Privacy Policy

Who we are and what this policy covers

Threegate Business Technology LLC ("Threegate," "we," "us," or "our") provides HYDRA Complete Commerce Management and operates hydraccm.com. This policy explains how we handle information received through this website and in connection with our business services, including qualifying deidentified data products.

Customer agreements and any applicable data processing agreement define the instructions, permissions, and obligations for customer service data. This policy does not amend those agreements, grant new data rights, or override binding prior privacy commitments. Where an applicable signed data processing agreement governs personal data, that agreement controls any conflict concerning that processing.

Information on this website

Demo requests, quotes, and email

If you contact us, we receive the information you choose to send, such as your name, company, email address, telephone number, requested service, and message. We use it to respond, arrange demonstrations, prepare quotes, provide support, and manage the resulting business relationship.

The website's demo and quote forms prepare a message in your email application. Completing a form does not send a request to Threegate through the website. You must review and send the email to complete your request. Your email provider also processes the message under its own terms. Please do not include passwords, payment-card details, or unnecessary sensitive personal information in a request.

Technical information and tracking

When you access the website, hosting and network systems may process technical information needed to deliver and protect the site, such as your IP address, requested page, browser information, and request time.

This public marketing website does not use analytics cookies, advertising pixels, or cross-site behavioral tracking. Its current pages do not set browser cookies or use browser local storage. The logged-in HYDRA application and external services are separate from these marketing pages; their operation and applicable terms may differ.

External links

Links to payment processing, the HYDRA login, and other external services take you to separate services. Information you provide there is handled under the applicable provider's terms and privacy notices.

Customer service data

HYDRA may process data submitted by or on behalf of a business customer, including account and contact information and records concerning orders, purchases, sales, returns, payments, products, quantities, prices, discounts, inventory movements, and related commerce activity. The categories depend on the customer's use of the service.

As between Threegate and the customer, the customer retains its rights in its data, subject to the applicable agreement and the rights of individuals and third parties. We access, host, copy, process, transmit, and use customer data to provide, support, secure, and maintain the service, carry out documented instructions, and undertake other activities expressly authorized by the applicable agreement and law.

Where we act as a processor or service provider for personal data, we process it on the customer's documented instructions and within the limits of applicable law and any required data processing agreement. Customers are responsible for having authority to provide their data and for required notices, permissions, and other lawful bases for the processing they authorize.

Qualifying deidentified data and analytics

Where the applicable customer agreement and law authorize it, we may derive deidentified and, where necessary, aggregated information from customer data for product improvement, analytics, benchmarking, industry research, commercial reports, and licensed data products.

We treat information as qualifying deidentified data only when it meets applicable standards and cannot reasonably be used, alone or with other reasonably available information, to identify or infer information about an individual or household, identify a customer or another merchant, or disclose their identifiable confidential business information. Removing names, replacing identifiers with codes, hashing information, or labeling a record "non-PII" does not by itself satisfy this standard.

Safeguards include removing or transforming identifiers and, where needed, suppressing or generalizing small groups, unusual transactions, precise locations, timestamps, and other identifying attributes. We assess reidentification risk before release and periodically afterward.

We publicly commit to maintain and use qualifying deidentified data in deidentified form and not to attempt reidentification, except for lawful testing of our deidentification safeguards where permitted by law. Before providing such data to recipients, we require contractual safeguards prohibiting reidentification, identification of the customer or merchant, and onward disclosure without equivalent restrictions. If information no longer qualifies, we stop using or disclosing it under those deidentified-data rights and remediate or delete it as required.

Continuing rights in qualifying deidentified data depend on the applicable agreement and law. They do not authorize indefinite retention of identifiable source records or the sale or disclosure of identifiable customer data for independent commercial purposes. This policy does not itself authorize a sale or sharing of personal data, behavioral advertising, or unrestricted pooling of identifiable records across customers.

Disclosure, confidentiality, and security

We limit access to customer data to authorized personnel and service providers with a need to know. Service providers handling customer data must be bound by written confidentiality, security, and data-use obligations consistent with the applicable agreement.

We use reasonable administrative, technical, and physical safeguards to protect customer data and maintain its confidentiality. No system can guarantee absolute security. We may disclose information when legally required, with advance notice where legally permitted, or as authorized by the applicable customer agreement and law.

Retention, return, and export

We retain inquiry and business correspondence as reasonably needed to respond, manage the relationship, keep appropriate business records, meet legal obligations, resolve disputes, and enforce agreements.

Customer data retention and export follow the applicable agreement and any data processing agreement. Under the adopted existing-customer EULA, customers have a 30-day post-termination export period using standard export functionality or a lawful alternative where access would create a security risk or is legally prohibited. The customer's controlling signed terms determine whether this provision applies.

After the applicable export period, retention may continue as reasonably necessary for legal obligations, disputes, enforcement, backups, security, and business records, subject to applicable law and contractual deletion obligations. Retained customer data remains subject to confidentiality, security, and use restrictions. Qualifying deidentified data may be retained under the applicable continuing rights and safeguards.

Questions and privacy requests

Contact [email protected] with privacy questions or requests concerning your information. Depending on your location, applicable law, and our role, you may have rights to access, correct, obtain, or delete information, or to object to, restrict, or opt out of certain processing. We evaluate requests under the law and agreements that apply and may need to verify your identity or authority. Where applicable, authorized agents may submit requests with appropriate authorization, and you may contact us to appeal a decision.

If your information was provided to a business using HYDRA, contact that business first. When we process information on its behalf, we assist or refer the request in accordance with its instructions and applicable obligations. Do not send sensitive identity documents unless we request an appropriate verification method.

Policy changes and contact

We will post updates here with a revised effective date. We provide direct written notice of material privacy-policy changes to customers as required by the applicable EULA. Changes requiring additional permission take effect only when that permission is obtained. An update does not retroactively authorize an unauthorized use or expand contractual data rights.

Threegate Business Technology LLC
Privacy contact: [email protected]
Website: hydraccm.com