Privacy Policy

This policy applies only to the showcase website hyvi.io. Personal data processing carried out on other services or platforms published by HYVI LDA is described in their own privacy policies, including:

• Blockunity : terms of use ; privacy policy
• Business API : terms of use ; privacy policy
• Stockunity : terms of use ; privacy policy
• MagicEdge : terms of use ; privacy policy

The data controller within the meaning of Article 4(7) of the GDPR is:

• Company: HYVI LDA, a company incorporated under Portuguese law
• Registered office: Rua João Domingos Bontempo 117, 4445-476 Ermesinde, Portugal
• NIF/NIPC (tax ID): 516901559
• EU VAT number: PT516901559
• Email: contact@hyvi.io

No data protection officer has been appointed, as such an appointment is not mandatory given our activities (Article 37 of the GDPR). Any question about your data may be sent to the email address above.

The table below summarises the processing carried out on this website. Each activity is then described in detail.

1. Contact form

When you use the contact form, we collect your name, your email address, the topic and type of your request (chosen from lists), your message and the display language of the website. This data is sent by email (SMTP) to contact@hyvi.io; the internal email also records the time of receipt. It is used solely to handle and answer your request, and is kept for 12 months after the last exchange and then deleted.

The form is protected against automated submissions by three mechanisms:

• Google reCAPTCHA v3, loaded only after your specific consent, given on the form itself and based on Art. 6(1)(a) GDPR and Art. 5(3) of the ePrivacy Directive. Without that consent no Google script or cookie is set, but the form cannot be submitted; you may instead write to us directly at contact@hyvi.io, with no tracker involved. If you accept, Google Ireland Ltd (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC (United States) process your IP address and interaction data with the page, and set the _GRECAPTCHA cookie (duration: 6 months) to tell a human visitor from a bot. The resulting score does not form the basis of any decision producing legal effects concerning you; it is used solely to reject abusive submissions. See Google’s privacy policy.
• A “honeypot” field, invisible to visitors and designed to trap bots. It collects no data about you.
• Rate limiting: at most 5 submissions per 10-minute period and per IP address. The counter is kept in the server’s memory, is not persisted and is lost on restart.

2. Server logs

The web server (nginx) hosted at OVH records, for each request, the IP address, the requested URL, the browser’s user agent and the timestamp. These logs are essential for detecting security incidents and diagnosing failures; they are kept for 14 days through automatic rotation and then erased.

3. Audience measurement (Umami)

We use Umami, an audience measurement tool self-hosted on our own infrastructure (an instance operated by HYVI LDA), without cookies and with IP address anonymisation. The script is only loaded after your “analytics” consent, given through the banner. Statistics are aggregated and kept for 13 months at most. You may withdraw your consent at any time through the “Manage cookies” link in the footer; withdrawal reloads the page so that the already-initialised script is fully disabled.

4. Display language

The NEXT_LOCALE cookie remembers the language in which you browse the website for 12 months. Being strictly necessary to provide the service you request, it is exempt from consent under Article 5(3) of the ePrivacy Directive.

5. Consent choices

Your decisions (one per purpose: analytics for audience measurement, captcha for reCAPTCHA) are stored in your browser’s local storage under the hyvi-consent key for 6 months, in line with the guidelines of the French supervisory authority (CNIL, deliberation 2020-092). This storage lets us honour your choices and keep proof of them. You may change them at any time through the “Manage cookies” link in the footer or the withdrawal button shown on the contact form. The full list of trackers is set out in our cookie policy.

6. Resuming the home film

When you change language from within the home-film player, a hyvi-film key is written to your browser’s session storage. It only keeps the playback position, the chosen route and the sound state for the time needed to reload the page in the new language. It is never sent to the server, is read and immediately erased on the next load, and disappears when the tab is closed. Being strictly necessary for the continuity of the playback you request, this storage is exempt from consent.

Your data is processed by the authorised staff of HYVI LDA. It is also accessible to the following processors, within the meaning of Article 28 of the GDPR, strictly to the extent required for their task:

• OVH SAS (2 rue Kellermann, 59100 Roubaix, France): hosting of the website and of the server logs, within the European Union.
• Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, United States): content delivery network (CDN), web application firewall and TLS termination. Cloudflare handles the traffic data (IP address, HTTP requests) needed to deliver and protect the website.
• Hostinger International Ltd. (61 Lordou Vironos Street, 6023 Larnaca, Cyprus): SMTP relay used to deliver contact form messages to contact@hyvi.io. Hostinger processes the content of those messages as a delivery provider, within the European Economic Area.
• Google Ireland Ltd / Google LLC: reCAPTCHA v3 service, only if you have consented to it on the contact form.

We do not sell or rent your personal data, nor do we share it with any advertising network. It may however be disclosed to the competent authorities where the law so requires.

The website is hosted in the European Union (OVH, France). Two processors may nevertheless process data from the United States:

• Cloudflare, Inc., for the traffic data described above;
• Google LLC, for reCAPTCHA, if and only if you have consented to it.

In accordance with Chapter V of the GDPR, these transfers are covered by the European Commission’s adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, under which both companies are certified, as well as by the standard contractual clauses adopted by the Commission (Decision 2021/914), which are incorporated into their data processing terms. You may obtain a copy by writing to contact@hyvi.io.

Under Articles 15 to 22 of the GDPR and Portuguese Law No. 58/2019, you have the following rights:

• Right of access (Art. 15): obtain confirmation that your data is being processed and receive a copy of it.
• Right to rectification (Art. 16): have inaccurate data corrected or incomplete data completed.
• Right to erasure (Art. 17): obtain the deletion of your data, under the conditions laid down by the Regulation.
• Right to restriction of processing (Art. 18): request that the use of your data be temporarily frozen.
• Right to data portability (Art. 20): receive the data you provided to us in a structured, commonly used and machine-readable format.
• Right to object (Art. 21): object, on grounds relating to your particular situation, to processing based on our legitimate interest.
• Right to withdraw consent (Art. 7(3)): at any time, without affecting the lawfulness of prior processing, via the “Manage cookies” link in the footer or the withdrawal button on the contact form.
• Post-mortem instructions: set out instructions regarding the fate of your data after your death, in accordance with Law No. 58/2019 and, where applicable, the law of your State of residence.

We make no decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you (Art. 22).

To exercise these rights, write to us at contact@hyvi.io, stating the right you are relying on. We will reply within one month of receiving your request; this period may be extended by two months for complex requests, in which case you will be informed. Where we have reasonable doubts about your identity, we may ask you for proof of identity, which will be destroyed once the check is complete.

If you consider that the processing of your data infringes the applicable rules, you may lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD): https://www.cnpd.pt.

You may also contact the supervisory authority of the Member State of your habitual residence, place of work or place of the alleged infringement (Art. 77 of the GDPR), for example the CNIL in France (www.cnil.fr).

We implement technical and organisational measures appropriate to the risk, in accordance with Article 32 of the GDPR:

• encryption of all communications in transit (HTTPS / TLS) and protection of the website by a web application firewall;
• data minimisation: only the data strictly necessary for each purpose is collected, and no user account is created on this website;
• hosting in the European Union with a certified provider, with access restricted to authorised persons only;
• short retention periods and automatic erasure of logs.

In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will inform you under the conditions set out in Article 34 of the GDPR.

We may amend this policy to reflect changes to the website, to the applicable rules or to our processors. The version in force is the one published on this page; the date of the last update appears at the top. In the event of a substantial change to the processing activities, a specific notice will be displayed on the website.

For any question about this policy or your personal data, you may write to us at contact@hyvi.io.