--- title: "Privacy Policy" description: "Privacy policy of Achiya Automation — how we collect, use, and protect your data. Compliant with Israeli Privacy Protection Law and Amendment 13 ←" canonical: "https://achiya-automation.com/en/privacy/" last-updated: "2026-09-15" language: "he" source: "https://achiya-automation.com" --- # Privacy Policy > Privacy policy of Achiya Automation — how we collect, use, and protect your data. Compliant with Israeli Privacy Protection Law and Amendment 13 ← מקור: https://achiya-automation.com/en/privacy/ --- - [Home](https://achiya-automation.com/en/) - Privacy Policy **Last updated:** August 28, 2026 This privacy policy describes how Achiya Automation, a sole proprietorship ("we", "our", "the Company") collects, uses, processes, and protects your personal data, in accordance with the Israeli Privacy Protection Law, 5741-1981, **Amendment No. 13 to the Law (5784-2024)**, and the Privacy Protection Regulations (Data Security), 5777-2017. By using our website and services, you consent to the terms of this policy. Please read it carefully. ## 1. Definitions The following terms shall have the meanings specified alongside them: - **"Personal Data"** — any information relating to an identified or identifiable individual, including: name, phone number, email address, IP address, device identifiers, browsing data, and location. - **"Sensitive Data"** — sensitive personal data as defined by law, including: medical information, location data, biometric identifiers, genetic data, financial activity data, sexual orientation, political opinions, party affiliation, or information about criminal offenses. **We do not collect this type of data on our website.** - **"Processing"** — any operation performed on personal data, including collection, storage, use, transfer, and deletion. - **"Data Subject"** — the individual to whom the personal data relates (you). - **"Third Party"** — any entity other than the Company or the data subject. ## 2. Data Controller & Contact Details - **Business name:** Achiya Automation - **Business type:** Sole proprietorship - **Address:** Hativat Carmeli St 10, Ashdod, Israel - **Email:** info@achiya-automation.com - **Phone:** 050-537-7060 - **Website:** achiya-automation.com ## 3. Types of Data We Collect ### 3.1 Data you provide directly (Section 11 of the Law) When filling out the contact form on our website, **providing information is voluntary and not required by law**: Field Required / Voluntary Consequence of not providing Full name Required to process your inquiry We will be unable to handle your inquiry Phone number Required to process your inquiry We will be unable to contact you Email address Voluntary No impact on handling; we can respond by phone or WhatsApp Business name/type and company size Voluntary No impact on handling your inquiry Budget, desired timeline and country Voluntary We may need to clarify fit and scope during the conversation Message content Voluntary We may need to ask additional questions Marketing consent Voluntary You will not receive marketing updates **Note:** Failure to provide the fields required for handling your inquiry will prevent us from responding to you. Fields marked "Voluntary" do not affect our ability to process your inquiry. To route and prioritize the inquiry for human review, the system also attaches the form page, source page, selected service or plan, and button source. Approximate time on page and interaction count are used in the browser to calculate an internal lead score, but are not sent as separate fields. The score does not make a final decision, reject an inquiry or replace human review. ### 3.2 Data collected automatically When browsing our website: - IP address — anonymized in Google Analytics; the server access log retains the full IP address and browser header for security, troubleshooting, and distinguishing visits - Browser type and operating system - Pages viewed and time spent - Referral source - Website performance data (Web Vitals) - Returning visit identification (via local browser storage) - An anonymous inquiry-funnel stage (for example, form start or successful delivery). The marker contains no name, phone, email, message text or form values, but the server log temporarily associates it with that visit's IP address and browser header - Affiliate-link clicks — program identifier, page, and link placement, and only while valid analytics-cookie consent exists; the destination URL is not sent ### 3.3 Data from Meta platforms (Facebook, Instagram, WhatsApp) We operate a customer service platform that connects to the Facebook Pages, Instagram accounts and WhatsApp Business numbers **owned by our clients**. A connection is established only after the client explicitly authorises it through Meta, and it can be disconnected at any time. When a client connects such an asset, we collect and process: - Details of the connected asset — its Page or account ID, name and profile picture - Messages sent to and from the connected asset, including attached files and media - Public comments posted on the connected asset's posts and ads - The sender's name and profile picture, as provided by Meta, to identify the conversation - Message timestamps and read status, to manage the queue of enquiries **Purpose:** to present all enquiries in a single interface for the client's agents, to reply to them, and to route them automatically. We act as a data processor on behalf of the client, who is the controller of those conversations. **What we do not do:** we do not sell this data, we do not use it for advertising or audience targeting, and we do not transfer it to any third party other than the infrastructure providers listed in section 5. Data from one client's asset is never accessible to another client. Disconnecting an asset, or contacting the address in section 2, deletes the data collected from it — see also our [data deletion page](https://achiya-automation.com/en/data-deletion/). ### 3.4 Data we do not collect - National ID numbers - Credit card details (payments are made by bank transfer or under a separate agreement) - Medical information or other sensitive data ## 4. Processing Purposes & Legal Basis We