Legal Notice

Website: www.hydraloop.com

Controller: Hydraloop Systems B.V.

Address: Oostergoweg 9, Wetsus Building / WaterCampus, 8911 MA Leeuwarden, The Netherlands

Contact: privacy@hydraloop.com

General contact: info@hydraloop.com

1. Introduction

Hydraloop Systems B.V. ("Hydraloop", "we", "us" or "our") respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, disclose, store and protect personal data when you interact with Hydraloop, including when you:

• visit www.hydraloop.com;
• use our website forms;
• request information, a product guide, quotation, consultation or demo;
• use our website chat functionality;
• communicate with us as a prospect, customer, installer, dealer, distributor, partner, supplier or other business contact;
• receive customer support or service;
• interact with Hydraloop products, software, connected features, the Hydraloop app or Hydraloop Device Manager, where applicable.

This Privacy Policy applies to the Hydraloop website (www.hydraloop.com), website forms, chat functionality, and commercial communications. Where a separate privacy notice applies to a specific product, app or connected device, that notice will prevail.

Where a separate privacy notice applies to a specific product, app, connected device, Hydraloop Device Manager or service environment, that specific notice will provide more detailed information and will prevail for that processing.

This Privacy Policy should be read together with our Cookie Policy, which explains how we use cookies, localStorage, sessionStorage and similar technologies on our website.

2. Who is responsible for your personal data?

Hydraloop Systems B.V. is the data controller responsible for the processing of personal data described in this Privacy Policy, unless stated otherwise.

Hydraloop Systems B.V.

Oostergoweg 9

Wetsus Building / WaterCampus

8911 MA Leeuwarden

The Netherlands

Email: privacy@hydraloop.com

Where relevant, this Privacy Policy may also apply to affiliated Hydraloop entities, including Hydraloop Inc. (United States) and Hydraloop MENA LLC-FZ (United Arab Emirates), where they process personal data in connection with Hydraloop products, services, websites or commercial activities.

3. Dealers, distributors, installers and partners

Hydraloop may work with dealers, distributors, installers, service partners, consultants, architects and other commercial or technical partners.

If you contact Hydraloop through such a partner, or if we refer your request to a partner, that partner may process your personal data. Depending on the situation, the partner may act as:

• an independent controller, where the partner determines its own purposes and means of processing;
• a processor, where the partner processes personal data only on behalf of Hydraloop;
• a joint controller, where Hydraloop and the partner jointly determine the purposes and means of processing.

In most cases, dealers, distributors and installers act as independent controllers for their own commercial activities. Where a partner processes personal data on behalf of Hydraloop, a data processing agreement is in place. Where a partner acts as an independent controller, their own privacy notice will apply to their processing of your personal data.

4. What personal data do we collect?

The personal data we collect depends on your relationship with Hydraloop and how you interact with us.

4.1 Website and technical data

When you visit our website, we may process:

• IP address;
• browser type and version;
• device type;
• operating system;
• pages visited;
• referral URL;
• session data;
• cookie preferences;
• language preferences;
• theme preferences;
• interaction data, such as clicks, scrolling and navigation behaviour;
• analytics identifiers, where consent has been given;
• information stored through cookies, localStorage and sessionStorage.

Our Cookie Policy contains a detailed overview of the cookies and browser storage items used on www.hydraloop.com.

4.2 Contact and form data

When you contact us, fill in a form, request a product guide, book a consultation, request a quotation or ask for more information, we may process:

• name;
• company name;
• job title or role;
• email address;
• telephone number;
• country or region;
• address details, where relevant;
• project type;
• building type;
• product interest;
• message content;
• any other information you choose to provide.

Hydraloop's website includes contact and information-request functionality, including forms and consultation/product-related requests.

4.3 Chat data

When you use the chat functionality on our website, we may process:

• chat messages;
• chat session identifiers;
• visitor identifiers;
• lead identifiers;
• whether the chat widget is open;
• pages visited for chat context;
• contact details you provide in the chat;
• technical information needed to operate the chat;
• intent level or intent score, where applicable and where consent is required.

