at somahq.si and enquiries about SomaHQ. The controller is EUTS UG (haftungsbeschränkt), In der Mulde 17, 75031 Eppingen, Germany, represented by Alexander Buddrick. Contact: contact@euts.ai. Register details and the registered-name transition are in the Impressum. This is our privacy contact; it is not a claim that a statutory data protection officer has been appointed.
Deutsche Datenschutzerklärung. The separate application and EUTS contact website may process additional data. Customer-controlled workspace data is governed by the DPA and deployment notices, rather than this website notice alone.
2. Visiting this website
To deliver pages and protect the service, our server and infrastructure provider process your IP address, request time, requested URL, response information and technical headers your browser sends, which may include browser, operating system and referrer information. The legal basis is Article 6(1)(f) GDPR: our legitimate interests in reliable delivery, preventing abuse and investigating failures. Necessary transmission is not analytics consent.
The website is served on infrastructure in Germany using Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. See its privacy information. This site has no contact form, account database, payment collection, analytics, advertising tags, remote fonts, embedded videos or browser fingerprinting. Search and menu interactions run in your browser and are not sent to us as interaction events.
3. Enquiries and business correspondence
If you email us, we process your address, message, attachments and details you provide to answer and follow up on your request. Article 6(1)(b) GDPR applies where this is necessary for a contract with you or steps you request before one. For staff contacting us for their organisation, and other enquiries, Article 6(1)(f) applies: our legitimate interest in handling business correspondence. Article 6(1)(c) applies where law requires retention or disclosure. We do not subscribe you to advertising simply because you enquire.
The “Contact” and consultation links open euts.ai, a separate website. Its form, analytics, consent choices, email delivery and possible international processing are explained in the EUTS privacy notice. Its practices are not features of somahq.si. Please do not send sensitive personal data, passwords or customer databases in an initial enquiry.
4. Recipients and transfers
Access is limited to authorised EUTS personnel and infrastructure or communications suppliers needed to deliver the relevant service, and authorities or professional advisers where legally necessary. A recipient acts as a processor where it handles data on our instructions and must then be covered by Article 28 GDPR terms. We do not sell personal data or disclose it for third-party advertising.
The marketing hosting identified above is in Germany. An EU server location alone does not establish that every supplier or support access is confined to the EEA. For an enquiry submitted through euts.ai, consult its linked disclosure before submitting. Any transfer requiring Chapter V GDPR safeguards must have a valid adequacy basis or appropriate safeguards, including completed SCCs and a transfer assessment where needed. Ask our privacy contact for recipient details and a copy of applicable safeguards. See providers and transfer information.
5. Retention
Request data is processed to deliver the response. The current website does not configure a separate visitor analytics store or a website access-log archive. Where infrastructure security or error records are retained, retention must be limited to diagnosing failures, preventing abuse or investigating a specific incident; records must be deleted or de-identified when that purpose ends. The infrastructure operator’s actual log rotation must be checked separately; no fixed deletion period is asserted here.
Enquiries are retained while being handled and for necessary follow-up, then deleted unless an applicable commercial or tax record obligation or the establishment, exercise or defence of legal claims requires retention. Only the relevant records may be retained for that purpose, with restricted access. You can ask for the retention criteria and records applying to your correspondence at any time. Workspace, backup and AI-log retention must be specified separately in your processing schedule.
6. Your GDPR rights
Subject to the conditions of the GDPR, you may request access (Article 15), correction (16), erasure (17), restriction (18) and portability of data provided on consent or contract and processed by automated means (20). You may withdraw consent at any time with future effect without affecting earlier lawful processing (Article 7(3)).
You may object, on grounds relating to your particular situation, to processing based on legitimate interests (Article 21(1)). You may object to direct marketing at any time (Article 21(2)). Email contact@euts.ai. We normally respond within one month. If a request is complex or numerous requests require an extension of up to two further months, we will tell you within the first month and explain why. We ask only for proportionate information needed to verify identity.
You can complain to a supervisory authority, including where you live, work or believe an infringement occurred. For the company’s Eppingen contact address, the local authority is Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg. You do not need to contact us first.
7. Required data, children and decisions
Basic connection data is technically necessary to display the website; without it the site cannot be delivered. Contacting us is voluntary, although we need a reply address and relevant details to answer. The site is intended for business users and does not target children. It does not make solely automated decisions with legal or similarly significant effects, or carry out visitor profiling.
8. Optional Google sign-in to the application
Where enabled in the separate SomaHQ application, you may choose Google to verify your identity instead of email-code sign-in. The approved scope is limited to openid email profile: an account identifier, email and verification status, and available basic profile details such as name and picture. It does not authorise Gmail, Calendar or Drive access, or sending workspace records to Google. The marketing site does not load Google sign-in scripts.
Choosing this method directs you to Google, which processes the sign-in request and technical connection data under its privacy policy. Google identity services may involve processing in the United States. This is a narrow identity-provider exception; it does not change the agreed business-data hosting, inference or mail providers. Before activation, the deployment notice must identify the applicable Google legal entity, controller/processor roles and any required transfer safeguards.
EUTS uses returned identity details to authenticate and associate your application account. The basis is Article 6(1)(b) GDPR where necessary for a contract with you, otherwise Article 6(1)(f) for secure organisation-account access. Retention follows the account lifecycle and necessary security-record criteria, which must be specified for that deployment. Revoking Google access does not itself delete your SomaHQ account; contact EUTS to exercise deletion or access rights. This notice describes the approved scope and does not confirm production activation.
9. Changes and further information
We will update this notice when processing changes. New optional tracking would require an updated notice and prior consent where required by § 25 TDDDG and the GDPR. See the cookie policy for current device-storage behaviour and the official GDPR text for the rights and duties referred to here.
SomaHQ · EUTS UG (haftungsbeschränkt)
contact@euts.ai · Legal hub