Privacy Policy – Website

The operators of this website take the protection of your personal data seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

As a rule, you can use our website without providing any personal data. Where personal data (for example your name, address or email address) is collected on our pages, this is always done on a voluntary basis wherever possible. We only share this data with third parties in the cases described in this privacy policy.

Please note that data transmitted over the internet (for example by email) can have security gaps. Complete protection of data against access by third parties is not possible.

I. Controller

The controller within the meaning of Article 4(7) of the General Data Protection Regulation (GDPR), and the provider of this website, is HeavenTech SA, 54 Avenue Louise, 1050 Brussels, Belgium. You will find the contact details at the end of this privacy policy.

II. Scope

This privacy policy applies to the website stellar.io. It informs users about the nature, scope and purpose of the collection and use of their data by the responsible provider.

A separate privacy policy applies to the use of our influencer marketing software Stellar.

The legal framework for data protection is the General Data Protection Regulation (GDPR) and the Belgian Law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

III. Collection of general information

Each time you access this website, we or our hosting provider automatically collect information. This information is also referred to as server log files.

The information collected includes: the name of the website, the file, the date, the amount of data, the web browser and web browser version, the operating system, the domain name of your internet provider, the so-called referrer URL (the page from which you accessed our website) and the IP address.

Without this data, it would in some cases be technically impossible to deliver and display the content of the website. The collection of this data is therefore strictly necessary. The legal basis is our legitimate interest in the secure and functional operation of the website (Article 6(1)(f) GDPR). We also reserve the right to review the log files retrospectively if we suspect unlawful use of our website.

IV. Handling of personal data

Definition: personal data is any information relating to an identified or identifiable natural person. It is therefore data that can be traced back to a person.

This personal data includes, for example, your first name and last name, telephone number, email address and IP address.

We only collect, use and, where applicable, share this data where the law expressly permits it or where the user consents to the collection, processing, use and sharing of the data.

V. Use of personal data

We use personal data to promote, analyse and improve our products, services, systems and tools. In particular, we may use personal data:

• to develop new products
• to send marketing communications
• to improve or change our services
• to carry out aggregated analyses and develop business intelligence that enable us to operate and protect our business, make informed decisions about it and report on its development.

VI. Sharing with third parties

We do not sell or rent personal data to marketers or to third parties that are not affiliated with us. In particular, we share your personal data with the following trusted third parties:

• a) with service providers of HeavenTech SA who support us in providing our services, in particular with hosting the website, data analysis, information technology and related infrastructure, email delivery and auditing
• b) with third parties in the event of a restructuring, merger, sale, joint venture, or assignment, transfer or disposal of all or part of our business, assets or shares (including in connection with insolvency or similar proceedings)
• c) for security, lawful purposes and law enforcement, where we consider it necessary: (i) under applicable law, (ii) to enforce our terms, (iii) to protect our or your rights and property, or the rights and property of our affiliated companies or other persons, and for data protection or security purposes, and (iv) to comply with orders from courts, law enforcement authorities, supervisory authorities and other public authorities and government bodies.

The services we use are described individually in the following sections.

VII. Contact forms and contact by email

If you send us enquiries via a contact form or by email, the information you provide, including the contact details you enter, is stored by us for the purpose of processing your enquiry and in case of follow-up questions. The contact form transmits the enquiry and your contact address so that we can reply by email or telephone. Using our contact forms requires your express consent to the transmission of the information you provide (Article 6(1)(a) GDPR). Where your enquiry relates to a contract or to pre-contractual measures, the legal basis is also Article 6(1)(b) GDPR.

Our forms, for example for contacting us or booking a demo, are provided via HubSpot (see section X). The data you enter in the forms is transmitted to HubSpot and stored there on our behalf.

As a rule, an enquiry is stored for 6 months after receipt so that we can refer back to it for follow-up questions. It is stored for longer where this is required or permitted by law.

You can object to this storage at any time.

VIII. Cookies

Our web pages use so-called cookies in some cases. Cookies do not harm your computer and do not contain viruses. They serve to make our website more user-friendly, effective and secure. Cookies are small text files that are placed on your device and stored by your browser.

Some cookies are so-called “session cookies”. They are deleted automatically at the end of your visit. Other cookies remain stored on your device until you delete them. These cookies enable us to recognise your browser on your next visit.

We use the following types of cookies:

• necessary cookies: these are required so that you can visit the website and use the functions it offers. Because they are essential for the operation of the website, you cannot deactivate them
• functional cookies: these store settings you have chosen (for example your language) in order to provide you with enhanced and more personal functions
• performance cookies: these collect information about how visitors use our website, for example which pages they visit most often. Cookies of this type are used, among others, by Google Analytics, HubSpot and Hotjar
• targeting cookies: these are used to measure the success of our advertising and to show you interest-based advertising. Cookies of this type are used, among others, by Google Ads, Meta (Facebook) and LinkedIn.

