Privacy Policy

Version 1.1 - 30 April, 2026

About us

This privacy policy ("Privacy Policy") explains how we process and protect your personal data when you use this Website or our services provided via http://www.udihub.io/ (together, the "Services").

These Services are operated by p36 GmbH, Hof Meisebach, 36251 Bad Hersfeld, Germany (the "Company", "we", "our", or "us"). The Company is the controller for the data processing described below.

Unless otherwise defined in this Privacy Policy, the definitions used in this Privacy Policy have the same meaning as in the EU General Data Protection Regulation (GDPR).

For all questions on the subject of data protection, you can also contact our data protection officer (DPO) at any time. Our DPO can be reached:

by e-mail to: dataprotection@p36.io

by mail to: p36 GmbH, Hof Meisebach, 36251 Bad Hersfeld, Germany

We expressly point out that if you use this e-mail address, the contents will not be exclusively noted by our DPO. If you wish to exchange confidential information, please therefore first contact us directly via: dataprotection@p36.io and mark the correspondence with: “F.A.O. data protection officer”.

1. Personal Data We Collect

We may collect or receive personal information for a number of purposes connected with our business operations when you use our Services, namely:

Usage and analytics information (e.g., identifiers, numbers of clicks, tracking data)
Contact details (e.g., name, address, phone number, birth date)
Geolocation (e.g., your actual location, GPS data)
Login details (e.g., password, username, session, e-mail address)
Payment details (e.g., billing information, credit card details)
Recruitment details (e.g., CV, letter of motivation)
Request details (e.g., details and content of your inquiries)
Website visitor details (e.g., IP address, logfiles, terminal ID)

There is no obligation to provide your personal data. However, please note that our Services cannot be provided if you do not provide the required data strictly necessary for performing the contract between you and us.

2. How we Collect Personal Data

We collect information about our users when they use our Services, including taking certain actions within it.

Directly

Via our Website and electronic communication
When you use our Services
When you correspond with us by electronic means using our Services
When you browse, complete a form or make an inquiry while using our Services

Indirectly

Through public sources (such as commercial registers), news articles and internet searches
From third parties, such as social media plugins and third-party cookies
From external Service Providers (see section 5)

3. Legal Basis and Purposes

Our legal basis for collecting and using the personal data described in this Privacy Policy depends on the personal data we collect and the specific purposes for which we collect it.

Contract: To perform our contractual obligations or take steps linked to a contract with you. In particular:

To provide you with customer support
To set up and manage your account, as well as to verify your credentials when logging in
To recruit you
To provide our Services

Consent: We may rely on your freely given consent at the time you provided your personal data. In particular:

To analyse, improve, personalise and monitor the usage of our Services and communication
To place non-essential cookies and other tools on your browser
To provide users with news, special offers, newsletters, and general information about services which we offer

Legitimate interests: We rely on legitimate interests based on our assessment that the processing is fair and reasonable and does not override your interests or fundamental rights and freedoms. In particular:

To place essential cookies and other tools on your browser that are technically necessary for our Services
To develop new services
To maintain and improve our Services, as well as to detect, prevent, and address security threats

Necessity for compliance with legal obligations: To meet regulatory obligations. In particular:

To notify you about changes to our Services and our Privacy Policy
To comply with applicable regulations and legislation.
For the legal enforcement of claims and rights.

4. Data Retention

We retain personal data for so long as it is needed for the purposes for which it was collected and in line with legal and regulatory requirements or contractual arrangements. After this period, we delete or fully anonymize your personal data.

5. Service Providers

We engage third-party companies ("Service Providers") to facilitate the operation of our Services, assist in analysing the usage of the Services, or perform necessary services, such as payment and the provision of IT services. These third parties have access to your personal data only to the extent necessary to perform these tasks.

