Privacy and cookie policy

1. Data controller

The controller of your personal data is Michał Siemienowicz, running a business under the name Harvve Michał Siemienowicz, Polish tax ID (NIP) 5423140610.

For any matters concerning personal data, contact us at: hello@harvve.com.

2. What data we process

• Data from email and phone correspondence: name or company name, email address, phone number and the content of your message.
• Technical data recorded automatically in server logs: IP address, date and time of the request, the page visited, browser and operating system type.
• Analytics data - only with your consent: information on how you use the site, your device and approximate location, collected with Google Analytics 4.

Providing data in correspondence is voluntary but necessary for us to answer your inquiry.

3. Purposes and legal bases

• Handling inquiries and preparing offers - Art. 6(1)(b) GDPR (steps prior to entering into a contract) and Art. 6(1)(f) GDPR (our legitimate interest in conducting business correspondence).
• Ensuring the security and proper operation of the site (server logs) - Art. 6(1)(f) GDPR (our legitimate interest in protecting the site against abuse and attacks).
• Traffic statistics and analysis - Art. 6(1)(a) GDPR (consent given in the cookie banner).
• Establishing, exercising or defending legal claims - Art. 6(1)(f) GDPR.

4. Cookies and similar technologies

The site uses cookies and browser storage (localStorage). Analytics cookies are set only with your consent.

• Necessary - cc_cookie stores your cookie choices (about 6 months); browser storage also keeps your selected theme (light/dark) and site language. No consent required.
• Analytics (Google Analytics 4) - _ga and _ga_<id> distinguish users and sessions (up to 2 years). Set only with your consent.

You can change or withdraw your consent at any time in the cookie settings linked in the site footer, and delete cookies in your browser settings.

5. Retention periods

• Correspondence - for as long as needed to handle the inquiry, then until any claims become time-barred or for the period required by law.
• Server logs - up to 30 days.
• Analytics data in Google Analytics 4 - 2 months.
• Cookies - for the periods listed in section 4.

6. Recipients and transfers outside the EEA

We entrust data to processors only to the extent necessary to run the site and under data processing agreements:

• Hetzner Online GmbH (Germany) - website hosting and server logs.
• OVH SAS (France) - email services.
• Google Ireland Limited (Ireland) - Google Tag Manager and Google Analytics 4, only with your consent.

Hetzner and OVH process data within the European Economic Area. When Google services are used, data may be transferred to Google LLC in the United States. Google LLC participates in the EU-US Data Privacy Framework, and transfers are based on the European Commission adequacy decision of 10 July 2023 (Art. 45 GDPR) and, additionally, on standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR).

7. Security

We use appropriate technical and organizational measures to protect data against unauthorized access, loss or alteration. We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you.

8. Your rights

You have the right to access your data, rectify it, erase it, restrict its processing, port it, and object to processing based on legitimate interest.

You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warsaw, Poland).

9. Changes to this policy

We may update this policy. The current version is always available on this page.