1. Introduction

This Policy applies to personal data we process as a data controller. Where we process personal data on behalf of a client (for example, analytics on a client’s website), we act as a data processor and the client’s privacy policy and data processing agreement will apply.

Please read this Policy carefully. By using our website or providing your personal data to us, you acknowledge that you have read and understood this Policy.

2. Data Controller & Company Information

The data controller responsible for your personal data is:

3. Personal Data We Collect

Depending on how you interact with us, we may collect the following categories of personal data:

3.1 Identity & contact data

• Full name, job title, company name;
• Email address, postal address, telephone number (if provided).

3.2 Enquiry & project data

• Information you submit via contact forms (project type, message content, how you found us);
• Correspondence, proposals, contracts and project notes;
• Billing and payment-related information (invoices, transaction references — we do not store full card details).

3.3 Technical & usage data

• IP address, browser type and version, device information, operating system;
• Pages visited, time spent, referral source and general usage patterns;
• Cookie identifiers (see Section 7).

3.4 Marketing preferences

• Your communication preferences and records of consent where required.

We do not intentionally collect special category data (e.g. health, ethnicity) unless you voluntarily provide it and we have a lawful basis to process it.

4. How We Collect Personal Data

We collect personal data through:

1. Direct interactions — when you fill in forms on our website, email us, speak with us or enter into a contract;
2. Automated technologies — cookies, server logs and analytics tools when you browse our website;
3. Third parties — such as business referrals, publicly available professional directories, or service providers (e.g. payment processors) where permitted by law.

5. Lawful Basis for Processing

Under UK GDPR, we rely on one or more of the following lawful bases:

• Consent — where you have given clear consent (e.g. non-essential cookies, optional marketing);
• Contract — where processing is necessary to perform a contract or take steps at your request before entering a contract;
• Legitimate interests — where processing is necessary for our legitimate business interests (e.g. responding to enquiries, improving our website, fraud prevention), provided your rights do not override those interests;
• Legal obligation — where we must comply with UK law (e.g. tax and accounting records).

You may withdraw consent at any time where consent is the lawful basis, without affecting the lawfulness of processing before withdrawal.

6. How We Use Your Personal Data

We use personal data to:

• Respond to enquiries and provide quotations;
• Deliver, manage and improve our Services;
• Process payments and maintain accounts;
• Communicate about projects, support and administrative matters;
• Send marketing communications where permitted (see Section 8);
• Analyse website performance and user experience;
• Comply with legal and regulatory obligations;
• Establish, exercise or defend legal claims.

We will not use your personal data for purposes incompatible with those described unless we notify you and, where required, obtain consent.

7. Cookies & Similar Technologies

Our website uses cookies and similar technologies. Cookies are small text files stored on your device. We use:

• Strictly necessary cookies — required for core site functionality (e.g. cookie consent preference);
• Analytics cookies — to understand how visitors use our site (only where you accept cookies via our banner);
• Functional cookies — to remember preferences where applicable.

When you first visit our site, a cookie banner allows you to Accept or Decline non-essential cookies. Your choice is stored in your browser’s local storage. You can also control cookies through your browser settings.

For more information about managing cookies, visit aboutcookies.org or the Information Commissioner’s Office (ICO) guidance.

8. Marketing Communications

We may send you information about our Services by email where you have opted in or where we have a legitimate interest in contacting existing business clients about similar services, and you have not opted out.

Every marketing email includes an option to unsubscribe. You may also contact us at info@harnova-solutions.com to update your preferences.

9. Data Sharing & Third Parties

We may share personal data with:

• Service providers — hosting, email, analytics, CRM, payment processing and IT support (under data processing terms where required);
• Professional advisers — lawyers, accountants or insurers where necessary;
• Authorities — regulators, courts or law enforcement when required by law.

We do not sell your personal data. We require third parties to protect your data and use it only for specified purposes.

10. International Transfers

We primarily store and process data within the United Kingdom. If we transfer personal data outside the UK, we ensure appropriate safeguards are in place as required by UK GDPR, such as:

• Transfers to countries with an adequacy regulation;
• Standard contractual clauses approved for UK transfers;
• Other mechanisms recognised under UK data protection law.

Contact us for more information about safeguards applied to specific transfers.

11. Data Retention

We retain personal data only for as long as necessary for the purposes set out in this Policy:

• Enquiries — typically up to 24 months if no contract is formed;
• Client project data — for the duration of the contract and up to 7 years thereafter for legal, tax and accounting purposes;
• Marketing data — until you unsubscribe or object, or after a reasonable period of inactivity;
• Website logs — typically up to 12 months unless required for security investigations.

When data is no longer needed, we securely delete or anonymise it.

12. Your Rights Under UK GDPR

Under UK data protection law, you have the right to:

• Access — request a copy of the personal data we hold about you;
• Rectification — request correction of inaccurate or incomplete data;
• Erasure — request deletion in certain circumstances (“right to be forgotten”);
• Restrict processing — request limitation of processing in certain circumstances;
• Data portability — receive your data in a structured, machine-readable format where applicable;
• Object — object to processing based on legitimate interests or for direct marketing;
• Withdraw consent — where processing is based on consent.

To exercise any of these rights, email info@harnova-solutions.com. We will respond within one month, which may be extended by a further two months for complex requests as permitted by law. We may need to verify your identity before processing a request.

There is no fee for most requests unless they are manifestly unfounded or excessive.

13. Children’s Privacy

If you are a parent or guardian and believe that your child has provided us with personal data without your consent, please contact us immediately at info@harnova-solutions.com. Upon verification, we will take steps to delete such information from our systems promptly.

Where we process personal data relating to children on behalf of a client (e.g. in analytics for a client’s website), the client is responsible for ensuring a lawful basis and appropriate safeguards under UK GDPR.

14. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction. These measures include:

• Secure hosting and encrypted connections (HTTPS) on our website;
• Access controls limiting data to personnel who need it;
• Strong passwords and, where available, multi-factor authentication;
• Regular review of suppliers and security practices.

No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

15. Disclaimer

Links on our website to third-party sites are not covered by this Policy. We are not responsible for the privacy practices of external websites. We encourage you to read their privacy policies before providing personal data.

16. Return & Refund Policy (Data Requests)

Requests to exercise data protection rights (access, erasure, etc.) are handled free of charge in most cases, as described in Section 12.

For refunds relating to paid Services, please refer to our Terms and Conditions (Section 13 — Refunds & Return Policy). Data protection rights and commercial refund policies are separate matters; we will clarify which applies to your request.

17. Complaints to the Information Commissioner

If you are unhappy with how we have handled your personal data, please contact us first so we can try to resolve the issue. You also have the right to lodge a complaint with the UK supervisory authority:

18. Changes to This Privacy Policy

We may update this Policy to reflect changes in law, technology or our practices. The “Last updated” date at the top indicates when revisions were last published.

Material changes will be communicated via our website or direct notice where appropriate. We encourage you to review this page periodically.

19. Contact Us

For privacy-related questions, data subject requests or concerns, contact: