Contents
This Privacy Policy explains how Heravox Ltd (“Heravox”, “we”, “us”) handles personal data when you visit heravox.com, request a demo or get in touch with us.
Heravox Ltd is a company registered in England and Wales under company number 17192543, with its registered office at 105 Thornsbeach Road, London SE6 1EY, United Kingdom. We are the controller of the personal data described in this policy. You can reach us at info@heravox.com.
Our website in short
We built heravox.com to collect as little as possible. The website has no database, keeps no visitor logs, sets no cookies and uses no analytics, advertising or tracking tools. Fonts, images and videos are served from our own server, so loading a page does not send your data to any third-party website. The website runs on Amazon Web Services in Istanbul, on a server kept separate from our customer environments.
What this policy covers
This policy applies to heravox.com and www.heravox.com (the “Website”). It does not apply to the environments we provide to our customers at addresses such as yourorganisation.heravox.com; those are governed by our customer agreements and the notices that apply to them. Our Trust Center at trust.heravox.com is explained in its own section below.
What we collect and why
We collect the information described below electronically, through the Website and by email.
When you browse the Website
Like any website, ours receives the technical information your browser sends with each request, such as your IP address, browser and device details and the page you asked for. We use it only to show you that page and we do not keep it once the request has been answered. We rely on our legitimate interest in operating the Website.
When we protect the Website
To stop the Website being overloaded or misused, we limit how many requests can come from a single IP address (or, for IPv6, a single address block). That address is held in the server’s memory for about a minute, is never written to disk and is not shared. Our demo form also contains a hidden field that helps us filter out automated submissions.
Ordinary visits do not create any record. If a deliberately malformed request causes an error in our application, a short error entry containing the requested web address may be written to a log file. That file is capped at 10 MB and its oldest entries are overwritten automatically. We rely on our legitimate interest in keeping the Website secure.
When you sign in to your organisation’s environment
If your organisation is a Heravox customer, you can enter your email address on the Website to be taken to your organisation’s environment. Only the domain part of your address (for example, company.com) is sent to our server; the full address stays in your browser and is removed from the address bar once your environment opens. If JavaScript is turned off in your browser, a fallback form sends your full email address instead. In both cases the information is used only to direct you to the right place and is not stored, logged or shared. We rely on our legitimate interest in getting users to their organisation’s environment.
When you request a demo
Our demo form asks for your name, work email address and organisation. You may also give your job title, phone number and a message. We need the required fields to reply to you; without them we cannot handle your request. Please do not include sensitive information, such as health details, in your message.
We use this information to answer your request, arrange and hold the demo and follow up on it. We do not use it to send newsletters or marketing emails. The form is not stored on the Website’s server; it is delivered to our info@heravox.com mailbox through Microsoft 365.
Where you request a demo on behalf of your organisation, we rely on our legitimate interest in responding to and following up on that request. Where you request it for yourself, the processing is also necessary to take steps before entering into a contract with you.
When you email us
If you write to info@heravox.com, we use your name, email address and anything you include in your message to reply to you. We rely on our legitimate interest in responding to the people who contact us.
When you exercise your privacy rights
If you send us a request about your personal data, we use the details you provide to verify your identity, handle the request and keep a record showing how we dealt with it. We do this to meet our legal obligations and, where needed, to establish or defend legal claims.
Who we share your data with
We share personal data only where this is needed for the purposes above:
- Amazon Web Services, which hosts the Website in Istanbul.
- Microsoft, which provides our email and calendar services through Microsoft 365.
- Vanta, which runs our Trust Center, if you choose to visit it.
- Professional advisers, such as lawyers and accountants, where their advice requires it.
- Investors, buyers and their advisers, under confidentiality, if Heravox takes part in a financing, merger, acquisition or sale of assets.
- Courts, regulators and other public authorities, where we are legally required to, or where this is necessary to establish, exercise or defend our legal rights.
We do not sell or rent personal data.
