Data protection

Privacy Policy

Last updated: August 5, 2026

1. Controller

The controller responsible for the processing of personal data on this website (hax.academy) is:
EXTREMIMPACT, UNIPESSOAL, LDA
Rua Costa Cabral, 279 – 2.º Trás
4200-222 Porto, Portugal
Email: info@hax.academy
NIPC / VAT: PT516710184
For any privacy matter, contact us at info@hax.academy.

2. What we process, why, and on what legal basis

We process personal data only where necessary and on a valid legal basis under Article 6 of Regulation (EU) 2016/679 ("GDPR"):

Server and security logs: When you visit this website, our hosting provider processes technical data such as your IP address, browser type, requested pages and timestamps. This is necessary to deliver the website, ensure its security and stability, and diagnose errors. Legal basis: Article 6(1)(f) GDPR (legitimate interest in the secure, reliable operation of the site). Log data is kept only for short, routine retention cycles.
Consulting and contact requests: If you use our contact form or email us, we process your name, email address, and — where you provide them — company, topic and message. Your request is delivered to our mailbox via our website platform's transactional email service and is used to respond to your inquiry and, where applicable, to prepare a proposal. Legal basis: Article 6(1)(b) GDPR (pre-contractual measures taken at your request) and Article 6(1)(f) GDPR (legitimate interest in responding to inquiries).
Learner area: Access to course materials is granted via a course number and course password, which are checked against our database. No personal account is created for this check. If you use the access-recovery form, we process your email address and, where provided, your course number and message, in order to verify your entitlement and resend access details. Legal basis: Article 6(1)(b) GDPR (performance of a contract).
Newsletter ("Field notes"), where offered: If you sign up, we process your email address to send you our field notes. Sign-up uses a double opt-in confirmation. Legal basis: Article 6(1)(a) GDPR (consent). You may withdraw your consent at any time — via the unsubscribe link in every mailing or by emailing info@hax.academy — with effect for the future.
Aggregated usage statistics: We review aggregated, privacy-respecting usage statistics provided by our hosting platform (such as page views and aggregate visitor counts) to understand and improve the site. These statistics do not involve cross-site tracking, advertising profiles or the identification of individual visitors. Legal basis: Article 6(1)(f) GDPR (legitimate interest in improving our website).

3. AI-modified content and editorial responsibility

This website contains content that has been created or modified with artificial intelligence, including images, video and text. Where such content constitutes AI-generated or AI-modified material within the meaning of Article 50(4) of Regulation (EU) 2024/1689 (Artificial Intelligence Act), it is disclosed and labelled accordingly. Further information on the EU labelling requirements is available at https://digital-strategy.ec.europa.eu/en/policies/eu-icons-labelling-ai-generated-content.

Editorial responsibility: Christian Kuhn is editorially responsible for all AI-modified content published on this website.

4. Cookies and similar technologies

This website sets no advertising, analytics or other non-essential cookies, and it embeds no third-party trackers. The storage that does occur is strictly necessary and happens only at your request: (a) HTTP-only session cookies (learner_session, ctw_proposal_session) set only when you sign in to a protected area; (b) a Supabase authentication token in local storage, only if you sign in to the admin backend; (c) local storage for features you actively use: your learner-type quiz result and your video votes, stored on your device only and readable by no third party; (d) local storage that remembers whether you closed our cookie notice (hax-consent). Under Article 5(3) of Directive 2002/58/EC (ePrivacy) and Article 5 of Portuguese Law no. 41/2004, storage that is strictly necessary for a service you explicitly request does not require consent, which is why this site shows an informational notice rather than a consent request. Should we ever introduce non-essential cookies, the notice becomes a real consent banner: nothing non-essential will load before you agree, declining will be as easy as accepting, with equal buttons and no pre-ticked boxes, and you will be able to withdraw at any time via Cookie settings in the footer (Article 7(3) GDPR).

5. Web fonts

The fonts used on this website are hosted on our own infrastructure (self-hosted). When you visit this site, no connection is established to third-party font services (such as Google Fonts) and no personal data is transmitted to font providers.

6. Recipients and processors

We do not sell personal data and we do not share it with third parties for their own marketing. We share personal data only with service providers who process it on our behalf and on our instructions (Article 28 GDPR):

Lovable (Lovable Labs Incorporated; EU representative: Lovable Labs AB, Stockholm, Sweden) — website hosting, infrastructure and transactional email delivery. Privacy policy: https://lovable.dev/privacy · Subprocessors: https://trust.lovable.dev
Supabase, Inc. — database infrastructure for the learner area. Privacy policy: https://supabase.com/privacy · Data processing addendum: https://supabase.com/legal/dpa

7. International data transfers

Some of our service providers process data outside the European Economic Area (including in the United States). Where that is the case, transfers are protected by appropriate safeguards within the meaning of Articles 44–46 GDPR, in particular European Commission adequacy decisions or the EU Standard Contractual Clauses concluded with the providers listed above. You may request further information about these safeguards at info@hax.academy.

8. How long we keep your data

We retain personal data only as long as necessary for the purpose for which it was collected, and thereafter only where retention is required by law (for example, statutory accounting and tax retention periods):

Inquiry and contact data: up to 24 months after our last interaction, unless a contract results or a longer statutory period applies.
Learner-area access data: for the duration of the course and a reasonable period thereafter.
Newsletter data: until you unsubscribe or the newsletter is discontinued; proof of your consent is retained as required by Article 7(1) GDPR.
Server logs: short, routine retention cycles of our hosting provider.

9. Your rights

Under the GDPR you have the right to: access your personal data (Article 15); rectification of inaccurate data (Article 16); erasure ("right to be forgotten", Article 17); restriction of processing (Article 18); data portability (Article 20); and the right to withdraw any consent at any time with effect for the future, without affecting the lawfulness of processing before withdrawal (Article 7(3)).

Right to object (Article 21 GDPR). Where we process your personal data on the basis of legitimate interests (Article 6(1)(f) GDPR), you have the right to object at any time, on grounds relating to your particular situation. Where personal data is processed for direct marketing, you may object at any time without stating reasons, and we will stop that processing.

To exercise any of these rights, contact info@hax.academy. Providing personal data to us is neither a statutory nor a contractual requirement; however, without it we may be unable to answer your inquiry or provide access to materials. We respond within one month; for complex or numerous requests this period may be extended by up to two further months, in which case we will inform you of the extension and its reasons (Article 12(3) GDPR).

No automated decision-making or profiling within the meaning of Article 22 GDPR takes place on this website.

10. Security

We use appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, alteration or destruction, including encryption in transit (HTTPS/TLS) and access controls.

11. Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or the place of the alleged infringement (Article 77 GDPR). In Portugal, the competent authority is the Comissão Nacional de Proteção de Dados (CNPD) — https://www.cnpd.pt.

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. The current version, with its "last updated" date, is always available on this page.