Privacy Policy

[LEGAL ENTITY NAME], [REGISTERED ADDRESS], [COUNTRY] ("Handovr," "we," "us") is the controller for the personal data described in Section 2(a)–(c) below. For any data protection matter, contact us at privacy@usehandovr.com.

Data Protection Officer: [We have assessed the requirements of Art. 37 GDPR and are not required to appoint a Data Protection Officer / Our Data Protection Officer can be reached at [DPO CONTACT]] — confirm which applies before publishing. EU/UK representative: if Handovr processes personal data of individuals located in the EU or UK without an establishment there, an Art. 27 GDPR / UK GDPR representative must be appointed and named here.

This Policy distinguishes two categories of data: Account Data — the data of the people who sign in — for which Handovr is the controller, and Customer Data— the project, task, and client information your organization stores in the Service — for which your organization is the controller and Handovr is a processor. Section (b) below describes Customer Data only for transparency; the governing document for that processing is the data processing agreement ("DPA") between Handovr and your organization, not this Policy.

(a) Account Data — sign-in and use of the Service

Individual accounts are provisioned by your organization's administrator, not created by self-registration. We process your name, work email, role, and organization to authenticate sign-ins, enforce access controls, and operate the Service. We also process sign-in timestamps and basic security logs (e.g. audit trails, rate-limiting of sign-in, password reset, and two-factor attempts).

Legal basis. Processing Account Data is necessary for the performance of the contract between your organization and Handovr and its associated legitimate interest in operating the Service securely (Art. 6(1)(b) and (f) GDPR).

(b) Customer Data your organization stores in the Service

Where your organization or its Authorized Users enter project, stage, task, document, or client information — including personal data about your organization's own clients — we process that data solely on your organization's documented instructions, as its processor under Art. 28 GDPR, governed by the DPA. Your organization is responsible for having a lawful basis to submit that data, including any data about its own clients, and for responding to requests from the individuals it concerns.

(c) If you are invited to use Handovr by one of our customers

If your organization's administrator provisions you an account, we process the Account Data described in (a) as controller, and any Customer Data associated with your activity as processor for that organization, as described in (b).

(d) Optional third-party integrations

Your organization's administrator may connect optional integrations. Connecting any of these is optional and can be disconnected at any time; we access only what each integration needs to perform the function described:

• Microsoft Outlook— when a client-communication task is marked done, the Service prepares a draft email in the connecting user's own Outlook mailbox. Nothing is ever sent automatically; the user reviews and sends it themselves.
• Slack — connected once for the organization by an Admin, not per person. When a client-communication task is marked done, the Service posts a message to a channel the Admin selected.
• Microsoft Teams — added by an Admin pasting a channel webhook URL; the same task-completion event posts a message to that channel. No OAuth account connection is involved.

Jira and Salesforce integrations are planned but not yet available; no data is exchanged with either today, and this Policy will be updated before they process any personal data.

Legal basis.Art. 6(1)(b) and (f) GDPR — performing the integration your organization's administrator configured, and our legitimate interest in providing the functionality requested.

(e) Cookies

The Service uses only the session cookie required to keep you signed in. We do not currently use any analytics, advertising, or third-party tracking cookies. Because this cookie is strictly necessary to provide the Service you have requested, it does not require consent under Art. 6(1)(f) GDPR and equivalent ePrivacy rules. If we add non-essential cookies in the future (e.g. analytics), we will request consent first and update this section.

• Account Data and Customer Data: retained for the duration of your organization's subscription, plus [RETENTION PERIOD, e.g. 30 days] afterward to allow for account recovery, unless a shorter period is agreed or a longer period is required by law.
• Audit log and rate-limiting records: retained only as long as needed for security purposes.
• Data accessed through an optional integration (Section 2(d)): not stored beyond what is needed to prepare the draft or post the message described.

Contact us at the details in Section 1 to exercise any of the following, or to withdraw consent where processing is based on it:

• Right of access (Art. 15 GDPR) to the personal data we process about you;
• Right to rectification (Art. 16 GDPR);
• Right to erasure (Art. 17 GDPR), unless we are legally obliged or entitled to continue processing;
• Right to restriction of processing (Art. 18 GDPR);
• Right to object (Art. 21 GDPR), on grounds relating to your particular situation;
• Right to data portability (Art. 20 GDPR), where processing is based on consent or a contract;
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR) — the authority competent for us is [SUPERVISORY AUTHORITY], or the authority in your place of residence.

Requests concerning Customer Data (Section 2(b)) should generally go through your organization's administrator, since your organization controls that data; we will support your organization in responding as required by the DPA.

No automated decision-making within the meaning of Art. 22 GDPR, including profiling, takes place.

[Describe here where the Service is hosted and where each sub-processor in Section 7 processes data. Where personal data is transferred outside the EU/EEA or UK, the transfer is based on an applicable adequacy decision (Art. 45 GDPR) or the European Commission's Standard Contractual Clauses (Art. 46 GDPR), supplemented by additional measures where necessary.]

The Service is built on Supabase (database, authentication, file storage, and transactional email) and hosted on Vercel. Where your organization connects an optional integration (Section 2(d)), the relevant provider — Microsoft or Slack Technologies — processes the data needed to operate that connection under its own terms. A current sub-processor list is available on request; your organization will be given notice of any new sub-processor as required by the DPA.

Measures we apply include, among others:

• Tenant isolation enforced at the database level (row-level security), not just in application code;
• Encryption in transit (TLS) for all traffic to the Service;
• Optional two-factor authentication, and rate-limiting on sign-in, password reset, and MFA attempts;
• Least-privilege access for administrative and support functions, with activity logged in an audit trail.

No system is completely secure; we maintain an incident-response process and will notify affected organizations of a personal data breach as required by Art. 33–34 GDPR and the DPA.

The Service is intended for business use by adults acting on behalf of an organization and is not directed at children.

We may update this Policy from time to time. Material changes will be communicated to your organization's administrator with reasonable notice before taking effect.

Questions about this Policy, or requests concerning your Account Data, can be sent to privacy@usehandovr.com.