International transfers
Website traffic is handled on our server in Istanbul. Demo requests and emails are kept in Microsoft 365, in Microsoft data centres outside Türkiye. Heravox Ltd is itself based in the United Kingdom.
For the purposes of the UK GDPR, our use of Amazon Web Services in Istanbul is covered by the AWS UK GDPR Addendum, which AWS’s service terms incorporate whenever the UK GDPR applies.
How long we keep your data
- Browsing data: not kept after your request is answered.
- Rate-limiting data: about one minute, in memory only.
- Error log entries: overwritten automatically as the 10 MB log fills up.
- Sign-in redirect data: not kept.
- Demo requests and emails: 12 months after our last contact with you, unless a customer relationship follows. If it does, we keep the relevant data for the periods set out in the customer agreement and its notices.
- Privacy requests: as long as needed to handle the request and to show that we handled it lawfully.
When data is no longer needed, we delete it or make it anonymous.
Cookies
The Website does not use cookies or similar technologies, and it does not save anything in your browser’s local storage. This is also true of the sign-in page. That is why you will not see a cookie banner or cookie settings on the Website. Our customer environments use their own cookies, which are explained in the notices for those environments.
If we ever add cookies or similar technologies to the Website, we will update this policy and, where the law requires it, ask for your consent before using them.
Our Trust Center
Our Trust Center at trust.heravox.com is a separate site that Vanta runs for us. The Website only links to it; no request is made to the Trust Center when you load our pages. If you visit the Trust Center, technical data such as your IP address and browser details is processed on the servers of Vanta and its infrastructure provider Cloudflare so that the page can be shown to you.
At present, the Trust Center shows public content only. It does not ask for any information, does not set cookies and saves only your language preference in your browser. If we start accepting document access requests there, we will update this policy first.
Children
The Website is intended for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18.
Your rights
You can exercise your rights by writing to info@heravox.com. We may ask you to confirm your identity before we act on a request.
Under the UK GDPR
You have the right to access your personal data and to have it corrected or erased. You can also ask us to restrict how we use it, object to processing based on our legitimate interests, and, where it applies, receive your data in a portable format. We normally reply within one month. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office (ico.org.uk).
Under the Turkish Personal Data Protection Law (KVKK)
If you are in Türkiye, Law No. 6698 on the Protection of Personal Data (“KVKK”) also applies. The legal grounds described above correspond to the following provisions of Article 5(2) of the KVKK: legitimate interest to (f), steps before entering into a contract to (c), legal obligation to (ç), and establishing or defending legal claims to (e). Under Article 11 of the KVKK, you have the right to:
- learn whether we process your personal data and, if so, request information about it;
- learn why we process it and whether it is used for that purpose;
- know the third parties in Türkiye or abroad to whom it has been transferred;
- ask us to correct it if it is incomplete or inaccurate;
- ask us to delete or destroy it under the conditions in Article 7 of the KVKK;
- ask us to inform those third parties of any correction, deletion or destruction;
- object to a result against you that arises solely from automated analysis of your data; and
- claim compensation if you suffer damage because your data was processed unlawfully.
KVKK requests should be made in Turkish, either in writing to our address above, by email to info@heravox.com from an email address you have previously given us and that is registered in our systems, or with a secure electronic or mobile signature. We will reply within 30 days. Requests are free of charge unless handling them involves a cost, in which case we may charge the fee set by the Turkish Personal Data Protection Board. If you are not satisfied with our reply, you can complain to the Board.
How we protect your data
The Website runs on its own server, separate from our customer environments. It has no database, keeps no visitor logs and makes no requests to third-party sites when you load a page. Connections to the Website are encrypted, and our rate limits and form filtering protect it against misuse. Only authorised people can access the info@heravox.com mailbox. If a security incident affects your personal data, we will inform you and the relevant authorities as the law requires.
Changes to this policy
We will update this policy when the way we handle personal data changes. The latest version will always be on the Website, with its date shown at the top.
Contact us
Heravox Ltd, 105 Thornsbeach Road, London SE6 1EY, United Kingdom. Email: info@heravox.com