process personal data solely for the following purposes and on the appropriate legal basis: Purpose Legal basis Responding to inquiries and requests Consent / Performance of contract Sending price quotes Performance of contract Improving the website and services Legitimate interest Statistical analysis and performance measurement Legitimate interest / Consent Sending marketing updates Explicit consent only Compliance with legal requirements Legal obligation ## 5. Third-Party Data Sharing We may share personal data with the following parties only: ### 5.1 Service and infrastructure providers - **Hetzner Cloud GmbH (Germany)** — Server hosting and infrastructure. Germany is recognized as a country with an adequate level of protection under Regulation 2(4). Security standards: ISO 27001, SOC 2 Type II. - **Google Analytics (Google LLC, USA)** — For website traffic analysis. Data includes: pages viewed, visit duration, referral source. IP addresses are anonymized. Google is committed to the EU-US Data Privacy Framework. [Google Privacy Policy (opens in a new tab)](https://policies.google.com/privacy) - **Inquiry processing systems (n8n)** — For processing contact form submissions. Hosted on Hetzner servers in Germany. - **Cloudflare Inc. (USA)** — CDN (Content Delivery Network), security, and DDoS protection services. Cloudflare processes: IP addresses, browser data, and technical browsing information. This data is used to protect the website and improve performance. Cloudflare is committed to ISO 27001 and SOC 2 Type II standards. [Cloudflare Privacy Policy (opens in a new tab)](https://www.cloudflare.com/privacypolicy/) - **Meta Platforms, Inc. (USA)** — When a client connects a Facebook Page, Instagram account or WhatsApp Business number, messages and comments travel through Meta's infrastructure to our system and back. In addition, if no delivery confirmation is received from a website form and you explicitly choose the continue-to-WhatsApp button, the details shown beside that button are transferred to Meta when the link opens and appear as an unsent message for your review. This path never opens automatically and transfers nothing without your click. Meta is committed to the EU-US Data Privacy Framework. [Meta Privacy Policy (opens in a new tab)](https://www.facebook.com/privacy/policy/) ### 5.2 Additional cases - When required by law or court order - To protect our rights or property - With your explicit consent **Note:** We do not sell, rent, or trade your personal data to third parties for their marketing purposes. ## 6. International Data Transfers Some of our service providers are located outside of Israel: Provider Location Legal basis for transfer Hetzner Cloud Germany (EU) Country with adequate level of protection — Regulation 2(4) Google Analytics USA EU-US Data Privacy Framework Cloudflare USA (global servers) EU-US Data Privacy Framework + Standard Contractual Clauses (SCCs) We ensure that all international data transfers comply with legal requirements and include appropriate safeguards, including engagement with providers committed to international data protection standards (ISO 27001, SOC 2). ## 7. Data Retention Periods We retain personal data only for as long as necessary: Data type Retention period Contact form submissions Up to 3 years from the last inquiry Active client data Duration of engagement + 7 years Analytics data According to the active GA4 property setting; standard GA4 properties support 2 or 14 months Website access, security, anonymous funnel-stage and affiliate-click logs Up to 90 days; log files then expire through automatic rotation Marketing consents Until consent is withdrawn + 3 years for documentation At the end of the retention period, data will be deleted or anonymized in an irreversible manner. ## 8. Cookies & Tracking Technologies ### 8.1 What are cookies? Cookies are small text files stored on your device when browsing our website. They allow the site to remember preferences and improve the user experience. ### 8.2 Types of cookies that may be stored Name / Type Purpose Duration Google Analytics (_ga, _gid) Statistical traffic analysis, only after explicit consent Up to 2 years, or until consent is withdrawn and they are deleted Cloudflare security and challenge cookies Bot and attack protection and Turnstile verification on forms Depends on the challenge type and Cloudflare settings **Note:** Cloudflare, which provides CDN, security and Turnstile form verification, may place security or challenge cookies when those mechanisms run. We do not use them for marketing tracking. While valid analytics-cookie consent exists, clicking an affiliate link sends a short request to our server with the program identifier, page, and link placement. The request does not include the destination URL and is not sent without valid consent. Like any HTTP request, it appears in the access log with ordinary connection data, such as the IP address and browser details, and is retained for up to 90 days. ### 8.3 Browser storage (localStorage and sessionStorage) In addition to cookies, the site stores the following values in your browser. Most stay on your device; the exception is inquiry-source context, whose attribution fields accompany a form only if you choose to submit it: Key name Purpose Duration cookie-consent Storing your cookie preferences (which types you approved) Up to 12 months (localStorage) cookie-consent-date Date and time you gave or changed your cookie consent Up to 12 months (localStorage) a11y-preferences Your chosen accessibility preferences; kept on your device Until manually deleted (localStorage) achiya_lead_context Selected service/plan, button source and source page. If a form is submitted within 30 minutes, these attribution fields accompany it Read for up to 30 minutes; deleted when the tab closes (sessionStorage) exit-intent-dismissed Remembers dismissal of the exit offer; kept on your device Until the tab closes (sessionStorage) mobile-cta-dismissed Remembers dismissal of the mobile inquiry button; kept on your device Until the tab closes (sessionStorage) **Note:** You can delete this data at any time through your browser settings (clear site data) or developer