Skip to content
EN

Privacy policy

Updated

Privacy Policy of the Website www.ehsvr.com

General information

The controller of personal data collected via the website www.ehsvr.com is BHP VR sp. z o. o. registered in the register of entrepreneurs by the competent court under the KRS number: 0000775079, share capital: PLN 6,200, place of business: Ludowa 2/20, 00-780 Warsaw, correspondence address: Ludowa 2/20, 00-780 Warsaw, NIP: 7551935718, REGON: 382887375, e-mail address: office@ehsvr.com, hereinafter referred to as the “Controller”. Personal data collected by the Administrator via the website are processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as the GDPR, and the Personal Data Protection Act of 10 May 2018.

The Administrator processes personal data via the website www.ehsvr.com in the following cases:

  • the user sends a form (for example the contact form or the free trial form). Personal data are processed to answer the request, arrange the free trial or prepare an offer, on the basis of Article 6 paragraph 1 letter b) of the GDPR (steps taken at the request of the data subject before entering into a contract). The technical data about the visit sent together with the form are processed to know which channel the contact came from, on the basis of the legitimate interest of the Controller in analysing the effectiveness of its channels (Article 6 paragraph 1 letter f) of the GDPR).
  • the user ticks the marketing consent checkbox in a form. Personal data are processed to send commercial information on the basis of that consent, in accordance with Article 6 paragraph 1 letter a) of the GDPR.
  • the user writes in the chat (Pipedrive LeadBooster). The data typed into the chat go to the Controller’s CRM system, Pipedrive.
  • the forms are protected against spam and abuse (Cloudflare Turnstile, request rate limiting, a short-lived duplicate check). Personal data are processed on the basis of the legitimate interest of the Controller in protecting the forms (Article 6 paragraph 1 letter f) of the GDPR).
  • the user accepts cookies. Website statistics, analysis of how the website is used and measurement of advertising (Google Analytics 4, Google Ads, Meta Pixel, Microsoft Clarity) take place only on the basis of consent (Article 6 paragraph 1 letter a) of the GDPR).

Each tool is described in the section “Third-party tools and cookies” below.

Types of personal data processed

Depending on the form, the Administrator processes the following categories of the user’s personal data:

  • Name and surname,
  • Email address,
  • Phone number,
  • Name of the organisation, sector and country,
  • Website or LinkedIn profile,
  • Content of the question,
  • Consents given in the form,
  • Technical data about the visit sent together with the form: the address of the page, the referring page (referrer), campaign parameters (UTM parameters, gclid, fbclid) and, only if the user accepted cookies, the landing page and the list of pages viewed in the session,
  • Data typed into the chat,
  • Data collected by analytics and advertising tools after consent, as described in the section “Third-party tools and cookies”.

Personal data archiving period

Users’ personal data are stored by the Administrator:

  • if the basis for data processing is the performance of a contract, for the time necessary to perform the contract, and after that time for a period corresponding to the limitation period for claims. Unless a special provision provides otherwise, the limitation period is six years, and for claims for periodic benefits and those related to business activity - three years.
  • in the event that the basis for data processing is consent, for the duration of its validity, and after the withdrawal of consent for a period of time corresponding to the limitation period for claims that may be filed by and against the Administrator. Unless special provisions provide otherwise, the limitation period is six years, and for claims for periodic benefits and related to business activity - three years.

In addition:

  • the hash of the e-mail address used to detect duplicate form submissions is kept for 10 minutes,
  • if the CRM system is temporarily unavailable, a copy of the form submission is kept for up to 7 days so that it can be entered manually,
  • the list of pages viewed in the session is kept in the browser’s sessionStorage until the tab is closed,
  • Google Analytics 4 event data are kept for up to 14 months,
  • Microsoft Clarity keeps session recordings for up to 30 days and aggregated heatmap data for up to 13 months.

When the website is used, the hosting provider (Cloudflare) processes the technical data necessary to deliver and protect the website, in particular the IP address assigned to the user’s computer or the external IP address of the Internet provider, browser type, access time and operating system type. The legal basis is the legitimate interest of the Administrator (Article 6 paragraph 1 letter f of the GDPR), consisting in providing the website securely. Navigation data, such as pages viewed, clicks and scrolling, are collected by analytics tools only after the user consents to cookies (Article 6 paragraph 1 letter a of the GDPR).

Providing personal data by the user is voluntary.

