Privacy policy
Last updated 28 Oct 2026
This policy explains what personal data Havkey processes, why, and what rights you have under the EU General Data Protection Regulation (GDPR).
Who is responsible
The controller of your personal data is the operator of Havkey named in the Operator section at the end of this page. You can contact us about privacy at the email address given there.
What we collect and why
| Data | Collected | Purpose | Legal basis |
|---|---|---|---|
| Name, phone, messenger or email, optional budget, country of residence and message | When you send a request about a project | To pass your request to the developer of that project so that their sales team can contact you | Your consent (Art. 6(1)(a) GDPR) |
| Email address | When you sign in | To send a one-time sign-in link and keep you signed in | Performance of the service you asked for (Art. 6(1)(b)) |
| Company and contact details | When a developer applies to list projects | To review the application and contact the company | Steps prior to a contract (Art. 6(1)(b)) |
| A salted, irreversible hash of your IP address, browser type | When you submit any form | Preventing spam and abuse, rate limiting | Legitimate interest in keeping the service secure (Art. 6(1)(f)) |
| Pages you open, clicks on buttons and links (position on the page, never what you type), scroll depth, time on page, page-load speed, error messages from the site’s code, screen-size group, language, the site you came from | When you browse the site | Understanding where the site is confusing or slow so we can improve it (our tool “Pulse”) | Legitimate interest in improving the service (Art. 6(1)(f)) |
We do not sell personal data and do not use it for advertising profiles.
Pulse: how we improve the site
Pulse is our own analytics tool; the data stays on our server and is not shared with anyone. It works without cookies and without storing anything in your browser. To count unique visitors we combine your IP address and browser type with a random key that changes every 24 hours and is then deleted, and store only an irreversible short hash, so the same visitor can’t be recognised on another day or on another site. We never store your IP address, what you type into forms, or full web addresses with personal details (only search filters such as city or number of rooms). If your browser sends a “Do Not Track” or “Global Privacy Control” signal, Pulse records nothing. You can object to this processing at any time by writing to us or by turning on one of these signals.
Who receives your data
- The developer of the project you asked about. Only the request you sent, and only for that project.
- Service providers acting on our instructions: Resend (email delivery), Cloudflare (hosting network, security and cookieless analytics), Google (Google Analytics: visit statistics). Where data is processed outside the European Economic Area, transfers rely on the European Commission’s Standard Contractual Clauses or an adequacy decision.
How long we keep it
Requests are kept for 24 months and then deleted, unless the law requires longer storage. Sign-in sessions expire automatically. Spam-protection records are deleted after 24 hours. Pulse events are deleted after 90 days; only daily totals without any visitor identifier are kept, for up to 13 months.
Cookies and local storage
We use only what is necessary for the site to work: a session cookie when you sign in. Your saved projects, comparison list and preferred currency are stored in your browser’s local storage and never leave your device. Cloudflare Web Analytics and our own Pulse do not use cookies or local storage and do not track you across sites. We also use Google Analytics 4 (Google Ireland Limited): it sets the cookies _ga and _ga_<ID> (kept for up to 2 years) and sends Google an online identifier of your browser, the pages you visit and your approximate location, so that we see visit statistics. Google may process this data in the USA under the EU–US Data Privacy Framework. You can block these cookies in your browser settings or with Google’s opt-out add-on (tools.google.com/dlpage/gaoptout).
Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to its processing, or transfer it to another service. You can withdraw your consent at any time; this does not affect processing that happened before the withdrawal. You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO, uodo.gov.pl).
Changes
If we change this policy, we will update the date at the top of this page. Material changes will be announced on the site.
Draft additions for business services
DRAFT — requires lawyer review. This section is not in force yet. It describes processing linked to Havkey’s paid services for businesses and will be merged into the policy above once approved. Until then, the sections above apply.
- Who is responsible (draft). The controller is Uravia OÜ, a company established in Estonia, Tornimäe tn 5, 10145 Tallinn, Estonia, registry code 17631710. Because the controller is established in Estonia, the lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee). You can also lodge a complaint with the supervisory authority of the country where you live or work — in Poland, the President of the Personal Data Protection Office (UODO, uodo.gov.pl).
- Developers pay Havkey for buyer requests. When you send a request about a project, the developer receives it and, after its free period, pays Havkey a fee for each delivered request (repeats, spam and requests rejected after a dispute are not charged). The fee does not depend on what you write and is not charged to you. To decide a developer’s dispute about a request, we may review that request.
- Requests about agency and agent listings. A request about a flat listed by an agency or agent goes to that agency (and the agent of the listing) or to the independent agent, so that they can contact you. The legal basis is your consent (Art. 6(1)(a) GDPR).
- Agencies and agents. For business accounts we process the company name, NIP, KRS or CEIDG entry, the intermediary’s liability insurance (OC) policy, and the names, photos, phone numbers, email addresses and languages of agents. We check them against public registers for the “Verified” mark and show the profile, team and listings publicly. Legal basis: performance of the contract (Art. 6(1)(b)) and our legitimate interest in showing buyers who is selling (Art. 6(1)(f)).
- Reviews of agencies and agents. A review shows the name you give, the rating and your text, and is published after moderation. We link it to your earlier request so that only people who contacted the seller can review it. Legal basis: [consent or legitimate interest — to be confirmed by the lawyer].
- Payments. Businesses pay by bank transfer or online through Stripe (card, BLIK, Przelewy24). Stripe processes the payment details; Havkey receives the payment status and never sees full card numbers. [Stripe’s role, controller or processor, and the transfer safeguards — to be confirmed by the lawyer.] We keep invoices and billing records for as long as tax and accounting law requires.
- Additional recipients: the agency or agent of the listing you asked about; Stripe (online payments); [invoicing or accounting service — to be named by the owner].
Operator
Uravia OÜTornimäe tn 5, 10145 Tallinn, Estonia
Registry code 17631710 (Estonian Commercial Register)
Contact: [email protected]