Privacy Policy

1. Controller

The controller responsible for processing personal data through this website is:

Matti Yohannes, trading as Onyx AI Agents
Germany
Email: matti@onyxaigents.com

For postal correspondence or formal notices, request the current service address by email. No data protection officer has been appointed because the statutory appointment requirements do not currently apply.

2. What data we process

Website access and security logs

When you access the site, the hosting provider may process technical information such as your IP address, date and time of access, requested URL, referrer, browser, operating system, device information, and response status. This is necessary to deliver the site, maintain security, prevent abuse, and diagnose errors.

Legal basis: Article 6(1)(f) GDPR. The legitimate interests are reliable delivery, technical security, fraud prevention, and service improvement.

Strategy-call bookings

The site embeds and links to Cal.com. If you book a call, Cal.com processes the information you submit, which may include your name, email address, company, answers to booking questions, selected time, timezone, and meeting metadata. We use this information to respond to your request, assess fit, schedule the meeting, and take steps toward a possible contract.

Legal basis: Article 6(1)(b) GDPR for steps requested before entering a contract and Article 6(1)(f) GDPR for business communication and scheduling. Cal.com may place necessary storage items or cookies for the booking interface. Its own policy applies to processing performed independently by Cal.com.

Direct communications

If you contact us by email, LinkedIn, video call, or another channel, we process the contact details, message content, call notes, and related business information needed to respond and manage the relationship.

Legal basis: Article 6(1)(b) GDPR where the communication concerns a prospective or existing contract, and otherwise Article 6(1)(f) GDPR.

Prospecting and B2B outreach

In the course of providing outbound services, Onyx AI Agents may process professional contact information relating to business decision-makers, including name, role, employer, professional email address, company profile, and publicly available professional information. The source may be a client's records, business directories, company websites, professional networks, or specialist data providers. Such processing is limited to relevant B2B communications and the delivery of contracted services.

Legal basis: Article 6(1)(f) GDPR. Legitimate interests include B2B business development and fulfilling client engagements. Individuals may object at any time.

3. Service providers and recipients

Personal data may be made available only where necessary to:

• Vercel, for website hosting, content delivery, security, and technical logs;
• Cal.com, for scheduling and operating the embedded booking interface;
• Google, because the website currently retrieves the DM Sans web font from Google Fonts when a page loads;
• email, video-conferencing, CRM, document, payment, accounting, and infrastructure providers used for business operations;
• professional advisers, public authorities, or courts where disclosure is legally required or needed to establish, exercise, or defend legal claims;
• clients, where professional contact data is processed in order to perform an agreed outbound engagement.

Providers acting on our behalf are engaged subject to appropriate data-protection terms where required.

4. International transfers

Some providers may process data in the United States or other countries outside the European Economic Area. Where required, transfers rely on an adequacy decision, participation in the EU–US Data Privacy Framework, the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism. Additional information may be requested using the contact details above.

5. Retention

We retain personal data only for as long as needed for the purpose for which it was collected and to meet legal obligations:

• technical logs are generally kept for a short security and troubleshooting period determined by the hosting provider;
• unsuccessful sales enquiries are generally reviewed and deleted or anonymised after 24 months unless continued retention is justified;
• contract, invoice, and accounting records are retained for the periods required by applicable commercial and tax law;
• suppression records may be kept to ensure that an opt-out continues to be honoured;
• data involved in legal claims may be retained until the relevant limitation periods expire.

6. Cookies and local storage

Onyx AI Agents does not currently operate its own advertising analytics or behavioural-tracking system on this site. The embedded Cal.com booking interface and externally loaded services may use cookies or comparable browser storage necessary to provide their features. You can also open Cal.com in a separate tab using the fallback link beneath the booking area.

7. Your rights

Subject to the conditions in the GDPR, you may request access, correction, deletion, restriction of processing, data portability, or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw consent at any time without affecting earlier lawful processing.

To exercise a right, email matti@onyxaigents.com. We may request information needed to verify your identity. You also have the right to lodge a complaint with the supervisory authority in the EU/EEA country of your habitual residence, place of work, or the place of the alleged infringement.

8. Automated decisions

The website does not make decisions producing legal or similarly significant effects solely through automated processing. Any fit assessment or commercial decision is reviewed by a person.

9. Security

We use reasonable technical and organisational measures appropriate to the risk, including encrypted transmission, access controls, limited provider access, and service monitoring. No internet transmission or storage system can be guaranteed completely secure.

10. Updates

This policy may be updated when the website, service providers, or legal requirements change. The current version will remain available at this URL.

Effective date: 26 August 2026