Personal data will also be processed in an automated manner in the form of profiling, provided that the user consents to this on the basis of Article 6 sec. 1 lit. a GDPR. The consequence of profiling will be the assignment of a profile to a given person in order to make decisions concerning them or to analyze or predict their preferences, behaviors and attitudes.

The Administrator takes special care to protect the interests of data subjects, and in particular ensures that the data collected by him are: processed in accordance with the law, collected for specific, lawful purposes and are not subject to further processing incompatible with these purposes, reliable and adequate in relation to the purposes for which they are processed and stored in a form enabling the identification of data subjects, no longer than is necessary to achieve the purpose of processing.

Sharing personal data

Users’ personal data are transferred to service providers that the Administrator uses to run the website: Cloudflare, Inc. (hosting and security), Pipedrive OÜ, Estonia (CRM system and chat) and, only after the user consents to cookies, Google Ireland Ltd / Google LLC, Meta Platforms Ireland Ltd and Microsoft Corporation / Microsoft Ireland Operations Ltd. Service providers to whom personal data are transferred, depending on the contractual arrangements and circumstances, are either subject to the Administrator’s instructions as to the purposes and means of processing this data (processors) or independently determine the purposes and means of their processing (controllers).

Google, Meta, Microsoft and Cloudflare may process data in the United States. The transfer to the USA is based on the EU-US Data Privacy Framework and, for Google, also on standard contractual clauses. Details for each provider are given in the section “Third-party tools and cookies”.

Right to control, access and correction of data

The data subject has the right to access their personal data and the right to rectify, delete, limit processing, the right to transfer data, the right to object, the right to withdraw consent at any time, however, this does not affect the lawfulness of processing based on consent before its withdrawal.

Legal basis for your request:

  • Access to data - Art. 15 GDPR
  • Rectification of data - Art. 16 GDPR.
  • Deletion of data (so-called right to be forgotten) - Art. 17 GDPR.
  • Restriction of processing - Art. 18 GDPR.
  • Data transfer - Art. 20 GDPR.
  • Objection - Art. 21 GDPR
  • Withdrawal of consent - Art. 7 sec. 3 GDPR.

To exercise the rights listed above, you can send an appropriate e-mail to the following address: office@ehsvr.com. If the user exercises the right arising from the above rights, the Administrator shall immediately comply with the request or refuse to comply with it, but no later than within one month of receiving it. However, if - due to the complexity of the request or the number of requests - the Administrator is unable to comply with the request within a month, it will comply with it within the next two months, informing the user in advance within a month of receiving the request - of the planned extension of the deadline and its reasons. If it is found that the processing of personal data violates the provisions of the GDPR, the data subject has the right to lodge a complaint with the President of the Office for Personal Data Protection.

“Cookies”

The Administrator’s website uses “cookies” and similar technologies (the browser’s localStorage and sessionStorage).

On the first visit a banner asks for a decision. Accept switches on the analytics and advertising tools and the chat. Necessary only leaves them switched off, and the website still works. The choice is stored in the browser’s localStorage under the key ehsvr-consent. It can be changed at any time with the Cookie settings link in the footer. Withdrawing consent deletes the analytics and advertising cookies stored on the ehsvr.com domain (_ga*, _gcl*, _fbp, _fbc, _clck, _clsk), informs Microsoft Clarity that consent was withdrawn and reloads the page. Cookies stored on the providers’ own domains (e.g. Microsoft’s CLID) can be deleted in your browser settings.

The website uses Google Consent Mode v2 in advanced mode. Before consent or after refusal, ad_storage and analytics_storage are set to “denied” and Google tags send only cookieless pings without identifiers. Cookies are set only after consent. Meta Pixel, Microsoft Clarity and the chat load only after consent (the chat also when the user clicks the chat button). Cloudflare Turnstile, which protects the forms, loads also without consent (see below).

Third-party tools and cookies

Google Tag Manager, Google Analytics 4 and Google Ads

  • Provider: Google Ireland Ltd / Google LLC.
  • Purpose: managing the measurement tags (Google Tag Manager, GTM-WP6XWW93), website statistics (Google Analytics 4, measurement ID G-QBJ592MSYT) and measuring conversions from Google Ads (AW-17507548866).
  • Data: after consent: page views, clicks on key buttons, clicks on the phone number and e-mail address, scroll depth, starting and sending a form together with the form type and the types of pages viewed in the session (never the contents of the form), and cookie identifiers. GA4 anonymises IP addresses by default.
  • When it loads: Google Tag Manager loads on every page. Before consent or after refusal, Google tags send only cookieless pings without identifiers. Cookies (_ga*, _gcl*) are set only after consent.
  • Legal basis: consent (Article 6 paragraph 1 letter a) of the GDPR).
  • Retention: Google Analytics 4 event data up to 14 months.
  • Transfer outside the EEA: to the USA, on the basis of the EU-US Data Privacy Framework (Google LLC is certified) and standard contractual clauses.
  • How to opt out: choose Necessary only in the banner or withdraw consent with the Cookie settings link in the footer.

