Privacy Policy

1. Scope

This privacy policy explains how Sailient Group collects and uses personal data through this website (sailientgroup.com), including data you provide when you contact us or apply for a role with us. It does not cover our products (Nexus, Sentinel, Atlas) — see Section 8. This website is not directed at children and we do not knowingly collect data relating to children.

2. Data Controller

The data controller responsible for this website is Sailient Group. Sailient Group is currently in the process of formal incorporation; the legally responsible entity, registered address, company register number and VAT ID will be published here once incorporation is complete. Until then:

See also our Legal Notice for provider identification under § 5 ECG and § 25 MedienG.

3. Categories of Personal Data We Process

We only process the categories below in relation to this marketing website — not to any product account, since this site does not offer logins or purchases.

4. How We Collect Personal Data

Directly from you: when you submit the contact form, apply through the careers page, or email us directly.

Automatically: our hosting and content-delivery provider (Cloudflare) generates standard technical logs (IP address, request metadata) as part of operating and securing the website. Where cookies or comparable technologies are used, see Section 7 and our Cookie Policy.

5. Legal Bases for Processing

Under Art. 6(1) GDPR, we rely on one or more of the following legal bases, depending on the purpose:

Art. 6(1)(d) (vital interests) and Art. 6(1)(e) (public task) are not relevant to this website's processing. We do not knowingly process special categories of data under Art. 9 GDPR through this site; if a future feature required this, we would identify the applicable Art. 9(2) exception before launch. [LEGAL REVIEW REQUIRED: confirm no special-category data is incidentally captured via free-text form fields, e.g. a cover letter.]

6. Purposes of Processing

Where a purpose above lists Technical (IP address), this means the IP address you submit the form from is stored alongside your submission. We rely on Art. 6(1)(f) GDPR for this: our legitimate interest is detecting and investigating spam, automated abuse and misuse of our forms. It is not used for profiling, advertising or tracking you across sites. If you object under Art. 21 GDPR, contact us using the details in Section 3. [LEGAL REVIEW REQUIRED: confirm this balancing test and the retention period below are adequately documented before this policy is treated as final.]

A finalized retention schedule will replace the [TO BE CONFIRMED] values above once our data processing operations are formally documented (see Section 10).

7. Cookies and Similar Technologies

We use a consent banner (see Cookie Policy) that distinguishes strictly necessary technologies from optional ones, in line with § 165(3) TKG 2021 (the Austrian implementation of the ePrivacy Directive, which governs access to end-user devices — not the GDPR's consent rules directly). Strictly necessary technologies, such as storing your cookie preference itself, do not require consent because they are essential to a service you actively request. Optional technologies require your prior, informed consent.

This site loads a Cloudflare Web Analytics beacon script (served from static.cloudflareinsights.com) for aggregate traffic measurement. Per Cloudflare's own documentation this beacon is designed to operate without cookies or persistent client-side identifiers. [LEGAL REVIEW REQUIRED] whether this nonetheless constitutes "access to end-user equipment" under § 165(3) TKG 2021 requiring consent, or falls under the strictly-necessary/no-device-access exception — the marketing/statistics category in our consent banner is kept available and inactive-by-default until this is confirmed. No marketing or advertising cookies are currently in use.

8. Disclosure to Third Parties & Processors

We share personal data with third parties only where necessary for the purposes in Section 6, or where you have consented. We do not sell personal data.

We require any processor we engage to protect personal data under a written agreement and to process it only on our documented instructions.

9. International Data Transfers

Cloudflare operates a global network, which means requests to this website may be handled at data centers outside the European Economic Area (EEA) as part of normal content delivery, even where stored data (e.g. form submissions in Cloudflare KV) is configured for EU-region storage. Where personal data is transferred to a country without an adequacy decision under Art. 45 GDPR, we rely on appropriate safeguards under Art. 46 GDPR, such as the EU Standard Contractual Clauses, as provided by our processor. [LEGAL REVIEW REQUIRED]: confirm and document, per processor, (a) which countries are involved, (b) which Art. 46 safeguard applies, and (c) whether supplementary measures are needed following the CJEU's "Schrems II" standard.

Our products (Nexus, Sentinel, Atlas) are governed by separate, product-specific terms and — once in production — are planned to be hosted with providers in Austria and Germany; this is a roadmap commitment, not a current operational fact, and will be confirmed in product-specific documentation once verified.

