Cookie policy

A tracker is any technique that reads or writes information on your device (computer, tablet, phone) when you visit a website. This policy covers two of them:

• Cookies: small text files placed by the website you are visiting (first-party cookies) or by an external service it calls upon (third-party cookies). They are sent back to the server with every request and disappear when they expire or when you delete them.
• Local storage (localStorage): a browser storage area, specific to the website, that is never sent to the server. It remains on your device until you clear your browsing data or, in the case of session storage (sessionStorage), until you close the tab.

Under Article 5(3) of Directive 2002/58/EC (the “ePrivacy Directive”) and Regulation (EU) 2016/679 (the “GDPR”), writing or reading a tracker requires your prior consent, unless the tracker is strictly necessary to provide the service you have requested or to carry out a communication. The table in section 3 states, for each tracker, whether it falls under that exemption.

The data controller, within the meaning of Article 4(7) of the GDPR, is:

HYVI LDA
Rua João Domingos Bontempo 117, 4445-476 Ermesinde, Portugal
Tax ID (NIF/NIPC) 516901559
EU VAT PT516901559
contact@hyvi.io

Audience-measurement trackers are operated by us, on our own infrastructure. The only third-party tracker on the website, Google reCAPTCHA, is described in section 4.

The website hyvi.io uses only five trackers. It has no customer account, no newsletter, no online payment and no advertising network: no advertising, profiling or social-network tracker is placed on your device.

1. Strictly necessary trackers

These trackers are essential to the operation of the website or to the storage of your choices. They are exempt from consent and cannot be disabled from the banner.

2. Audience measurement (subject to consent)

We measure traffic on the website with Umami, an open-source tool that we host ourselves. It is only loaded once you have agreed in the banner (“audience measurement” purpose); without that agreement, no measurement script is executed and no data is collected.

These statistics are used solely to understand how the website is used and to improve it. They are neither sold, nor shared with third parties, nor used for advertising purposes.

3. Contact-form protection (subject to dedicated consent)

The form on the Contact page is protected against automated submissions by Google reCAPTCHA v3. This service is loaded only on that page and only after you have clicked the “Enable bot protection (Google reCAPTCHA)” button. This choice is separate from the audience-measurement one: accepting one does not mean accepting the other.

Until you enable this protection, no Google script is loaded and no Google cookie is set. The form remains protected by measures that rely on no tracker at all (honeypot field, limit on the number of submissions per IP address).

No third-party cookie is placed on your device before your explicit consent. The only third-party provider that may set a tracker is Google, for the reCAPTCHA service described above, and only if you have enabled it on the contact page.

For this service Google acts under its own terms, which we do not control and which Google may change. We invite you to read its documentation before enabling the protection.

The other trackers on the website (NEXT_LOCALE, hyvi-consent, hyvi-film, Umami) are not transmitted to any third-party provider for its own purposes: they are issued and read by our own infrastructure, hosted in the European Union. The routing of traffic through our CDN provider is described in the privacy policy.

On your first visit, a banner invites you to accept or refuse audience measurement. Both options are offered with the same ease; the website remains fully accessible whatever your choice, and closing the banner with the Escape key counts as a refusal. No consent-based tracker is activated until you have made a choice.

The bot protection of the contact form is the subject of a separate request, displayed on the contact page itself. Each purpose is decided independently.

Your decisions are stored in your browser’s local storage (hyvi-consent), together with the date of your last choice. In line with the guidelines of the European supervisory authorities, your consent, like your refusal, is kept for a maximum of 6 months: after that period, the banner is shown to you again. It is also shown again if the list of trackers or purposes changes (new banner version), or if you use another browser or another device.

Refusing or withdrawing your consent has no effect on your access to the website. Only the contact form requires bot protection to be enabled before it can be submitted; you may otherwise write to us directly at contact@hyvi.io.

You can change or withdraw your choices at any time, as easily as you gave them:

• Consent banner: on your first visit, or again after 6 months, choose “Accept” or “Refuse” for audience measurement.
• “Manage cookies” link: located in the footer of every page of the website, it reopens the banner so that you can revise your decision. Withdrawal takes effect immediately: the page is reloaded so that the already-initialised audience measurement script is fully disabled.
• Contact form: once bot protection is enabled, the “Withdraw my reCAPTCHA consent” button displayed under the form withdraws your consent and prevents any further loading of the Google service.
• Your browser settings: you can view, delete or block cookies and local storage from your browser settings. Clearing site data also erases your consent decisions, which will then be requested again. As the _GRECAPTCHA cookie is issued by Google, deleting it through the browser is the only way to remove it before it expires.

Blocking all cookies in your browser may prevent your display language from being remembered. For instructions, refer to your browser’s help pages (Chrome, Firefox, Safari, Edge, etc.).

Some of the information processed through the trackers described above constitutes personal data within the meaning of the GDPR. The applicable legal bases are your consent (Article 6(1)(a)) for audience measurement and Google reCAPTCHA, and our legitimate interest (Article 6(1)(f)) in operating the website and honouring your choices for strictly necessary trackers.

You have the rights of access, rectification, erasure, restriction, objection and data portability, as well as the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out beforehand. You may also lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD) or with the supervisory authority of your country of residence.

How to exercise these rights, the list of our processors and the retention periods of all data handled by the website are detailed in our privacy policy.

We may update this policy to reflect a change in the trackers used, in the applicable rules or in the recommendations of supervisory authorities. The date of the last update appears at the top of the page. Where a change concerns consent-based trackers, the banner version is incremented and your consent is requested again.

For any question about the use of trackers on the website or to exercise your rights, write to us at contact@hyvi.io.