The chat functionality is provided by Hydraloop's own AI-powered chat system, hosted on Hydraloop infrastructure. The chat uses artificial intelligence (including OpenAI as a third-party AI service provider) to assist visitors with product questions, consultation scheduling and general enquiries. Chat session data stored in the browser (localStorage and sessionStorage) is retained until cleared by the user. Server-side chat data is retained for a limited period to enable follow-up and improve the service.

4.4 Customer, product and service data

If you purchase, install, use, maintain or receive support for a Hydraloop product or service, we may process:

• customer contact details;
• installation address or service location;
• product model;
• product serial number;
• installation details;
• installer or service partner details;
• warranty records;
• service records;
• maintenance information;
• support requests;
• communication with customer support or service teams;
• product status data;
• error messages and alerts;
• troubleshooting logs;
• diagnostic data;
• water recycling statistics;
• connectivity status;
• performance monitoring data, where applicable.

Product, app, Hydraloop Device Manager and connected device data may be governed by separate privacy notices. Where a separate notice applies, it will provide more detailed information and will prevail for that processing. This Privacy Policy primarily applies to website and general business-contact processing.

4.5 Partner, dealer, distributor, installer and supplier data

When we work with business contacts, installers, dealers, distributors, architects, consultants, suppliers or other partners, we may process:

• name;
• company name;
• business email address;
• business telephone number;
• role or job title;
• business address;
• country or region;
• contractual and commercial information;
• training or certification information;
• onboarding information;
• meeting notes;
• orders, quotations, invoices and payment information;
• partner portal or documentation access data, where applicable.

Hydraloop publicly provides documentation, manuals, installation material, product data sheets and partner-related information through its Info Center.

4.6 Marketing and event data

When you subscribe to communications, attend an event, interact with a campaign, download content or express interest in Hydraloop, we may process:

• name;
• email address;
• company name;
• role or job title;
• country or region;
• product or project interests;
• communication preferences;
• newsletter subscription status;
• marketing consent status;
• unsubscribe status;
• event registration and attendance information;
• campaign interaction data;
• email engagement data, such as opens and clicks, where permitted.

Hydraloop uses ActiveCampaign for email marketing, CRM automation and managing communication preferences.

4.7 App, Hydraloop Device Manager and connected feature data

Where Hydraloop offers an app, Hydraloop Device Manager, remote monitoring or connected product features, we may process data needed to provide those services, such as:

• account details;
• product registration data;
• device identifiers;
• product status;
• notifications;
• diagnostic information;
• remote monitoring information;
• service or maintenance alerts;
• usage and performance information;
• support-related information.

Where a separate privacy notice applies to the Hydraloop app, Hydraloop Device Manager or connected device features, that notice will provide specific information about the data categories and retention periods applicable to those services.

5. How do we collect personal data?

We may collect personal data:

• directly from you, for example when you fill in a form, contact us, use chat, request support or communicate with us;
• automatically, for example through cookies, browser storage, analytics tools, server logs, connected products or digital services;
• from Hydraloop dealers, distributors, installers, service partners or other commercial partners;
• from suppliers, business contacts, events, professional networks or public sources;
• from systems used to manage customer relationships, support, sales, marketing, installation, service or product performance.

6. Why do we process personal data?

We process personal data for the purposes described below.

6.1 To operate and secure our website

We process technical and usage data to:

• provide the website;
• keep the website secure;
• remember cookie preferences;
• remember language and theme preferences;
• troubleshoot technical issues;
• prevent misuse;
• maintain website functionality;
• improve website performance.

6.2 To respond to requests

We process contact and form data to:

• respond to questions;
• send requested product information;
• provide product guides;
• arrange consultations, quotations or demos;
• assess project needs;
• follow up on requests;
• refer requests to the appropriate Hydraloop team, dealer, distributor, installer or service partner.

6.3 To provide chat functionality

We process chat data to:

• operate the chat feature;
• continue a chat session after a page reload;
• understand the context of your request;
• respond to chat messages;
• create or follow up on leads where you provide contact details;
• improve the chat experience, where permitted.

