Privacy Policy

1. Privacy at a glance

General information

The following information provides a simple overview of what happens to your personal data when you visit this website or contact us. Personal data means any data that can be used to identify you personally. Detailed information can be found in the following sections of this privacy policy.

What data do we collect and for what purpose?

• Technical access data in order to provide the website securely and reliably.
• Information that you actively provide to us, for example via a contact form or within a password-protected download area.
• Analytics data only to the extent that you have given your consent via our consent management; for this purpose we use Google Analytics 4 with Google Consent Mode v2.

What rights do you have?

In particular, you have the right to access, rectification, erasure, restriction of processing, data portability and to object to certain processing activities. You may withdraw any consent you have given at any time with effect for the future.

2. Controller

The controller responsible for data processing on this website is:

Harvey Amber GmbH
Heinrich-Hertz-Straße 12
41516 Grevenbroich
Email: info@harveyamber.com

If other parties are jointly responsible for individual processing operations or if processors are used, these are identified in the relevant sections below.

3. Hosting

Hetzner Online GmbH

This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The hosting serves to provide our online offering in a secure, fast and reliable manner.

To the extent personal data is processed in the course of hosting, this is based on Article 6(1)(f) GDPR. Where processing is necessary for the performance of a contract or for pre-contractual measures, Article 6(1)(b) GDPR may also apply. We have concluded a data processing agreement with Hetzner pursuant to Article 28 GDPR.

4. General information on legal bases, recipients and storage periods

We process personal data only where there is a legal basis for doing so. In particular, the following may apply:

• Article 6(1)(a) GDPR where you have given consent to processing.
• Article 6(1)(b) GDPR where processing is necessary for the performance of a contract or for pre-contractual measures.
• Article 6(1)(c) GDPR where we are subject to legal obligations.
• Article 6(1)(f) GDPR where processing is necessary to safeguard legitimate interests and no overriding interests of the data subject prevail.

Unless a more specific storage period is stated in this privacy policy, we store personal data only for as long as this is necessary for the respective purposes or for as long as statutory retention obligations apply.

Recipients of personal data are, in particular, technical service providers that we engage as processors and, in individual cases, authorities or other bodies to which we must disclose data due to legal obligations.

5. Data collection on this website

5.1 Server log files

When you access our website, the hosting provider automatically collects and stores information in so-called server log files. This includes, in particular, browser type and browser version, operating system used, referrer URL, host name of the accessing device, time of the request and the IP address.

The processing takes place to ensure the security, stability and functionality of the website on the basis of Article 6(1)(f) GDPR. Server log files are generally stored for a maximum of 14 days and then deleted, unless longer retention is required to investigate security incidents or misuse.

In addition, we carry out our own cookieless reach measurement. When a page is accessed, we store the date and time, the page accessed, the referrer domain, the device category and a short technical value derived from the IP address and browser identifier together with a secret value that changes daily. The IP address itself is not stored; it is not possible to identify individual persons or to recognise visitors across multiple days. No cookies are set for this purpose and no information is stored on or read from your terminal device. The legal basis is our legitimate interest in a statistical evaluation of the use of our website (Article 6(1)(f) GDPR). The raw data is deleted after twelve weeks at the latest or condensed into anonymous statistics without any personal reference.

5.2 Cookies and similar technologies

Our website uses cookies and similar technologies. We use technically necessary cookies only to the extent required to provide the website or to enable functions expressly requested by you. We use analytics or marketing technologies only if you have given us your prior consent.

Where information is stored on or read from your terminal device through technically necessary cookies or similar technologies, this is based on Section 25(2) TDDDG. Any subsequent processing of personal data is carried out—depending on the purpose—on the basis of Article 6(1)(b) GDPR or Article 6(1)(f) GDPR. For all non-essential technologies, the legal basis is your consent pursuant to Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

5.3 Consent management (cookie banner)

We use a consent management tool to obtain, manage and document your consents. When you visit the website for the first time, a consent banner is displayed. There you can consent to the use of individual categories of technologies or reject them.

Your selection is stored so that we can take your preferences into account on subsequent page visits and demonstrate that consent was obtained. The legal basis for this is Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR and—where information is stored on or read from your terminal device—Section 25(2) TDDDG.

For this purpose, we use an in-house consent management solution through which your consents can be obtained, stored, documented and withdrawn or adjusted at any time via the cookie settings.

5.4 Contact form and other contact options

If you contact us via contact form or email, we process the information you provide in order to handle your request and, where applicable, to answer follow-up questions. This regularly includes your name, contact details, the content of your message and technical transmission metadata.

