Privacy Policy

Effective: 16 October 2026

Information on how we process personal data provided when using the AI Headz website and its contact and B2B client acquisition audit services.

1. Data controller

AI Headz is a service and website operated by the Controller (hereinafter: Controller). Questions or requests about data processing can be sent to the Controller’s contact details above.

2. What data do we process?

When you use the website and fill in the forms, we may process the following personal data:

• name,
• email address,
• phone number,
• company name,
• job title or role,
• company and business information provided in the audit,
• company and business information provided in the proposal request form (brief),
• other information provided when contacting us,
• and technical data related to the use of the website, where these qualify as personal data.

We do not aim to collect special categories of personal data. Please do not provide such data in the audit or contact forms.

3. Purposes and legal bases of processing

3.1. Preparing the B2B client acquisition audit
We use the data provided in the audit form to carry out the audit, analyse the results, deliver the audit and communicate about it. Purpose: preparing the audit and the related contact. Legal basis: taking steps at the request of the data subject, or another appropriate legal basis under applicable data protection law.

3.2. Proposal request (brief) and reminder
We process the data provided in the proposal request form (brief) to prepare a proposal and a possible engagement. The name and email address entered in the first step are saved before the full submission, so that you can continue later. If the form is left unfinished, we send one email reminder with a link to continue. Legal basis: taking steps at the request of the data subject prior to entering into a contract, and the Controller’s legitimate interest.

3.3. Contact
We may use the contact details provided on the website to get in touch with you, answer your questions and discuss our services.

3.4. Later business contact
AI Headz may later contact prospects who have previously been in touch about services, partnership opportunities or other business solutions that may be relevant based on their earlier interest or business profile. In doing so, the Controller complies with applicable data protection and electronic communications rules and respects the data subject’s rights to object and unsubscribe.

3.5. Operating the website
We may process technical data needed for the secure and proper operation of the website, such as IP address, browser and device information, and system log data.

3.6. Visitor statistics (first-party)
We measure website traffic with our own measurement running on Cloudflare (page viewed, referrer, campaign tag, country, device type). Without your consent this is cookieless and anonymous: we use a code derived daily from the IP address and browser identifier that cannot be reversed; the IP address is not stored and visits are not linked across days. If you allow statistics or interest cookies in the cookie banner, we also use an anonymous visitor ID (aih_vid cookie, 6 months); if you later submit a form, your earlier visits may be linked to your enquiry (lead scoring, see the Cookie Policy). Legal basis: without consent, our legitimate interest (improving the website); with the cookie, your consent. Google Tag Manager and the tools it loads (e.g. Google Analytics) load only after consent.

3.7. Personalised pages and proposals
If we send you a personalised page, proposal or contract by link, we record when and how long you read it and how far you scrolled, so we can follow up at the right time. Legal basis: our legitimate interest and steps prior to entering into a contract. You can object at any time at [email protected].

3.8. Artificial intelligence in internal work
We may use artificial intelligence (Anthropic Claude) to process incoming enquiries (summaries, reply drafts, gathering public company information). A team member always reviews the result; the AI makes no decisions about you. Anthropic does not use data sent via its API to train its models.

3.9. Newsletter
Subscribers to the B2B Headz newsletter receive professional content based on their consent. Every email contains a one-click unsubscribe link.

3.10. Customer relationship management and meetings
Enquiries, proposals and related tasks are managed in our internal CRM and task system (stored on Cloudflare). Shared meetings are kept in our Google Calendar (participants' names and email addresses).

4. Data retention

We process personal data only for as long as necessary for the purpose, or as required or permitted by law. Data provided in the audit and contact forms is kept for the duration of the business relationship and, after it ends, in line with relevant legal and business interests. Where processing is based on consent, you may withdraw it at any time. Cookie retention periods are set by the settings for each cookie.

5. Who can access the data?

Personal data may be accessed by the Controller’s staff and contractors who need access to perform their duties. We may also use external providers that supply, for example:

• hosting,
• website operation,
• CRM systems,
• email or communication services,
• analytics services,
• marketing and advertising services.

These providers may process personal data to the extent necessary to provide their service. The Controller updates the list of processors and providers in use as needed.

We currently use the following processors to operate the website:

• Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) – hosting, website operation, database and security services,
• Plus Five Five, Inc. (Resend) (2261 Market Street #5039, San Francisco, CA 94114, USA) – email delivery, such as confirmations and notifications about form submissions, and the reminder to continue the brief.
• Anthropic, PBC (548 Market St, PMB 90375, San Francisco, CA 94104, USA) – artificial intelligence for internal processing of enquiries (see 3.8),
• Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) – calendar (Google Calendar) and, with consent, Google Tag Manager / Google Analytics.

The Cookie Policy gives details of the analytics and marketing tools used on the website.

6. Transfers to third countries

Some online providers or technology partners may process data outside the European Economic Area. Cloudflare, Inc. and Plus Five Five, Inc. (Resend), named above, may also process data in the United States. Such transfers are made with the appropriate safeguards required by applicable data protection law.

7. Your rights

You have the right to:

• request information about the processing of your personal data,
• request access to your personal data,
• request their rectification,
• request their erasure in certain cases,
• request restriction of processing in certain cases,
• object to processing based on legitimate interest,
• withdraw your consent at any time where processing is based on consent,
• request data portability under the applicable conditions.

Requests can be sent to the Controller’s contact details above. You also have the right to lodge a complaint with the competent supervisory authority (in Hungary: the National Authority for Data Protection and Freedom of Information, naih.hu).

8. Data security

The Controller applies appropriate technical and organisational measures to protect personal data against, among other things, unauthorised access, alteration, loss or destruction.

9. Cookies and similar technologies

We may use cookies necessary for the website to work and – under the appropriate conditions – analytics and marketing cookies. You can decide on non-essential cookies in the cookie banner on the website. Details are in the Cookie Policy.

10. Automated decision-making

The Controller does not make automated decisions based on data provided on the website that would have legal effects on you or similarly significantly affect you.

11. Changes to this policy

The Controller reserves the right to amend this policy, in particular if the website, the technologies used or the applicable law change. The current version is always available on the website.

Last updated: 16 October 2026