HA Expert Privacy Policy (EN)

The data controller for personal data processed in connection with the use of ha-expert.com is:

Tomasz Furdal
Mosevej 2
8620 Kjellerup
Denmark

Contact (including data protection matters): kontakt@ha-expert.com

HA Expert's own analytics (described in detail in section 4) does not identify who the visitor is: it does not collect a name, email address, IP address, or any persistent identifier that would let it recognise the same person on a later visit. It only collects information about how the site is used: which sections are viewed, for how long, whether the visitor scrolls, and whether they click on the contact form. This is aggregate, anonymous behavioural statistics, not a profile of a specific person.

ha-expert.com provides expert services related to Home Assistant (diagnostics, configuration, automations, consulting). Data is processed for the purpose of:

• handling requests submitted through the contact form (legal basis: GDPR Art. 6(1)(b) - pre-contractual measures / performance of a contract);
• measuring traffic and advertising effectiveness using Google Analytics and Google Ads (legal basis: GDPR Art. 6(1)(a) - consent, for the "marketing"/"analytics" purpose selected in the banner);
• HA Expert's own anonymous analytics described in section 4 (legal basis: GDPR Art. 6(1)(a) - consent, for the "analytics" purpose).

The website and the contact form work fully even without any consent to analytics or marketing purposes - declining does not limit your ability to use the service.

• Google Analytics / Google Ads (Google Ireland Limited) - traffic and ad-effectiveness measurement, only after the relevant consent, taking Google Consent Mode into account (see section 7).
• Cloudflare - infrastructure/CDN operator and the Cloudflare Worker handling the contact form. Cloudflare's Data Processing Addendum (version 6.4, April 2026) applies automatically as part of the Self-Serve Subscription Agreement - confirmed 2026-08-27 directly in the account dashboard (no separate "Compliance"/"DPA" item to accept, in line with Cloudflare's own documentation). cloudflare.com/cloudflare-customer-dpa.
• Resend - the email delivery provider for the contact form. Resend automatically applies a pre-signed Data Processing Addendum (DPA) to every account, compliant with GDPR Article 28 - resend.com/legal/dpa, resend.com/security/gdpr.
• HA Expert's own analytics - data is stored on the controller's own infrastructure (see section 4) and is not shared with third parties.

Once consent to the "analytics" purpose is given, the system collects only:

• a random session identifier (exists only in the current browser tab's sessionStorage; not a persistent identifier across visits);
• the time of the event;
• the site language;
• the cleaned URL path (without query parameters or URL fragments);
• the referral source (e.g. Google, an ad, a direct visit) and only the presence (not the value) of selected campaign parameters;
• the country determined server-side from a trusted infrastructure header (not from a stored IP address);
• active time on the page, scroll depth, viewed sections, and named actions (e.g. clicking the contact form).

• raw IP addresses;
• the content or data of the contact form;
• the full browser identifier (User-Agent);
• a persistent identifier that would allow recognising the same user across separate visits;
• mouse movements or session recordings.

• ha_consent_v2 - stored in the browser's localStorage, holds the consent decision (the "analytics" and "marketing" purposes separately). TO BE CONFIRMED: retention period for this decision.
• the own-analytics session identifier - in sessionStorage, automatically removed when the browser tab is closed.
• Google (Analytics, Ads) cookies and similar technologies - used only after consent is given to the relevant purpose. Example categories (the exact, current list and retention periods are set by Google and may change - the full, always up to date list is published by Google at policies.google.com/technologies/cookies): advertising cookies (e.g. of the _gcl_au, _gads, _gac_ type, typically 90 days to 13 months) and analytics cookies (e.g. of the _ga type). Since 15 June 2026, a single consent signal (ad_storage) determines whether advertising data from Google Analytics reaches Google Ads.

By default the site sets all Google consent signals (ad_storage, ad_user_data, ad_personalization, analytics_storage) to "denied" before any Google script loads. After the user's decision, the signals are updated according to the purposes selected. Even when consent is declined, Google may still receive limited, cookie-less signals used for aggregate statistical modelling, in line with the Google Consent Mode mechanism - this is Google's own behaviour, not HA Expert's own analytics. HA Expert's own analytics remains completely disabled when consent to the "analytics" purpose is declined and sends no data at all.

The retention period for HA Expert's own analytics data is 180 days from the event (confirmed 2026-08-27), after which the data is permanently deleted as part of an automated schedule.

Technical status (updated 2026-08-27): implemented and tested. An automated job runs daily at 03:30 (Europe/Copenhagen time) and deletes data older than 180 days. A test confirmed correctness: a synthetic record older than 180 days was deleted, while all real data remained untouched (confirmed by comparing checksums before and after).

Data processed by Google (Analytics, Ads) may be transferred outside the EEA, based on the compliance mechanisms Google applies (standard contractual clauses and other safeguards described in Google's privacy policy). TO BE CONFIRMED: the transfer mechanism Google is using at the time of publication.

Data handled by Resend (the content of emails sent from the contact form) is stored in the USA. The transfer is covered by the Standard Contractual Clauses built into their DPA and by Resend's participation in the EU-U.S. Data Privacy Framework - resend.com/legal/dpa.

TO BE CONFIRMED: the transfer mechanism used by Cloudflare (check alongside their DPA).

You have the right to: access your data, have it corrected, have it deleted, restrict its processing, receive it in a portable format, and object to processing based on consent. Consent to the "analytics" and "marketing" purposes can be withdrawn or changed at any time using the permanent privacy settings button visible on the site - withdrawing consent is exactly as easy as giving it, and does not affect the lawfulness of processing carried out before the withdrawal. You have the right to lodge a complaint with a supervisory authority - either in the controller's home country (Denmark: Datatilsynet, datatilsynet.dk) or in your own country of habitual residence, in line with Article 77 GDPR.

Because HA Expert's own analytics does not collect any persistent identifier or data allowing direct identification, fulfilling an individual access/deletion request for a specific person may be technically limited - TO BE CONFIRMED: exact description of how such a request would be handled in practice.