6.4 To sell, deliver, install and support products and services

We process customer, product and service data to:

• handle quotations and orders;
• enter into and perform contracts;
• deliver products and services;
• support installation and commissioning;
• provide warranty and after-sales support;
• provide maintenance and service support;
• diagnose technical issues;
• monitor device status and performance, where applicable;
• improve product quality, reliability and safety;
• comply with legal, tax, accounting and regulatory obligations.

6.5 To manage business relationships

We process business contact data to:

• manage relationships with customers, prospects, dealers, distributors, installers, suppliers and partners;
• handle commercial communications;
• provide technical documentation;
• provide training or onboarding;
• manage partner, installer or supplier collaboration;
• process contracts, orders, invoices and payments.

6.6 For analytics and website improvement

With your consent where required, we process analytics and personalisation data to:

• understand how visitors use our website;
• measure sessions and returning visits;
• analyse visitor behaviour;
• improve website content and navigation;
• personalise certain website elements, such as smart calls-to-action;
• measure the performance of campaigns and website improvements.

Based on the current cookie/storage inventory, analytics and personalisation items include, among others, hla_vid, hla_sid, hydra_visitor, _hjSessionUser_[id], headless_intent_level, headless_intent_score and headless_hj_captured.

6.7 For marketing and communications

We process marketing data to:

• send newsletters or commercial communications where permitted by law;
• inform you about Hydraloop products, services, events, updates or content;
• follow up on business enquiries;
• measure the effectiveness of communications;
• manage opt-outs and communication preferences.

You can unsubscribe from marketing emails at any time using the unsubscribe link in the email or by contacting us.

6.8 For legal, compliance and security purposes

We process personal data to:

• comply with legal obligations;
• maintain business records;
• protect our rights and interests;
• detect or prevent fraud, abuse or security incidents;
• resolve disputes;
• enforce contracts;
• respond to lawful requests from authorities;
• support audits, compliance reviews or corporate transactions.

7. Legal bases for processing

We process personal data only where we have a valid legal basis under applicable data protection law.

Depending on the situation, we rely on the following legal bases:

Where we rely on legitimate interests, we balance our interests against your privacy rights and interests.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing before withdrawal.

8. Cookies, analytics and similar technologies

We use cookies and similar technologies, including localStorage and sessionStorage, on our website.

Some of these technologies are strictly necessary for the website to function properly. Others, such as analytics and personalisation technologies, are only used with your consent unless an exemption applies.

Our Cookie Policy contains a detailed overview of the cookies and browser storage items used on our website, including:

• hl_consent;
• wp-wpml_current_language;
• wordpress_logged_in_[hash];
• PHPSESSID;
• _hjSessionUser_[id];
• hla_vid;
• hydra_visitor;
• headless_chat_visitor_id;
• headless_chat_session_id;
• headless_chat_lead_id;
• hydraloop-theme;
• hla_sid;
• headless_chat_open;
• headless_chat_pages;
• headless_chat_triggered;
• headless_chat_exit_triggered;
• headless_intent_level;
• headless_intent_score;
• headless_hj_captured.

For full details, see our Cookie Policy.

9. Automated decision-making, lead scoring and personalisation

Hydraloop does not use personal data for automated decision-making that produces legal effects or similarly significant effects on individuals.

We may use limited analytics, segmentation, intent scoring, lead scoring or website personalisation to understand interest in Hydraloop products, improve website content, prioritise follow-up or show more relevant website elements.

Such processing does not automatically determine whether you can purchase a product, receive support, enter into a contract or access essential services.

10. Who do we share personal data with?

We may share personal data with:

• Hydraloop group companies or affiliated entities;
• authorised Hydraloop staff;
• dealers, distributors, installers, service partners or other commercial partners, where needed to respond to your request or provide services;
• IT, hosting, cloud and security providers;
• CRM, form, chat, email, marketing, analytics and support service providers;
• logistics, installation, maintenance or service providers;
• payment, accounting, legal, tax, insurance and professional advisers;
• public authorities, regulators or courts where required by law;
• potential buyers, investors or advisers in the context of a business transaction, merger, financing, restructuring or acquisition.