The legal basis is Article 6(1)(b) GDPR where your request is aimed at entering into or performing a contract. In all other cases, the processing is based on Article 6(1)(f) GDPR, as we have a legitimate interest in handling enquiries efficiently.

We generally store the enquiries you send to us until your request has been finally processed and thereafter only to the extent that statutory retention obligations exist or we need the data for the establishment, exercise or defence of legal claims.

5.5 Password-protected download area

Where a password-protected download area is provided on this website for clients or other authorised users, we process the login and usage data required for this purpose in order to technically enable access and secure the content made available there.

Technically necessary session cookies may be used for this purpose and are deleted when the browser is closed. Accesses and downloads may be logged with a timestamp and in pseudonymised or shortened form where this is necessary for contract performance, the prevention of misuse or IT security.

The legal basis is Article 6(1)(b) GDPR to the extent that the download area concerns contractually owed services, and Article 6(1)(f) GDPR for IT security measures. Where technically necessary information is stored on or read from your terminal device, this is based on Section 25(2) TDDDG.

6. Analytics tools

6.1 Google Analytics 4 with Google Consent Mode v2

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics helps us evaluate the use of our website and improve our offering.

We use Google Analytics 4 together with Google Consent Mode v2 in an advanced implementation. The Google tag is loaded technically; however, the consent parameters for analytics and advertising purposes are set to "denied" by default. Analytics cookies are only set and read once you have expressly consented via our consent management.

To the extent that purely cookieless signals or functional requests are transmitted to Google before your consent within this implementation, these serve exclusively to communicate consent status, technically control tags and, according to Google, enable modelled and aggregated measurement without the use of persistent identifiers. We do not transmit plain personal data such as names or email addresses to Google Analytics in this context.

Once consent has been granted, the following data in particular may be processed: pages accessed, events and interactions, referrer, timestamps, device-related information, browser information and approximate location data. According to Google, IP addresses of EU users are not logged or stored; they are only used briefly to derive coarse location information.

The legal basis for full audience measurement using Google Analytics 4, including the setting and reading of analytics cookies, is your consent pursuant to Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. To the extent that cookieless, purely functional signals are transmitted to Google before your consent within Google Consent Mode v2, we rely on Article 6(1)(f) GDPR.

You can withdraw or change your consent at any time with effect for the future via the cookie settings on our website. In addition, you can use the browser add-on provided by Google to deactivate Google Analytics.

Where data is transferred to the United States, this is based on the adequacy decision of the European Commission regarding the EU-U.S. Data Privacy Framework, provided the recipient is certified accordingly. Google LLC is certified under the EU-U.S. Data Privacy Framework. Where necessary, the Standard Contractual Clauses of the European Commission are agreed in addition.

7. Self-hosted resources

Fonts (Inter)

The website uses the "Inter" font. The font files are loaded exclusively from our own web server. No external font CDN is accessed. In particular, no IP address is transmitted to third parties solely because the fonts are loaded.

No external CDN resources

As currently implemented, no external content delivery networks are used for layout, design or basic functionality. Static resources are delivered through our own server infrastructure.

8. Advertising services

No advertising cookies are set on this website without your consent, and no data is transmitted to third parties for advertising or remarketing purposes. As currently implemented, no Facebook Pixel, LinkedIn Insight Tag or comparable advertising tracking pixels are used.

9. Your rights as a data subject

Subject to the statutory requirements, you have the following rights in particular:

• Right of access pursuant to Article 15 GDPR.
• Right to rectification pursuant to Article 16 GDPR.
• Right to erasure pursuant to Article 17 GDPR.
• Right to restriction of processing pursuant to Article 18 GDPR.
• Right to data portability pursuant to Article 20 GDPR.
• Right to object pursuant to Article 21 GDPR.
• Right to withdraw any consent granted with effect for the future pursuant to Article 7(3) GDPR.

To exercise your rights, you can contact us at any time at info@harveyamber.com. We generally process such requests without undue delay and, within the statutory framework, usually within one month.

10. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement.

The competent supervisory authority for Harvey Amber GmbH in North Rhine-Westphalia is currently:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Postfach 20 04 44, 40102 Düsseldorf
www.ldi.nrw.de

11. Currency and amendments to this privacy policy

This privacy policy is current as of April 2026. We reserve the right to amend it if legal requirements, technical processes or our online offering change. The version published on our website at the relevant time shall apply.