We use necessary cookies on the basis of our legitimate interest (Article 6(1)(f) GDPR). We only use all other cookies with your consent (Article 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future.

You can set your browser so that you are informed when cookies are set and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when you close the browser. If you deactivate cookies, the functionality of this website may be limited.

IX. Integration of third-party services and content

Our website sometimes includes content, services and features from other providers. These include, for example, videos from YouTube and graphics and images from other websites. In order for this content to be retrieved and displayed in the user’s browser, the transmission of the IP address is strictly necessary. The providers (hereinafter “third-party providers”) therefore see the IP address of the user concerned.

Although we endeavour to use only third-party providers that need the IP address solely to deliver content, we have no influence over whether the IP address may be stored. In that case, this storage serves statistical purposes, among others. Where we know that the IP address is stored, we inform our users.

For example, we load icons (Font Awesome) on this website via the cdnjs content delivery network of Cloudflare, Inc., San Francisco, USA (“Cloudflare”). When you visit our website, your IP address is transmitted to Cloudflare. The legal basis is our legitimate interest in a consistent and appealing presentation of our website (Article 6(1)(f) GDPR). For more information, please see Cloudflare’s privacy policy at https://www.cloudflare.com/privacypolicy/.

X. Analytics and marketing services we use

Unless stated otherwise, we only use the services described below if you have given your consent (Article 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future.

A. HubSpot

We use HubSpot on our website for marketing activities. The provider is HubSpot Ireland Limited, Dublin, Ireland, a subsidiary of HubSpot, Inc., USA (“HubSpot”). We use this integrated software solution for our own marketing, lead generation and customer service purposes. This includes email marketing, contact management such as user segmentation and CRM, landing pages and contact forms.

HubSpot uses cookies that enable us to analyse your use of the website. HubSpot evaluates the information collected (for example IP address, geographical location, browser type, duration of the visit and pages viewed) on our behalf so that we can generate reports on visits and the pages visited. The data entered in our forms is also stored with HubSpot. We have concluded a data processing agreement with HubSpot.

For more information, please see HubSpot’s privacy policy at https://legal.hubspot.com/privacy-policy.

B. Google Analytics

This website uses functions of the web analytics service Google Analytics. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Google Analytics uses cookies that enable an analysis of your use of the website. The information generated about your use of this website may be transmitted to and stored on Google servers, including in the USA. According to Google, IP addresses are not logged or stored in Google Analytics. On behalf of the operator of this website, Google will use this information to evaluate your use of the website and to compile reports on website activity.

You can prevent the data generated by the cookie and relating to your use of the website from being collected by Google, and prevent Google from processing this data, by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout

For more information on how Google handles user data, please see Google’s privacy policy at https://policies.google.com/privacy.

C. Google Ads conversion tracking

We use the online advertising programme “Google Ads” and, as part of Google Ads, conversion tracking. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you click on an advertisement placed by Google, a cookie for conversion tracking is placed on your device. If you visit certain pages of our website and the cookie has not yet expired, Google and we can recognise that you clicked on the advertisement and were redirected to this page.

The information obtained using the conversion cookie is used to compile conversion statistics. This tells us the total number of users who clicked on our advertisement and were redirected to a page with a conversion tracking tag. However, we do not receive any information that personally identifies users.

For more information, please see https://policies.google.com/technologies/ads and Google’s privacy policy at https://policies.google.com/privacy.

D. Meta (Facebook) Custom Audiences

On our website, we use the “Custom Audiences” remarketing function of Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Meta”). This function allows us to target visitors to our website with advertising by showing them personalised, interest-based advertisements when they visit Facebook or Instagram. To use this function, the Meta Pixel is integrated on our website.

When you visit the website, the Meta Pixel establishes a direct connection to Meta’s servers. This tells Meta which of our pages you have visited. Meta may assign this information to your personal user account. We are jointly responsible with Meta for the collection and transmission of this data (Article 26 GDPR).

For more information on how Meta collects and uses data, your rights in this respect and the options for protecting your privacy, please see Meta’s privacy policy at https://www.facebook.com/privacy/policy/. You can manage your advertising preferences in your Meta account.

E. LinkedIn Insight Tag

Our pages use the Insight Tag of the social network LinkedIn. The provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (“LinkedIn”). The LinkedIn Insight Tag is a small piece of JavaScript code that we have added to our website.