10. Data Retention

[RETENTION PERIOD TO BE CONFIRMED] for each purpose in Section 6. As a general principle, we retain personal data only for as long as necessary to fulfil the purpose it was collected for, including any applicable statutory retention obligations under Austrian commercial or tax law, after which it is deleted or anonymized. Job application data that does not result in an offer is deleted or anonymized within a defined period once finalized; contact inquiries are retained only as long as needed to resolve them, unless a longer period is required to establish, exercise or defend legal claims.

11. Data Security

We apply technical and organizational measures (TOMs) to protect personal data against loss, misuse and unauthorized access. Measures currently in place for this website include: TLS/HTTPS encryption in transit (HSTS enforced), a Content Security Policy and standard security headers, and Cloudflare's platform-level DDoS and web application protections. [TO BE CONFIRMED / LEGAL REVIEW REQUIRED]: formal documentation of access-control policy (e.g. role-based access, multi-factor authentication for administrative access), logging and monitoring scope, backup policy, and a written incident response procedure — these are expected to be formalized alongside incorporation and are not yet documented as TOMs in the Art. 32 GDPR sense. Should a personal data breach occur, we will notify the competent supervisory authority within 72 hours where legally required under Art. 33 GDPR, and affected individuals under Art. 34 GDPR where the risk threshold is met.

12. Automated Decision-Making & Profiling

We do not currently use automated decision-making or profiling that produces legal or similarly significant effects on you within the meaning of Art. 22 GDPR, on this website or in our recruitment process (see Section 13). If this changes, we will update this policy in advance and describe the logic involved, its significance, and the safeguards and rights that apply, including the right to obtain human intervention.

13. Use of AI in Recruitment

We do not currently use AI tools to screen, score or make decisions about job applications. Applications submitted through our careers page are stored and reviewed by our team directly; no automated system decides whether an application progresses. If we introduce AI-assisted tools into recruitment in the future, we will update this policy beforehand to describe the tool, the extent of human review, your rights under Art. 22 GDPR, and any applicable requirements under the EU AI Act and Austrian labor law (e.g. works council co-determination, where applicable). We will not claim human oversight of a process that has not actually been implemented.

14. Your Rights

Subject to the conditions set out in the GDPR, you have the right to:

• Access the personal data we hold about you (Art. 15 GDPR)
• Rectification of inaccurate or incomplete data (Art. 16 GDPR)
• Erasure of your personal data, in certain circumstances (Art. 17 GDPR)
• Restriction of processing, in certain circumstances (Art. 18 GDPR)
• Data portability, for data you provided under consent or a contract (Art. 20 GDPR)
• Object to processing based on our legitimate interests (Art. 21 GDPR)
• Withdraw consent at any time, without affecting the lawfulness of prior processing (Art. 7(3) GDPR)
• Rights related to automated decision-making, where applicable (Art. 22 GDPR — see Section 12)

Under Austrian law, § 1 DSG additionally grants a constitutional-level right to secrecy of personal data ("Grundrecht auf Datenschutz"), which underlies the rights above. To exercise any of these rights, contact info@sailientgroup.com. We may need to verify your identity before acting on a request. We aim to respond within one month, extendable by a further two months for complex requests, in which case we will inform you.

15. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority, in particular the Austrian Data Protection Authority (Österreichische Datenschutzbehörde, "DSB"), if you believe our processing infringes the GDPR:

We would appreciate the chance to address your concern directly first — please contact us at info@sailientgroup.com before lodging a complaint, though you are not required to do so.

16. Links to Third-Party Websites

This website may link to third-party websites, including our own product sites (Nexus, Sentinel, Atlas) and platforms like GitHub, LinkedIn or X where noted. We do not control these third-party sites and are not responsible for their privacy practices. We encourage you to read the privacy policy of every website you visit.

17. Changes to This Policy

We keep this privacy policy under regular review and may update it as our processing activities, incorporation status, or applicable law changes. Material changes will be reflected in the "Last updated" date below.

18. Governing Law & Jurisdiction

This policy is governed exclusively by Austrian law. Place of jurisdiction: Salzburg, Austria. See also our Terms of Use and Legal Notice.

Last updated: August 25, 2026