Privacy Policy

We take the protection of your personal data very seriously. This Privacy Policy explains how personal data is collected, processed, and used when you visit chipfoundry.one, in accordance with the General Data Protection Regulation (GDPR) and applicable German data protection laws.

Last updated: September 2026

1. Data Controller

The data controller responsible under the General Data Protection Regulation (GDPR) and other applicable data protection laws is:

Herzberg Industries GmbH
Bautzner Landstraße 45
01454 Radeberg
Germany
Represented by: Dr. Nico Herzberg
Email: info@chipfoundry.one

2. General Information on Data Processing

We process personal data only to the extent necessary to provide a functional website and to respond to inquiries. Personal data is processed in accordance with applicable data protection regulations, in particular the GDPR and the German Federal Data Protection Act (BDSG).

Personal data will only be collected, used, and passed on if permitted by law or if you consent to the data collection.

3. Website Access Data and Server Logs

When you visit this website, certain technical data is automatically collected and stored in server log files. This data may include:

  • IP address (anonymized where technically possible)
  • Date and time of access
  • Browser type and version
  • Operating system
  • Referrer URL (previously visited page)
  • Requested page or file
  • HTTP status code
  • Amount of data transferred

Purpose: This data is processed to ensure the technical stability, security, and functionality of the website, and to optimize our services.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in ensuring website functionality and security)

Retention period: Log files are automatically deleted after a maximum of 30 days.

4. Partner Applications and Direct Inquiries

When you submit a partner application through the website or contact us directly, the following data may be collected and processed:

  • Name and work email address
  • Organization name, country, and website (if provided)
  • Capability summary and collaboration goals
  • Date and time of submission
  • Additional information you voluntarily provide

This data is used to review a partner application, carry out pre-contractual communication, or respond to your inquiry. We will not use it for unrelated marketing without your explicit consent.

Legal basis:

  • Art. 6(1)(b) GDPR (processing necessary for pre-contractual measures or fulfillment of a contract), or
  • Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries and maintaining business communication)

Retention period: Application and inquiry data is retained only for as long as necessary for review and follow-up, typically no longer than 12 months unless a longer legal retention period or an active business relationship applies.

4a. Partner Portal Accounts

When an institute is admitted to the ChipFoundry.One partner portal, we process the following data for each account holder:

  • Name, work email address, and job title (if provided)
  • Postal address of the institute (if provided)
  • Account activity: sign-in events, submitted validations, and requests responded to

This data is used to operate the account (authentication, password reset, and account-related notifications) and to attribute actions taken on behalf of the institute in the portal, such as who created an account or responded to a request. It is not used for marketing.

Legal basis: Art. 6(1)(b) GDPR, as processing necessary for performing the partnership agreement between the institute and ChipFoundry.One.

Retention period: For as long as the account remains active, and for a limited period afterward as required for audit and legal-retention purposes.

4b. Customer Accounts, Projects and Payments

ChipFoundry.one is offered to businesses only. When you create a customer account, submit a project, or buy a service, we process:

  • Your name, job title, email address, and contact phone number
  • Your company name, legal form, business address, and VAT ID (if provided)
  • Your confirmation that you act as a business and your acceptance of our Terms and Conditions, together with the time and the account used
  • Project information you provide, including requirements and uploaded documents
  • Order and payment records, such as the amount, the payment status, and the card brand and last four digits

We use this data to run your account, provide the services you order, issue invoices, contact you about your projects, and document that our contracts are concluded with business customers. Project information may be processed with the help of AI service providers acting on our behalf, solely to structure your requirements and prepare matches.

Card payments are processed by our payment provider, Stripe. We never receive or store your full card details.

Legal basis:

  • Art. 6(1)(b) GDPR (performance of the contract and pre-contractual steps)
  • Art. 6(1)(c) GDPR (statutory retention obligations under tax and commercial law)
  • Art. 6(1)(f) GDPR (legitimate interest in documenting that contracts are concluded with businesses and in preventing misuse)

Retention period: For as long as your account is active. Invoices, order records, and the confirmations made when ordering are kept for as long as statutory retention periods require.

5. Hosting

Our website and platform run on Google's cloud servers. Google processes this data on our behalf under a GDPR-compliant data processing agreement.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reliable and secure hosting) and, for customer accounts, Art. 6(1)(b) GDPR.

6. Cookies and Tracking Technologies

This website does not load Google Analytics or other analytics or marketing trackers. We will not enable non-essential analytics unless an explicit consent mechanism and corresponding policy update are in place.

Your browser may store technically necessary session data to ensure basic functionality. This does not constitute tracking and is essential for the website to operate correctly.

7. Data Sharing and Third-Party Disclosure

Your personal data will not be sold, rented, or shared with unauthorized third parties for commercial purposes.

Data may only be disclosed to third parties in the following circumstances:

  • Where necessary for the technical operation of the website (e.g., hosting providers)
  • Where you have provided explicit consent
  • Where required by law or by order of a competent authority
  • To protect our rights, property, or safety, or that of others

All third-party service providers are contractually obligated to comply with applicable data protection laws and to process data only in accordance with our instructions.

8. Data Security

We implement appropriate technical and organizational security measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures include:

  • Encryption of data in transit (SSL/TLS)
  • Secure hosting infrastructure with industry-standard protections
  • Access controls and authentication mechanisms
  • Regular security assessments and updates

Despite these measures, please be aware that no data transmission over the internet can be guaranteed to be 100% secure. We cannot ensure or warrant the security of any information you transmit to us.

9. Your Rights as a Data Subject

Under the GDPR, you have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR): You have the right to obtain confirmation as to whether we process your personal data and, if so, to access such data and receive information about the processing.
  • Right to rectification (Art. 16 GDPR): You have the right to request correction of inaccurate personal data and completion of incomplete data.
  • Right to erasure (Art. 17 GDPR): You have the right to request deletion of your personal data under certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected.
  • Right to restriction of processing (Art. 18 GDPR): You have the right to request restriction of processing in certain situations.
  • Right to data portability (Art. 20 GDPR): You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller.
  • Right to object (Art. 21 GDPR): You have the right to object to processing of your personal data based on legitimate interests (Art. 6(1)(f) GDPR).
  • Right to withdraw consent (Art. 7(3) GDPR): If processing is based on your consent, you have the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise any of these rights, please contact us at: info@chipfoundry.one

10. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement, if you believe that processing of your personal data infringes the GDPR.

The competent supervisory authority for data protection in the Free State of Saxony (Germany) is:

Saechsischer Datenschutzbeauftragter
Devrientstrasse 1
01067 Dresden
Germany
Website: https://www.saechsdsb.de/

11. International Data Transfers

Where a service provider processes personal data outside the European Economic Area (EEA), we ensure appropriate safeguards as required by Chapter V of the GDPR, such as the European Commission's Standard Contractual Clauses.

12. Children's Privacy

This website is not directed to children under the age of 16. We do not knowingly collect personal data from children. If you believe that we have inadvertently collected data from a child, please contact us immediately so that we can delete such information.

13. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy to reflect changes in our data processing practices, legal requirements, or technical developments. Any changes will be published on this page with an updated "Last updated" date. We encourage you to review this Privacy Policy periodically. Continued use of the website after changes constitutes acceptance of the updated policy.

14. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact us at:

Email: info@chipfoundry.one
Postal address: Herzberg Industries GmbH, Bautzner Landstraße 45, 01454 Radeberg, Germany