The LinkedIn Insight Tag allows the collection of data about visits to our website, including the URL, referrer URL, IP address, device and browser characteristics, timestamp and page views. LinkedIn does not share any personal data with us, but only provides aggregated reports on the website audience and advertising performance. LinkedIn also offers retargeting for website visitors, allowing us to use this data to display targeted advertising outside our website without identifying the member. LinkedIn members can control the use of their personal data for advertising purposes in their account settings.

We use the LinkedIn Insight Tag to enable detailed campaign reports, to track conversions and to obtain information about the visitors to our website. For details on data collection and on your rights and setting options, please see LinkedIn’s privacy policy at https://www.linkedin.com/legal/privacy-policy.

F. Hotjar

On our website, we use services of Hotjar Ltd, St. Julian’s, Malta (“Hotjar”).

Hotjar helps us to provide you with a better user experience and a better service. It helps us diagnose technical problems and analyses user trends. Above all, Hotjar’s services allow us to improve the functionality of the website by making it more user-friendly, more valuable and easier for you to use.

For more information on data protection at Hotjar, please see https://www.hotjar.com/legal/policies/privacy/.

G. YouTube videos in privacy-enhanced mode

We use videos from YouTube on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

We use the “privacy-enhanced mode” provided by YouTube. When you open a page with an embedded video, a connection to the YouTube servers is established and the content is displayed on the web page by notifying your browser. According to YouTube, in “privacy-enhanced mode” data is only transmitted to the YouTube server, in particular which of our pages you have visited, when you watch the video. If you are logged in to YouTube at the same time, this information is assigned to your YouTube account. You can prevent this by logging out of your account before visiting our website.

For more information on data protection at YouTube, please see Google’s privacy policy at https://policies.google.com/privacy.

XI. Use of AI services

To support our work processes, for example when handling enquiries, we use AI services, in particular Claude from Anthropic PBC, San Francisco, USA, and ChatGPT from OpenAI, San Francisco, USA. Personal data that you send us may be transmitted to and processed by these providers. The legal basis is our legitimate interest in handling your enquiries efficiently (Article 6(1)(f) GDPR).

For more information, please see the privacy policies of Anthropic at https://www.anthropic.com/legal/privacy and of OpenAI at https://openai.com/policies/privacy-policy/.

XII. Transfers to third countries

Some of the providers mentioned are based in the USA or process data there. The USA is a third country within the meaning of the GDPR. Where the provider concerned is certified under the EU-U.S. Data Privacy Framework, the transfer is based on the adequacy decision of the European Commission (Article 45 GDPR). Otherwise, we base the transfer on appropriate safeguards, in particular the standard contractual clauses of the European Commission (Article 46(2)(c) GDPR).

XIII. Security

Within our company, we implement appropriate organisational, technical and administrative measures to protect personal data. Unfortunately, the security of a data transmission or data storage system can never be fully guaranteed. If you have reason to believe that your communication with us is no longer secure, please contact us immediately.

XIV. Data minimisation

In accordance with the principles of data avoidance and data minimisation, we only store personal data for as long as necessary or as required by law (statutory retention period). If the purpose of the information collected no longer applies or the retention period ends, we restrict the processing of the data or delete it.

XV. Your rights

On request, you have the right to obtain, free of charge, information about the personal data we hold about you, and to request its rectification, erasure or the restriction of its processing. You also have the right to object to the processing, to withdraw any consent you have given at any time with effect for the future, and to receive your data in a structured, commonly used and machine-readable format. Exceptions: the data is stored because this is required for business transactions, or the data is subject to a statutory retention obligation.

For these purposes, please contact us using the contact details at the end of this privacy policy.

In order to be able to take a restriction of processing into account at any time, the data must be kept for control purposes. If there is no statutory archiving obligation, you can also request the erasure of the data. Otherwise, we will restrict the processing of the data if you so wish.

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority for HeavenTech SA is the Belgian Data Protection Authority (Autorité de protection des données), Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be.

XVI. Updates to this privacy policy

We may make changes to this privacy policy. The “Last updated” note at the end of this privacy policy indicates when it was last updated. Changes take effect when we publish the revised privacy policy on our website.

XVII. Contact

If you have any questions about this privacy policy, please send us a message at andre.kilz@stellar.io or write to:

HeavenTech SA
54 Avenue Louise
1050 Brussels
Belgium
For the attention of André Kilz

Sensitive information: because the security of email communication cannot always be guaranteed, please do not include credit card details or other sensitive data (for example about racial or ethnic origin, political opinions, religion, health or similar) in your emails to us.