Meta Pixel

  • Provider: Meta Platforms Ireland Ltd.
  • Purpose: measuring the effectiveness of our ads (Meta Pixel ID 1464471547974625).
  • Data: page views and the “Lead” event on the thank-you page shown after a form is sent, cookie identifiers (_fbp, _fbc).
  • When it loads: only after consent.
  • Legal basis: consent (Article 6 paragraph 1 letter a) of the GDPR).
  • Transfer outside the EEA: to the USA, on the basis of the EU-US Data Privacy Framework.
  • How to opt out: choose Necessary only in the banner or withdraw consent with the Cookie settings link in the footer.

Microsoft Clarity

  • Provider: Microsoft Corporation / Microsoft Ireland Operations Ltd.
  • Purpose: understanding how the website is used (heatmaps, session recordings, clicks, scrolling) in order to improve it.
  • Data: clicks, scrolling and the course of the visit. Form fields are masked and not recorded. Cookies: _clck (up to 1 year), _clsk (1 day), CLID (up to 1 year).
  • When it loads: only after consent and only on www.ehsvr.com.
  • Legal basis: consent (Article 6 paragraph 1 letter a) of the GDPR).
  • Retention: session recordings up to 30 days, aggregated heatmap data up to 13 months.
  • Transfer outside the EEA: to the USA, on the basis of the EU-US Data Privacy Framework (Microsoft is certified).
  • How to opt out: choose Necessary only in the banner or withdraw consent with the Cookie settings link in the footer.

Cloudflare (hosting, security, Turnstile)

  • Provider: Cloudflare, Inc.
  • Purpose: hosting of the website (Cloudflare Pages), security and protection of the forms. Cloudflare Turnstile checks whether a form is sent by a human. The form endpoint limits the number of requests. Cloudflare KV holds the short-lived duplicate check and, if the CRM system is temporarily unavailable, the copy of a submission.
  • Data: IP address, browser and device signals. Turnstile does not use advertising cookies.
  • When it loads: hosting on every page. Turnstile on pages with a form, also without consent, because it is necessary to protect the form from spam.
  • Legal basis: legitimate interest of the Controller in the security of the website and in protecting the forms from spam (Article 6 paragraph 1 letter f) of the GDPR).
  • Retention: hash of the e-mail address for the duplicate check: 10 minutes; copy of a submission when the CRM system is unavailable: up to 7 days.
  • Transfer outside the EEA: to the USA, on the basis of the EU-US Data Privacy Framework.
  • How to opt out: Turnstile is necessary to send a form, so it cannot be switched off in the cookie settings. Instead of the form you can write to office@ehsvr.com.

Pipedrive (forms and CRM)

  • Provider: Pipedrive OÜ, Estonia.
  • Purpose: recording a form submission as a lead with a note in our CRM system, in order to answer the request, arrange the free trial or prepare an offer, and to know which channel the contact came from.
  • Data: the data entered in the form (name, e-mail, phone, organisation, sector, country, website or LinkedIn profile, question, consents) and the technical data about the visit: the address of the page, the referring page (referrer), UTM parameters, gclid and fbclid and, only if the user accepted cookies, the landing page and the list of pages viewed in the session (kept in the browser’s sessionStorage until the tab is closed).
  • When it is used: when the user sends a form.
  • Legal basis: Article 6 paragraph 1 letter b) of the GDPR (steps taken at the request of the data subject before entering into a contract), Article 6 paragraph 1 letter f) of the GDPR (legitimate interest: analysing the effectiveness of our channels) and, for the marketing consent checkbox, Article 6 paragraph 1 letter a) of the GDPR.
  • Retention: as described in the section “Personal data archiving period”.
  • How to opt out: the form is optional. Marketing consent can be withdrawn at any time by writing to office@ehsvr.com.

Pipedrive LeadBooster chat

  • Provider: Pipedrive OÜ, Estonia.
  • Purpose: talking to us in the chat.
  • Data: the data typed into the chat go to Pipedrive.
  • When it loads: only after consent, or when the user clicks the chat button.
  • How to opt out: choose Necessary only in the banner and do not click the chat button.
On this page