tools. ### 8.4 Managing preferences On your first visit to the website, a cookie notice will be displayed allowing you to choose which cookies to accept. You can change your preferences at any time by: - Clicking the "Cookie Settings" button below - Your browser settings - Deleting cookies and reloading the website Cookie Settings ## 9. Data Security We implement appropriate security measures in accordance with the Privacy Protection Regulations (Data Security), 5777-2017: ### 9.1 Technical security measures - **Encryption in transit:** The website is served over HTTPS; the negotiated protocol depends on the browser, Cloudflare and the origin server - **Anonymization:** IP addresses are anonymized in Google Analytics - **Access control:** Data access is restricted on a role-based permissions basis (RBAC) - **Two-factor authentication:** Enabled in management systems that support it, according to the active configuration - **Traffic protection:** Cloudflare rules and server-level protections, with review of security logs and alerts - **Security updates:** Regular software and system updates ### 9.2 Backups - **Frequency:** Automatic backups for systems configured for backup; frequency varies by service - **Protection and access:** Backup access is restricted, and encryption is used according to provider and configuration capabilities - **Retention and location:** Determined by the system, infrastructure provider and relevant agreement ### 9.3 Logging and documentation - **Website access, funnel-stage and affiliate-click logs:** Up to 90 days, under the automatic rotation described in Section 7 - **Internal change logs and security-incident documentation:** Up to 24 months - **Access:** Restricted to authorized personnel for security and troubleshooting ### 9.4 Security incident notification In accordance with Amendment 13 to the Privacy Protection Law, in the event of a serious security incident that may cause substantial harm to your privacy: - **We will notify you within 72 hours** of discovering the incident - We will detail the type of data that was exposed - We will provide recommendations for self-protection - We will report to the Privacy Protection Authority as required under Regulation 11 ### 9.5 Business continuity Backup and recovery procedures exist for managed systems. Recovery time and recovery-point commitments are not uniform across services and are defined in a proposal or agreement when included in scope. Despite our efforts, no security system is perfect. We are committed to handling every security incident with full transparency and responsibility. ## 10. Your Rights (Under Amendment 13) Under the Privacy Protection Law and Amendment 13, you are entitled to the following rights: - **Right of access:** To review the personal data we hold about you - **Right of correction:** To request correction of inaccurate or incorrect data - **Right of deletion:** To request deletion of your data (subject to legal obligations) - **Right to object:** To object to data processing for marketing purposes - **Right to withdraw consent:** To withdraw consent you have given at any time - **Right to restrict processing:** To request restriction of processing under certain circumstances - **Right to data portability:** To receive the data you provided to us in a readable and structured format (such as CSV or JSON) - **Right to be notified of data breaches:** To be informed if a security incident affects your data **To exercise your rights:** Send a request to info@achiya-automation.com with the following details: - Your full name - Identifying information (phone number or email you provided) - Description of your request We will respond to your request within 30 days as required by law. ### 10.2 Data deletion Upon a deletion request or termination of engagement: - **Active systems:** Deletion will be completed within up to 30 days, subject to identity verification and legal retention duties - **Backups:** The data will be removed in the next backup rotation and no later than 90 days, subject to legal retention duties - **Method:** Data will be removed from systems under our control according to each system's deletion capabilities - **Confirmation:** Written confirmation will be sent after completion has been verified Note: Data that must be retained by law (such as invoices for 7 years) will be kept in accordance with the law. ## 11. Minors Our services are intended for business owners and are not directed at minors under the age of 18. We do not knowingly collect personal data from minors. If you become aware that a minor has provided us with personal data, please contact us and we will delete the data immediately. ## 12. Filing a Complaint If you believe your privacy has been violated, please contact us first at info@achiya-automation.com and we will endeavor to resolve the matter. If you have not received an adequate response, you may file a complaint with the Privacy Protection Authority: **The Privacy Protection Authority** Ministry of Justice Website: [www.gov.il/he/departments/the_privacy_protection_authority (opens in a new tab)](https://www.gov.il/he/departments/the_privacy_protection_authority) ## 13. Policy Changes We may update this policy from time to time. Material changes will be published on the website with appropriate notice. The last update date appears at the top of this document. Continued use of the website after a policy update constitutes acceptance of the changes. ## 14. Contact Us For questions, requests, or complaints regarding this privacy policy or the processing of your data: - **Email:** info@achiya-automation.com - **Phone:** 050-537-7060 - **WhatsApp:** [Send a message (opens in a new tab)](https://wa.me/972505377060?text=Hi%20Achiya%2C%20I%20have%20a%20privacy-related%20inquiry) ## 15. Governing Law This privacy policy is governed by the laws of the State of Israel, in particular the Privacy Protection Law, 5741-1981 and its regulations. Exclusive jurisdiction shall be vested in the competent courts in Israel. --- סיכום האתר לסוכנים: https://achiya-automation.com/llms.txt · כל העמודים: https://achiya-automation.com/sitemap-index.xml · API: https://achiya-automation.com/openapi.json