Privacy
This notice covers personal data on this website. The architecture for processing palm captures and protecting stored templates is described on Trust & security.
Section 01
The controller is Hamsa Group B.V., trading as HamsaID, Johan Huizingalaan 763 A, 1066 VH Amsterdam, The Netherlands. KvK 87019434. For any question about this notice or your rights, write to info@hamsaid.com.
This notice covers the marketing website only. The HamsaID product is a separate processing context, governed by a data-processing agreement per deployment. Section 04 explains how the two differ.
Section 02
No tracking
We do not run analytics or advertising scripts. Fonts, images and scripts are served from our own domain. Submitting the contact form sends your enquiry to Formspark for email delivery; simply browsing these pages does not send a form submission.
Hosting
Our hosting provider, Cloudflare, Inc., serving this site from its global edge network, records standard request metadata for security and abuse prevention: IP address, user agent, referrer and timestamp. These are kept for 14 days, then deleted, and are never used to build a profile. Legal basis: our legitimate interest in operating a secure service (Art. 6(1)(f) GDPR).
Demo requests
When you submit the demo form, your name, work email, organisation, use case and message are sent to Formspark (Trampoline Software SRL, Belgium), which stores the submission in Ireland and forwards it to info@hamsaid.com. Formspark also receives the request metadata needed to process the submission, such as your IP address. We use your enquiry to respond to you. Legal basis: steps taken at your request before entering a contract (Art. 6(1)(b) GDPR). We keep enquiries for up to 24 months after our last exchange with you, then delete them. If a pilot is signed, your contact details move under that commercial agreement and its retention rules.
Section 03
We do not sell personal data and we do not share it for marketing purposes.
Cloudflare serves the website. Formspark, operated by Trampoline Software SRL in Belgium, processes contact-form submissions and delivers them to us by email; it stores submissions on Amazon Web Services in Ireland. Formspark publishes its own list of subprocessors and a GDPR statement. Our email provider processes the delivered enquiry so that we can respond.
We may disclose data where we are legally required to, for example in response to a binding order from a competent EU authority.
Your enquiry itself is stored and processed inside the EEA, in Ireland. Website hosting runs on Cloudflare's global edge network, so page requests may be served from outside the EEA, and where any subprocessor sits outside the EEA the transfer is covered by Standard Contractual Clauses or an equivalent mechanism under the GDPR. No biometric data is involved in any of this: it is website traffic and enquiries only.
Section 04
Where HamsaID is deployed at an airport, venue or other operator, that operator is normally the controller for the verification and Hamsa Group B.V. acts as processor under a written agreement. The architecture is designed so that raw palm captures are transformed at the sensor and overwritten before the next capture, and so that any stored template is encrypted and bound to a single context.
If you have used a HamsaID terminal and want to know what exists about you, contact the operator of that venue first, and us second. We will help either way.
Section 05
Under the GDPR you may request access to your personal data, correction, erasure, restriction and portability, and you may object to processing based on legitimate interest. Write to us and we will respond within one month.
You also have the right to complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the authority in the country where you live or work.
Section 06
We may update this notice. The date below always reflects the most recent change, and anything material will be called out on this page.
Last updated 9 September 2026.