We only share personal data where there is a valid reason and appropriate safeguards are in place.

Where a service provider processes personal data on our behalf, we enter into a data processing agreement where required.

Key categories of service providers currently include:

• Hosting and infrastructure: Hydraloop-managed servers (Netherlands);
• CRM and email marketing: ActiveCampaign (United States);
• AI services for chat: OpenAI (United States);
• Analytics and behaviour insights: Hotjar (European Union);
• Anti-spam and security: Google reCAPTCHA (United States);
• Consultation scheduling: Calendly (United States);
• Forms: Gravity Forms, self-hosted (Netherlands).

11. International transfers

Some Hydraloop entities, service providers or business partners may be located outside the European Economic Area.

Where personal data is transferred outside the EEA, we ensure that appropriate safeguards are in place in accordance with applicable data protection law. These safeguards may include:

• an adequacy decision by the European Commission;
• Standard Contractual Clauses;
• additional technical, contractual or organisational measures where required;
• another lawful transfer mechanism under applicable law.

Hydraloop uses the following service providers located outside the EEA:

• ActiveCampaign (United States) — email marketing and CRM;
• OpenAI (United States) — AI-powered chat functionality;
• Google (United States) — reCAPTCHA anti-spam protection;
• Calendly (United States) — consultation scheduling.

Personal data may also be shared with Hydraloop Inc. (United States) and Hydraloop MENA LLC-FZ (United Arab Emirates) in connection with commercial activities, customer support or service delivery.

For US-based providers covered by the EU-U.S. Data Privacy Framework, the European Commission's adequacy decision serves as the transfer mechanism. For other transfers, Standard Contractual Clauses or another appropriate safeguard applies.

12. How long do we keep personal data?

We do not keep personal data for longer than necessary for the purposes for which it was collected, unless a longer retention period is required by law or needed to protect our legal interests.

The table below provides indicative retention periods.

13. Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

These measures may include:

• access controls;
• secure systems;
• encryption or pseudonymisation where appropriate;
• logging and monitoring;
• staff confidentiality obligations;
• supplier due diligence;
• data processing agreements;
• internal security procedures;
• incident response procedures.

No system is completely secure. If you believe your data or interaction with Hydraloop is no longer secure, please contact us at privacy@hydraloop.com.

14. Your privacy rights

Depending on your location and applicable law, you may have the following rights:

• the right to access your personal data;
• the right to correct inaccurate or incomplete data;
• the right to request deletion of your data;
• the right to restrict processing;
• the right to object to processing;
• the right to data portability;
• the right to withdraw consent where processing is based on consent;
• the right to lodge a complaint with a supervisory authority.

To exercise your rights, please contact us at:

privacy@hydraloop.com

We may ask you to provide additional information to verify your identity before responding to a request.

15. Right to object to direct marketing

You have the right to object to the processing of your personal data for direct marketing at any time.

You can unsubscribe from marketing emails by using the unsubscribe link in the email or by contacting us at privacy@hydraloop.com.

After you unsubscribe, we may retain limited information necessary to ensure that we respect your opt-out.

16. Supervisory authority

If you are located in the Netherlands, you may lodge a complaint with the Dutch supervisory authority:

Autoriteit Persoonsgegevens

www.autoriteitpersoonsgegevens.nl

If you are located elsewhere in the European Economic Area, you may also contact your local data protection authority.

17. Children

Our website, products and services are not directed at children.

We do not knowingly collect personal data from children through our website. If you believe that a child has provided personal data to us, please contact us so we can take appropriate action.

We do not knowingly collect personal data from children under the age of 16. If you believe that a child under 16 has provided personal data to us, please contact us at privacy@hydraloop.com so we can take appropriate action.

18. Third-party websites and platforms

Our website may contain links to third-party websites, platforms or services. We are not responsible for the privacy practices, security or content of those third parties.

We recommend that you read the privacy policies of any third-party websites or services you visit.

19. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example when we change our website, products, services, data processing activities, suppliers or legal requirements.

The latest version will always be available on our website.

Last updated: May 2026. We may notify you of material changes by posting a notice on our website.