HA Expert Privacy Policy

The controller of personal data processed in connection with the use of ha-expert.com is:

Tomasz Furdal
HA Expert
Mosevej 2
8620 Kjellerup
Denmark

Contact, including data protection matters: kontakt@ha-expert.com

HA Expert processes data for the following purposes:

• handling enquiries submitted through the contact form or by email and taking steps at the user's request before entering into a contract or in connection with performing a contract, under Article 6(1)(b) GDPR;
• handling other correspondence, ensuring website security and preventing abuse, where necessary for the legitimate interests of HA Expert, under Article 6(1)(f) GDPR;
• measuring traffic and advertising effectiveness using Google Analytics and Google Ads, only after the relevant consent has been given, under Article 6(1)(a) GDPR;
• operating HA Expert's own analytics described in section 4, only after consent for the “analytics” purpose has been given. To the extent that the information processed constitutes personal data, the legal basis is Article 6(1)(a) GDPR;
• complying with legal obligations, in particular accounting and tax obligations connected with a contract, under Article 6(1)(c) GDPR.

The website and the contact form also work without consent to analytics or marketing purposes. Refusing consent does not restrict access to the offer or the ability to send an enquiry.

Depending on how the website is used, the following data may be processed:

• data voluntarily provided through the contact form or by email, in particular contact details and the content of an enquiry;
• technical data necessary to deliver and secure the website, which may be processed by infrastructure providers, such as an IP address, HTTP request information and basic connection data;
• data related to Google Analytics and Google Ads, only in accordance with the user's consent choices;
• HA Expert's own analytics data described in section 4.

Important distinction: infrastructure providers may technically process an IP address in order to deliver and secure the website, while HA Expert's own analytics database does not store the raw IP address.

HA Expert analytics measures website use. It does not determine a visitor's name or identity. Session events are sent only after analytics consent.

With that consent, recorded data may include a random session identifier in sessionStorage, event time, language, page path without parameters, entry source, country provided by infrastructure, desktop/mobile viewport variant, active time, scrolling, named clicks and form stages. We do not record raw IP addresses, full User-Agent strings, form contents or session recordings.

Recognising a returning browser requires separate consent. Only after that purpose is selected in privacy settings is a random ha_analytics_browser_v1 identifier stored in localStorage for up to 90 days from creation, without extending its lifetime on visits. The collector stores its SHA-256 hash to link sessions from that browser. This is pseudonymous browser recognition, not identification of a person. We do not use IP matching or fingerprinting for returning visits.

Withdrawing returning-browser or analytics consent removes the identifier from the browser and stops further linking. Giving consent again creates a new identifier. Previously recorded statistics and session links remain in retained history until retention is applied; the link to the removed identifier is not restored.

Minimal banner-render and consent-decision statistics contain no person or session identifier. A random identifier for each event is used only for short-lived deduplication, for approximately 24 hours. The independent counter of messages accepted by the sending provider contains no form contents or contact details; linking it to a session requires analytics consent.

Privacy settings provide separate choices for analytics, advertising and marketing, and returning-browser recognition. The last purpose requires analytics and a separate selection. Existing analytics consent and the “Accept analytics and ads” button do not enable returning-browser recognition.

ha_consent_v2 remembers purpose choices in localStorage. Sessions use sessionStorage. The optional ha_analytics_browser_v1 has a 90-day lifetime. Each purpose can be withdrawn in the same settings; refusing does not block the website or contact form. Google uses its technologies according to analytics and advertising choices. Returning-browser consent is not sent to Google as an additional advertising purpose.

To the extent necessary for the website to operate, data may be processed by:

• Google Analytics and Google Ads (Google Ireland Limited), for traffic and advertising effectiveness measurement in accordance with the consent given. How Google processes data is described in the Google Privacy Policy;
• Cloudflare, as the provider of infrastructure, CDN, website security and the services used by the contact form backend. The processing terms are set out in the Cloudflare Data Processing Addendum;
• Resend (Plus Five Five, Inc.), as the provider of email delivery related to the contact form. The processing terms are set out in the Resend Data Processing Addendum;
• GitHub (GitHub, Inc.), for hosting the static part of the website on GitHub Pages. How GitHub processes data is described in the GitHub Privacy Statement;
• technical infrastructure providers necessary for the proper and secure operation of the services, only to the extent required to provide those services.

Results from HA Expert's own analytics are used by HA Expert and are not shared with Google Ads or other parties for advertising profiling.

Before consent is given, the relevant Google consent signals (ad_storage, ad_user_data, ad_personalization, analytics_storage) are set to “denied”. After the user makes a choice, the settings are updated according to the consent given.

Depending on how Google Consent Mode operates, Google may receive limited technical or measurement signals without the relevant cookies when consent has not been given. Google determines how these signals operate.

HA Expert session analytics remains disabled without analytics consent. Minimal consent statistics and the server message counter operate separately, without a session identifier when that consent is absent.

• HA Expert analytics data is subject to a separate retention procedure, by default removing events older than 180 days. Expiry of the browser identifier after 90 days does not retroactively delete database records;
• the decision stored in ha_consent_v2 remains in the browser until it is changed, website data is cleared, or the consent mechanism is reset;
• correspondence and contact form data is retained for as long as necessary to handle the enquiry, perform the cooperation and protect against potential legal claims;
• data that must be retained under accounting, tax or other applicable laws is retained for the period required by law;
• data processed by external providers may be subject to their documented retention periods depending on the type of service and applicable agreements.

HA Expert does not retain data longer than necessary for the purpose for which it was collected unless further retention is required by law.

Some providers used by HA Expert may process data outside the European Economic Area, particularly in the United States.

Google uses legal mechanisms for international data transfers, including the EU-U.S. Data Privacy Framework and Standard Contractual Clauses (SCCs) where required. Details are described in Google's documentation on data transfer frameworks.

Cloudflare uses the EU-U.S. Data Privacy Framework and appropriate Standard Contractual Clauses for transfers requiring an additional legal safeguard, as set out in Cloudflare's GDPR information.

Resend primarily processes customer data in the United States. Transfers from the European Economic Area are covered by the Standard Contractual Clauses incorporated into the Resend Data Processing Addendum and by Resend's participation in the EU-U.S. Data Privacy Framework, as set out in the Resend Data Processing Addendum.

GitHub may process data in the United States and other countries. For transfers from the European Economic Area it relies, among other mechanisms, on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses, as set out in the GitHub Privacy Statement.

Where provided for by the GDPR, the user has the right to:

• receive information about the processing of their data;
• access their data;
• rectify their data;
• erase their data;
• restrict processing;
• data portability;
• object to processing where the legal basis is a legitimate interest;
• withdraw consent at any time where processing is based on consent.

Consent for analytics, marketing and returning-browser recognition can be changed or withdrawn at any time using the privacy settings available on the website. Withdrawing consent is as easy as giving it and does not affect the lawfulness of processing carried out before the withdrawal.

The user has the right to lodge a complaint with the competent supervisory authority, in particular Datatilsynet in Denmark or the data protection authority competent for the user's habitual residence.

The random identifier recognises a browser, not the identity of a person. Analytics does not link it to contact details or message contents. A name or email address alone may not identify the analytics events relating to a particular person. We do not collect additional identity data solely for that purpose.

HA Expert does not use website data to make decisions about users based solely on automated processing that produce legal effects or similarly significantly affect them.