Legal
Privacy policy
How we process personal data when you use this website or contact us.
Last updated: 01.11.2026
This policy explains what personal data fatfish.ai collects when you visit fatfish-ai.com, contact us, book a call or download a document, why we do it, how long we keep it, and what rights you have under the EU General Data Protection Regulation (GDPR).
In short: we collect only what we need to run this website and to answer you. We do not use tracking or advertising cookies, we do not sell your data, and we keep it in the EU wherever possible.
1. Who is responsible
The controller under Art. 4(7) GDPR is:
Johann Hahn Gewerbe, trading as fatfish.ai
Heinrich-Greif-Str. 5
01217 Dresden, Germany
Phone: +49 (0) 1573 48 500 48
Email: [email protected]
For any question about this policy or your data, write to [email protected].
Data protection officer: Mr. Eliezer Berlin
2. When you visit this website
Server log files
Each time you open a page, your browser automatically sends information to our web server. We store it in log files:
- IP address
- date and time of the request
- the page or file requested and the referring page
- browser type and version, and operating system
- amount of data transferred and status of the request
Purpose: to deliver the website, keep it stable and secure, and detect and fight attacks.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the website.
Retention: log files are deleted after [7] days, unless a security incident requires us to keep specific entries longer to investigate it.
Hosting
This website is hosted by [HOSTING PROVIDER, address] in a data centre in [Frankfurt, Germany / other EU location]. The provider processes data only on our behalf and under our instructions, based on a data processing agreement (Art. 28 GDPR).
Cookies and similar technologies
We use only technologies that are strictly necessary to provide the website, for example to remember your language choice (English or German). These do not require consent (§ 25(2) of the German Telecommunications Digital Services Data Protection Act, TDDDG). The legal basis for any related processing of personal data is Art. 6(1)(f) GDPR.
We do not use analytics, advertising or social media tracking. If we introduce such tools in the future, we will ask for your consent first and update this policy.
Fonts
The fonts on this website are stored on our own server. Your browser does not connect to Google or any other font provider when you visit.
3. When you contact us
Contact form, email and phone
When you use our contact form, email us or call us, we process the information you give us. In the contact form, that is:
- name and work email address (required)
- organisation, country and number of employees
- your message, if you write one
Purpose: to answer your enquiry and, if you wish, prepare a discovery call or an offer.
Legal basis: Art. 6(1)(b) GDPR where your enquiry relates to a possible contract with us; otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering messages sent to us.
Retention: if no business relationship follows, we delete your enquiry [6] months after our last contact. If a contract follows, see section 4.
We use [EMAIL PROVIDER, e.g. Google Workspace] to receive and send email, and [FORM SERVICE, if the form is not processed on our own server] to process form submissions. Both act as processors under a data processing agreement.
Booking a call and video meetings
[Include only if used.] If you book a call through [BOOKING TOOL], the provider processes your name, email address, the time you choose and any notes you add, on our behalf. We hold video meetings using [VIDEO TOOL]. Legal basis: Art. 6(1)(b) GDPR.
Downloading our documents
If you request a document such as our Security & GDPR one-pager, we use your email address to send it to you. Legal basis: Art. 6(1)(b) GDPR. We will not add you to a mailing list unless you separately agree to it.
4. Business contacts, customers and prospects
If you or your organisation become a customer, or we discuss a project, we keep contact details and our correspondence in our customer relationship management system ([CRM PROVIDER]).
Legal basis: Art. 6(1)(b) GDPR to prepare and perform contracts; Art. 6(1)(c) GDPR where the law requires us to keep records; Art. 6(1)(f) GDPR to maintain business relationships.
Retention: for the duration of the relationship. Business letters and accounting records are kept for 6 or 10 years as required by German commercial and tax law (§ 257 HGB, § 147 AO).
We send news or marketing emails only if you have agreed to receive them. You can withdraw your consent at any time, for example via the link in every such email.
5. Who receives your data
We share personal data only where necessary for the purposes above:
| Recipient | Purpose | Location | Basis |
|---|---|---|---|
| [HOSTING PROVIDER] | Website hosting | [EU] | Data processing agreement |
| [EMAIL PROVIDER] | [EU / USA] | Data processing agreement | |
| [FORM SERVICE] | Contact form | [EU] | Data processing agreement |
| [BOOKING TOOL] | Scheduling calls | [EU / USA] | Data processing agreement |
| [CRM PROVIDER] | Customer relationships | [EU / USA] | Data processing agreement |
| [Fatfish, Israel] | Project support by our group company | Israel | EU adequacy decision |
| Tax advisers, auditors, authorities | Legal obligations | Germany | Art. 6(1)(c) GDPR |
We do not sell personal data, and we do not share it for advertising.
6. Transfers outside the EU
We prefer providers that process data in the EU. Where a provider is located in, or may access data from, a country outside the European Economic Area, the transfer is protected by:
- an adequacy decision of the European Commission (this applies, for example, to Israel, and to US companies certified under the EU-U.S. Data Privacy Framework), or
- the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), with additional safeguards where needed.
You can ask us for a copy of the relevant safeguards.
7. How long we keep data
| Data | Retention |
|---|---|
| Server log files | [7] days |
| Enquiries without a following business relationship | [6] months after last contact |
| Customer correspondence and business letters | 6 years (§ 257 HGB) |
| Accounting records and invoices | 10 years (§ 147 AO) |
| Consent records | As long as needed to prove consent |
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you (Art. 15)
- have incorrect data corrected (Art. 16)
- have your data deleted (Art. 17)
- restrict how we process it (Art. 18)
- receive your data in a portable format (Art. 20)
- withdraw consent at any time, with effect for the future (Art. 7(3))
Right to object (Art. 21 GDPR): where we process your data based on our legitimate interests (Art. 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation. Where we use your data for direct marketing, you can object at any time without giving reasons, and we will stop.
To exercise your rights, write to [[email protected]]. We answer within one month.
Right to complain
You can complain to a data protection supervisory authority, in particular in the country where you live or work. The authority responsible for us is:
Sächsische Datenschutz- und Transparenzbeauftragte (Saxon Data Protection and Transparency Commissioner)
Postfach 11 01 32, 01330 Dresden, Germany
[email protected]
If you live in Ireland, you can also contact the Data Protection Commission (dataprotection.ie).
9. Other information
Do you have to give us your data? No. But without an email address or phone number, we cannot answer your enquiry.
Automated decisions: we do not make decisions about you based solely on automated processing, including profiling (Art. 22 GDPR).
Security: this website uses TLS encryption. Our information security management is certified to ISO 27001:2022.
Changes: we update this policy when our services or the law change. The current version is always available on this page.