Privacy Notice

1. Introduction

This privacy notice explains how we handle personal data when you visit our website carchainx.com or use our signup form. CarChainX is currently under development (planned product launch in 2026). This notice will be updated as our data processing evolves.

2. Data Controller

The controller responsible for data processing within the meaning of Art. 4 (7) GDPR is:

Company

CarChainX Technology OÜ

Address

Sepapaja tn 6, EE-15055 Tallinn, Estonia

Board member

Gökhan Konuk

Email

info@carchainx.com

Phone

+49 1556 1923919

Registration number (RIK)

17355730

EUID

EEARIREG.17355730

3. Hosting

Our website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Servers are located exclusively within the EU. A data processing agreement under Art. 28 GDPR is in place with Hetzner. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in reliably providing our website).

4. Server log files

When you access our website, our hosting provider automatically records technical data in so-called server log files:

• IP address of the requesting device
• Date and time of the request
• Requested URL
• Referrer URL (previous page)
• Browser and operating system used (user agent)

This data is processed exclusively to ensure stable operation, to enable error analysis and to defend against attacks. Retention period: max. 14 days.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest).

5. Locally hosted fonts

We host the Inter and Space Grotesk font files on our own webspace. When you load the page, these fonts are delivered directly from our server; no connection to Google Fonts is made and no related transfer of personal data to Google occurs. Purpose: consistent typography. Legal basis: Art. 6 (1) (f) GDPR.

6. Locally hosted library

For the scroll-driven background animation we use the scrolly-video library as a local file on our own webspace. When you load the page, this file is delivered directly by our server; no connection to external CDN services such as jsDelivr, Cloudflare, or Fastly is made. Legal basis: Art. 6 (1) (f) GDPR.

7. Newsletter / “Stay in touch”

In the “Stay in touch” section you can leave us your email address so we can inform you about the product launch and significant developments. Submission is voluntary and occurs solely on the basis of your explicit consent.

Form submissions are processed via the service Web3Forms, operated by Web3Forms Technologies, India. Web3Forms is delivered via Cloudflare infrastructure (USA). India is not considered a safe third country under the GDPR; the transfer is based on standard contractual clauses pursuant to Art. 46 GDPR.

We store your email address until you object to processing.

You can withdraw your consent at any time without giving reasons by sending an email to info@carchainx.com. Withdrawal takes effect for the future.

Legal basis: Art. 6 (1) (a) GDPR (consent), Art. 46 GDPR (third-country transfer).

8. Pilot programme / application form

Applications for our pilot programme are handled through an external form provided by Google. The link on the “Pilot programme” page takes you to Google Forms (forms.gle). A connection to Google is only established once you follow that link; no data is transmitted to Google from our website itself.

The form service is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you open the form, Google processes your IP address and technical access data and may set cookies. A transfer to Google LLC in the USA cannot be ruled out; it takes place on the basis of the EU standard contractual clauses pursuant to Art. 46 GDPR and the EU-US Data Privacy Framework, to which Google LLC is certified.

The data you provide in the form (company profile, market role, use case, and contact details) is transmitted to us and used solely to assess your application and to contact you. We store it until the selection process is complete, and for no longer than 24 months if no cooperation comes about.

Legal basis: Art. 6 (1) (b) GDPR (steps taken prior to entering into a contract) and Art. 6 (1) (f) GDPR (legitimate interest in a structured selection process). Google's own privacy policy applies in addition.

9. External links

On our site we link to LinkedIn profiles of our team members. No data is transmitted to LinkedIn merely by loading the page. Only when you actively click such a link does LinkedIn Ireland Unlimited Company's privacy policy apply.

10. Local storage (language preference)

When you use the language switcher in the header, we store your choice (carchainx.lang) in your browser's Local Storage so the page appears in your preferred language on subsequent visits. This storage is technically necessary to preserve a deliberately chosen function and falls under the exception in §25 (2) (2) TTDSG. We do not use any other cookies or tracking.

11. Your rights

You are entitled to the following rights at any time:

• Right of access to data we hold about you (Art. 15 GDPR)
• Right to rectification of inaccurate data (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw given consent with effect for the future (Art. 7 (3) GDPR)

An informal message to info@carchainx.com is sufficient to exercise your rights.

12. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority if you consider that the processing of your data violates the GDPR.

The competent authority for CarChainX Technology OÜ (registered in Estonia) is the Andmekaitse Inspektsioon (AKI), Tatari 39, 10134 Tallinn, Estonia.

You may also contact the data protection authority of your place of residence - in Germany, for example, the state data protection commissioners.

13. Status & changes

Status of this privacy notice: April 2026. We reserve the right to amend this notice when the underlying data processing changes - in particular, when CarChainX launches in 2026.