Type(s) of Service Providers who might access your personal data:

Third parties that are engaged in the course of your matter, such as counsels, banks and other payment providers, KYC/AML service providers, and postal or courier providers
Professional advisers that we use, such as accountants and law firms
Public authorities
Third parties who provide IT and software services

6. Data Transfers

The Company and/or the Service Providers may transfer your personal data to and process it in the following countries:

EU/EEA
USA
Australia
United Kingdom

We may use Service Providers partly located in so-called third countries (outside the European Union or the European Economic Area) or process personal data there, i.e., countries whose level of data protection does not correspond to that of the EU.

We safeguard your personal data per our contractual obligations and applicable data protection legislation when transferring data abroad.

Such safeguards may include:

The transfer to countries where there is an adequacy decision by the European Commission in place
Applying standard data protection model clauses, binding corporate rules or other standard contractual obligations that provide appropriate data protection

If a third country transfer takes place and there is no adequacy decision or appropriate safeguards, it is possible and there is a risk that authorities in the third country (e.g. intelligence services) can gain access to the transferred data and that the enforceability of your data subject's rights cannot be guaranteed.

7. Data Disclosure

We may disclose your personal data in the good faith belief that such action is necessary:

To comply with a legal obligation (i.e., if required by law or in response to valid requests by public authorities, such as a court or government agency)
To protect the security of our Services and defend our rights or property
To prevent or investigate possible wrongdoing in connection with us

8. Data Security

We take reasonable technical and organisational measures that we deem appropriate to protect your stored data against manipulation, loss, or unauthorised third-party access. Our security measures are continually adapted to technological developments.

We also take internal data privacy very seriously. Our employees and the service providers that we engage are required to maintain secrecy and comply with applicable data protection legislation. In addition, they are granted access to personal data only insofar as this is necessary for them to carry out their respective tasks or mandate.

The security of your personal data is important to us but remember that no method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security. We recommend using antivirus software, a firewall, and other similar software to safeguard your system.

9. Your Rights

You have the below data protection rights. To exercise these rights, you may contact the above address or send an e-mail to: dataprotection@p36.io. Please note that we may ask you to verify your identity before responding to such requests.

Right of access: You have a right to request a copy of your personal data, which we will provide to you in an electronic form.
Right to amendment: You have the right to ask us to correct our records if you believe they contain incorrect or incomplete information about you.
Right to withdraw consent: If you have provided your consent to the processing of your personal data, you have the right to withdraw your consent at any time with effect for the future. This includes cases where you wish to opt-out from marketing communications. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose(s) to which you initially consented to unless there is another legal basis for processing.
Right to erasure: You have the right to request that we delete your personal data when it is no longer necessary for the purposes for which it was collected or when it was unlawfully processed.
Right to restriction of processing: You have the right to request the restriction of our processing of your personal data where you believe it to be inaccurate, our processing is unlawful, or where we no longer need to process it for the initial purpose, but where we are not able to delete it due to a legal obligation or because you do not want us to delete it.
Right to portability: You have the right to request that we transmit your personal data to another data controller in a standard format such as Excel, if this is data which you have provided to us and if we are processing it on the legal basis of your consent or to perform our contractual obligations.
Right to object to processing: Where the legal basis for our processing of your personal data is our legitimate interest, you have the right to object to such processing on grounds relating to your particular situation. We will abide by your request unless we have a compelling legal basis for the processing which overrides your interests or if we need to continue to process the personal data for the exercise or defence of a legal claim.
Right to lodge a complaint with a supervisory authority: You have the right of appeal to a data protection supervisory authority if you believe that the processing of your personal data violates data protection law. In the EU and EEA, you can exercise this right, for example, before a supervisory authority in the Member State of your residence, your place of work or the place of the alleged infringement. You can find a list of the relevant authorities here: https://edpb.europa.eu/about-edpb/board/members_en.

10. Cookies

Our Services use cookies and similar technologies (collectively “Tools”) provided either by us or by third parties.

A cookie is a small text file that is stored on your device by the browser. Comparable technologies are web storage (local / session storage), fingerprints, tags or pixels. Most browsers are set by default to accept cookies and similar technologies. However, you can usually adjust your browser settings so that cookies or similar technologies are rejected or only stored with your prior consent. If you refuse cookies or similar technologies, you may not be able to use all of our Services without problems.

