Action required before launch
This document is a working draft. Every value shown in [square brackets] must be completed with the real legal entity details, and the whole page must be reviewed by a qualified lawyer in your jurisdiction before this site goes live. It is structured to cover the GDPR disclosure requirements, but structure is not legal advice.
1. Who we are
Holits ("we", "us") operates holits.com. For the purposes of the EU General Data Protection Regulation (GDPR) we are the data controller for personal data collected through this website.
- Legal entity: [registered company name]
- Registered address: [registered address]
- Company registration number: [registration number]
- Data protection contact: hello@holits.com
We have assessed that we are [not] required to appoint a Data Protection Officer under Article 37 GDPR. [If appointed, give the DPO's contact details here.]
2. What personal data we collect
We collect only what the site actually needs to function.
2.1 Information you give us
When you submit the contact form we collect your name, email address, and optionally your company name, together with the project type, budget range, timeline and message you provide. You also record your agreement to this policy.
2.2 Information collected automatically
- Analytics. We use Umami, which we host ourselves on our own infrastructure in the EU. Your analytics data is not shared with an analytics vendor and does not leave servers we control. Umami sets no cookies and does not collect or store personal data or cross-site identifiers. It records aggregate page views, referrers and country-level location. It does not build a profile of you and does not track you across websites.
- Server and security logs. Our hosting and network providers process IP addresses and request metadata to deliver the site and to protect it from abuse.
- Abuse prevention. Contact form submissions are rate limited by IP address, and may be checked using hCaptcha to distinguish humans from automated submissions.
2.3 Cookies
This site sets no advertising or tracking cookies. Your theme preference (dark or light) is stored locally in your browser and is never transmitted to us. Because we set no non-essential cookies, no cookie consent banner is required.
3. Why we process it, and our legal basis
| Purpose | Data | Legal basis (Article 6 GDPR) |
|---|---|---|
| Responding to your enquiry | Contact form fields | Art. 6(1)(b) — steps taken at your request prior to entering into a contract |
| Following up about a potential engagement | Name, email, company, enquiry detail | Art. 6(1)(f) — our legitimate interest in responding to business enquiries |
| Preventing spam and abuse | IP address, captcha result | Art. 6(1)(f) — our legitimate interest in keeping the service available |
| Understanding aggregate site usage | Non-identifying analytics events | Art. 6(1)(f) — our legitimate interest in improving the site, using analytics that do not identify you |
| Meeting legal and accounting obligations | Correspondence relating to an engagement | Art. 6(1)(c) — compliance with a legal obligation |
4. Who we share it with
We do not sell personal data and we do not share it for advertising. We use the following processors, each under a data processing agreement:
| Processor | Purpose | Location |
|---|---|---|
| Resend | Delivering contact form submissions to our inbox | [EU / US — confirm and state transfer safeguard] |
| Vercel | Website hosting and delivery | [region] |
| Cloudflare | DNS and protection against network abuse | [region] |
| hCaptcha | Distinguishing human from automated submissions | [region] |
| [Email provider] | Receiving and storing correspondence | [region] |
Where a processor transfers personal data outside the European Economic Area, that transfer relies on [Standard Contractual Clauses / an adequacy decision — confirm per processor].
5. How long we keep it
- Enquiries that do not lead to an engagement: deleted within [24] months of our last correspondence.
- Enquiries that lead to an engagement: retained for the duration of the engagement and then for [the statutory retention period applicable in our jurisdiction], for legal and accounting purposes.
- Server and security logs: retained by our providers for a short rolling period, typically no more than [30] days.
- Analytics: retained in aggregate form only, on our own EU infrastructure, and never linked to you.
6. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you (Art. 15)
- Rectify inaccurate or incomplete data (Art. 16)
- Erase your data where there is no overriding reason to keep it (Art. 17)
- Restrict processing in certain circumstances (Art. 18)
- Receive your data in a portable, machine-readable format (Art. 20)
- Object to processing based on legitimate interests (Art. 21)
- Withdraw consent at any time, where processing is based on consent, without affecting processing carried out before withdrawal
To exercise any of these rights, email hello@holits.com. We will respond within one month, as required by Article 12(3). There is no charge for a reasonable request.
You also have the right to lodge a complaint with a supervisory authority. In our case that is [name of your national data protection authority]; you may also complain to the authority in the country where you live or work.
7. Automated decision-making
We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you (Art. 22). Spam filtering on the contact form is a technical measure and does not make decisions about you as a person.
8. Security
Data is transmitted over TLS, contact form input is validated on the server, submission endpoints are rate limited, and access to correspondence is limited to the people who need it. No system is perfectly secure, but we treat the data you send us as confidential business information.
9. Children
This site is aimed at businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16.
10. Changes to this policy
If we change this policy we will update the date at the top of this page. Where a change materially affects how we handle data you have already given us, we will contact you directly.
11. Contact
Questions about this policy or about how we handle your data: hello@holits.com.