Privacy Policy

Controller

Hartung Coding OÜ, operating as H Product Studio Registry code 17200631 Tartu mnt 67/1-13b 10115 Tallinn, Estonia Represented by Anna Hartung Email: hello@buildwithh.com

Scope and Applicable Law

This policy applies to buildwithh.com, its contact and call-request forms, and related H Product Studio communications. Hartung Coding OÜ is established in Estonia, so the EU General Data Protection Regulation (GDPR) applies to our processing. We also provide the disclosures below for visitors in the United States. Some U.S. state-law rights apply only when a business meets statutory thresholds; we voluntarily accept access, correction, deletion and opt-out requests as described below.

Information We Collect

Information you provide: name, business email, company or project details, enquiry text, and requested call date, time and time zone. Information collected from the browser: IP address and request headers needed for hosting and security; consent choices; landing page, referrer and campaign parameters (such as UTM, gclid or fbclid); and, only after the relevant consent, analytics or marketing events. We do not collect payment-card details on this website.

Purposes, Categories, Retention

Enquiries and call requests — to review, respond, schedule and take steps toward a contract (Art. 6(1)(b) GDPR) and to operate an efficient business intake process (Art. 6(1)(f)). Hosting, security and abuse prevention — to deliver and protect the site (Art. 6(1)(f)) and comply with legal duties where applicable (Art. 6(1)(c)). Client administration and delivery — to perform a contract (Art. 6(1)(b)) and meet accounting or legal duties (Art. 6(1)(c)). Analytics and marketing — only for the category you consent to (Art. 6(1)(a)); you may withdraw that consent at any time.

Service Providers and Recipients

The following providers receive data only for the stated function. Provider role and transfer safeguards depend on the service and applicable contract; Telegram is specifically disclosed as the delivery channel for submitted enquiries.

Cookies, Local Storage and Consent

Strictly necessary storage includes your cookie preference and a short-lived lead_guard security cookie used to reduce duplicate or automated submissions. Campaign parameters may be kept in first-party local storage for up to 30 days so they can accompany an enquiry you actively submit; they are not sent to an advertising provider merely because they are stored. Google Analytics 4 and Google Tag Manager load only after the relevant optional consent. Analytics and marketing are separate choices. You may reject all optional technologies or change your choice at any time below.

Change cookie settings

Global Privacy Control and Do Not Track

When your browser sends a Global Privacy Control (GPC) signal, this site treats it as an opt-out of marketing tracking and advertising sharing: marketing remains disabled even if a stored preference says otherwise. There is no uniform legal or technical standard for the older Do Not Track (DNT) signal. We do not interpret DNT as a separate consent instruction; optional analytics and marketing are off by default until you make a choice in the cookie banner.

Disclosure and U.S. Sale/Sharing Notice

We disclose data only as needed to operate the site, respond to an enquiry, provide contracted work, protect the service, comply with law, or use analytics/marketing selected by you. Recipients are listed below. A submitted enquiry is delivered to our internal team through Telegram and may include your name, email, message, requested call details, landing page and campaign attribution. We do not sell personal information for money. Optional advertising or marketing disclosures could qualify as a ‘share’ or targeted-advertising disclosure under some U.S. state laws; those functions remain off unless marketing consent is granted, and Global Privacy Control overrides that choice.

Retention

Campaign attribution in local storage expires after 30 days. The lead_guard security cookie expires after 6 hours. Cookie preferences remain until changed, cleared or replaced for a new policy version. Enquiries that do not become an engagement are normally deleted from our active lead channel within 12 months after the last substantive contact. Client, project, invoice and legally relevant records may be retained for up to 7 years where needed for contract performance, accounting, legal claims or statutory duties. Analytics retention is configured separately in the provider and is intended not to exceed 14 months. We may retain a limited record longer when required by law, an active dispute or a security incident.

Your Privacy Rights

Depending on the law that applies, you may request access, correction, deletion, restriction, portability, or an objection to processing, and may withdraw consent without affecting earlier lawful processing. California and other eligible U.S. residents may also request to know the categories and recipients of personal information and opt out of sale, sharing or targeted advertising. We do not discriminate for exercising a privacy right. Email hello@buildwithh.com. We may request information reasonably needed to verify the request and authority of an agent. You can withdraw optional cookie consent immediately through the settings on this page.

International Data Transfers

Some providers may process data outside the EU/EEA, including in the United States or locations used by Telegram. Where GDPR requires a transfer mechanism, we rely on an applicable adequacy decision, Standard Contractual Clauses or another lawful safeguard. Because a website enquiry is delivered through Telegram, do not include passwords, payment details, health data, government identifiers or other sensitive information in the message field.

Data Security and Protection

We use proportionate technical and organizational safeguards, including encrypted transport, restricted access, abuse controls and maintained hosting. No internet transmission or third-party messaging system is risk-free, so please do not submit sensitive or confidential credentials through the public forms.

Children's Privacy

Our services are not directed to children under 16. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete such information promptly.

Changes to This Policy

We may update this policy when our services, providers or legal obligations change. The effective date above will change. When a change materially affects existing processing or requires a new choice, we will provide an appropriate notice or request consent; merely visiting the site does not waive privacy rights.

Complaints

You may lodge a complaint with a competent data-protection authority under Art. 77 GDPR. Hartung Coding OÜ’s lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon). You may also contact the authority where you live or work.