In the following, the Tools we use are listed by category, whereby we inform you in particular about the providers of the Tools, the storage period, and their purpose. If personal data is transferred to third countries, we refer you to section 6 of our Privacy Policy, also with regard to the risks this may entail.

We use Tools that are necessary for the operation of the website on the basis of our legitimate interest in enabling you to use our Services more conveniently and individually and to make use of it as timesaving as possible. In certain cases, these Tools may also be necessary for the performance of a contract or to carry out pre-contractual measures. In these cases, access to and storage of information in the terminal device is absolutely necessary and is carried out on the basis of the implementation laws of the ePrivacy Directive of the EU member states.

We use all other Tools, especially those for marketing purposes, on the basis of your consent. In these cases, access to and storage of information in the end device is subject to consent and takes place on the basis of the implementation laws of the ePrivacy Directive of the EU member states. If you have given your consent to use certain Tools, we will (also) transfer the data processed when using the Tools to third countries on the basis of this consent.

You can withdraw your consent for certain Tools at any time in the settings of our cookie banner solution. Alternatively, you can assert your revocation for certain Tools directly with the provider.

10.1. Essential Tools

CookiesYes

We use CookieYes, a service provided by CookieYes Limited, 3 Warren Yard Warren Park, Wolverton Mill, Milton Keynes, MK12 5NW, United Kingdom ("CookieYes"). CookieYes asks website visitors for consent to set cookies and process personal data. For this purpose, CookieYes collects the masked IP address of our website users in order to keep a record of cookie consents. Legal basis: legitimate interests, Art. 6(1)(f) GDPR.
Tools used:

cookieyes-consent (1 year): Stores users' consent preferences so that their preferences are taken into account on subsequent visits to this website.

For more information, please see CookieYes’ privacy policy.

Webflow

We use the website-building and hosting service Webflow, provided by Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA (“Webflow”), to design, host, and manage our website. Legal basis: performance of a contract, Art. 6(1)(b) GDPR.
Tools used:

Wf_auth (2 years): Storing a user's login status for functional purposes.

For more information, please see Webflow’s privacy policy.

Cloudflare

We use Cloudfare, a service provided by Cloudfare Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare is used to optimise the loading times of our website and to secure it. Through Cloudflare, user requests on our website are initially routed via Cloudflare servers and statistics are compiled from these data streams. This serves to detect potential threats to our website from malware at an early stage and to optimise the loading times of our website. These statistics enable us to continuously improve our services, to carry out a cost-benefit analysis of our internet marketing and to make our internet presence more interesting and user-friendly for you as a user. Legal basis: legitimate interests, Art. 6(1)(f) GDPR.
Tools used:

_cfuvid (session): Applies rate-limiting and security protections for visitors who share an IP address to maintain performance and security.

For more information, please see Cloudflare's privacy policy.

Clerk

We use Clerk, a service provided by Clerk Inc., 548 Market St PMB 77571, San Francisco, CA 94104, USA (“Clerk”), to provide secure user authentication and account management for our website. Legal basis: performance of a contract, Art. 6(1)(b) GDPR.
Tools used:

_client_uat (session): Maintains login session status and ensures secure authentication.

For more information, please see Clerk's privacy policy.

Stripe

We use Stripe, a service provided by Stripe Inc, 510 Townsend Street, San Francisco, CA 94103, USA. It allows our company to process payments and send payouts globally, as well helps us to minimise risks of fraud. Legal basis: performance of a contract, Art. 6(1)(b) GDPR.
Tools used:

stripe_mid ( 1 year): Fraud prevention & merchant identification
stripe_sid (30 minutes): Fraud prevention & session tracking
m (session): Stripe metadata / payment element rendering

For more information, please see Stripe's privacy policy.

10.2. Non-essential cookies

Posthog

We use the analytics service PostHog, provided by PostHog, Inc., 965 Mission Street, San Francisco, CA 94103, USA (“PostHog”), to better understand user interactions with our platform and improve the user experience. Legal basis: consent, Art. 6(1)(a) GDPR.
Tools used:

ph_* (1 year): uniquely identifies users and tracks their interactions on our website and within our apps (UDI Connect, UDI Hub). It helps us analyze user behavior and improve our services.

For more information, please see PostHog’s privacy policy.

12. Social Media and Links to Third-Party Apps and Websites

Our Services contain links to websites or apps that are not operated by us. When you click on a third-party link, you will be directed to that third party's website or app. We have no control over the content, privacy policies, or practices of any third-party websites or services.

We maintain online presences on social networks to, among other things, communicate with customers and prospective customers and to provide information about our products and Services. If you have an account on the same network, it is possible that your information and media made available there may be seen by us, for example, when we access your profile. In addition, the social network may allow us to contact you. As soon as we transfer personal data into our own system, we are responsible for this independently. This is then done to carry out pre-contractual measures and to fulfil a contract. For the legal basis of the data processing carried out by the social networks under their own responsibility, please refer to their data protection declarations. Below is a list of social networks on which we operate an online presence:

13. Contact Forms and Appointment Scheduling

If you contact us via a form on our website, we process the personal data you provide to handle your request and to communicate with you. Depending on the form fields, this may include first and last name, email address, job title, company and the content of your message. Providing this information is necessary to process your inquiry; otherwise, we may be unable to respond or do so appropriately. The legal basis for this processing is Art. 6(1)(b) GDPR (taking steps prior to entering into a contract and/or performance of a contract). We use Microsoft Bookings for online appointment scheduling for meetings with our Sales team. The service provider is Microsoft Corporation, One Microsoft Way, Redmond, Washington 98052, USA (hereinafter “Microsoft”). Microsoft Ireland Operations Limited is Microsoft’s data protection representative for the European Economic Area and Switzerland and can be contacted at the following address: One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. Microsoft Bookings enables the display of available time slots and the efficient management of bookings, as well as the sending of appointment confirmations and reminders. In the course of scheduling an appointment—depending on the information you provide—the following personal data in particular may be processed: name, email address, where applicable telephone number, company/role, and, where applicable, the content of your message/request (free-text). The data is required in order to plan, conduct, and follow up on the appointment. The data you enter is processed in our systems (in particular in Microsoft 365, e.g., Calendar/Exchange) and transmitted to Microsoft for the purpose of handling the appointment. Processing is carried out on the basis of Art. 6(1)(b) GDPR. Microsoft processes personal data on our behalf as a processor (Art. 28 GDPR) on the basis of a data processing agreement. Processing in third countries (e.g., the USA) cannot be ruled out. Where required, transfers of data are based on appropriate safeguards, in particular the EU Standard Contractual Clauses. Further information on data processing by Microsoft can be found in Microsoft’s privacy policy.

14. Newsletter

We send newsletters and other notifications by email and through other communication channels and may deliver them with the help of third parties. In principle, you must expressly consent to receive newsletters and other notifications from us, unless this is permitted for other legal reasons. We use "double opt-in" for any consent in the case of e-mails, i.e., you will receive an e-mail with a web link that you must click to confirm, so that no misuse by unauthorized third parties can take place. We may log such consents including Internet Protocol (IP) address, date and time. Newsletters and other notifications may contain web links or tracking pixels that record whether an individual newsletter or notification has been opened and which web links were clicked (performance measurement). Such web links and tracking pixels record the use of newsletters and other notifications. We use this statistical recording of usage, including success and reach measurement, in order to be able to offer newsletters and other notifications effectively and in a user-friendly manner, as well as permanently, securely and reliably, based on the reading habits of the recipients. You can unsubscribe from newsletters and other notifications at any time and thereby object in particular to the aforementioned collection of usage. You can do so by contacting us directly or following the link included in the footer of each newsletter we send you.

15. Changes to this Privacy Policy

We may update our Privacy Policy from time to time. We therefore encourage you to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

16. Contact us

If you have any questions about this Privacy Policy or wish to withdraw your consent (where applicable), do not hesitate to get in touch with us at:
p36 GmbH,
Hof Meisebach, 36251 Bad Hersfeld, Germany,
dataprotection@p36.io