Privacy Policy

Univot ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services.

This policy complies with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

The data controller responsible for your personal data is:

We use your personal information for the following purposes:

• To provide services: Responding to inquiries, delivering consulting services, and managing projects
• To communicate: Sending updates, newsletters, and marketing communications (with your consent)
• To improve our website: Analyzing usage patterns and optimizing user experience
• For legal compliance: Meeting legal obligations and protecting our rights

Under GDPR, we process your personal data based on:

• Consent (Art. 6(1)(a) GDPR): For analytics via Google Tag Manager and for newsletter emails
• Contract: When necessary to provide services you've requested
• Legitimate interests: For business operations, fraud prevention, and website improvement
• Legal obligation: When required by law

We do not sell your personal data. We share it only with the following service providers (processors), who handle it on our behalf, and with others where the law requires:

• Hosting (Vercel Inc., USA): Our website is hosted on Vercel. When you visit, Vercel processes server log data such as your IP address, browser type and the pages requested, to deliver and secure the site.
• Analytics (Google Tag Manager and Google Analytics, Google Ireland Limited / Google LLC): Loaded only if you click Accept in our cookie banner. They help us understand which pages are useful. If you decline, these scripts are not loaded.
• Email delivery (DreamHost): Messages from our contact form and newsletter sign-up are sent through our email provider, DreamHost, and stored in our mailbox there.
• Scheduling (Calendly LLC, USA): We link to Calendly for booking calls. Calendly is not embedded on our site, so it only receives your data if you follow the booking link and enter your details there, under Calendly's own privacy policy.
• Legal authorities: When required by law or to protect our rights

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required by law.

• Contact form submissions: 3 years or until you request deletion
• Client project data: 10 years for tax and legal compliance
• Marketing data: Until you unsubscribe or request deletion

You have the following rights regarding your personal data:

• Right to access: Request a copy of your personal data
• Right to rectification: Correct inaccurate or incomplete data
• Right to erasure: Request deletion of your data (subject to legal obligations)
• Right to restriction: Limit how we process your data
• Right to data portability: Receive your data in a structured format
• Right to object: Object to processing based on legitimate interests
• Right to withdraw consent: Withdraw consent for analytics or newsletter emails at any time, with effect for the future

To exercise any of these rights, please contact us at hello [at] univot [dot] com

When you first visit, a banner asks whether you agree to analytics. Google Tag Manager, and the Google Analytics cookies it sets, load only after you click Accept. If you click Decline, or make no choice, no analytics scripts or cookies are loaded.

Changing or withdrawing consent: Use the "Cookie settings" link in the footer of any page. It clears your saved choice and shows the banner again, so you can decline. Withdrawal applies from that point on. You can also delete cookies and site data in your browser settings.

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction.

• SSL/TLS encryption for data transmission
• Secure hosting infrastructure
• Regular security assessments
• Access controls and authentication

However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security of your data.

Some of our service providers (Vercel, Google, Calendly and DreamHost) are based in the United States, so your data may be processed outside the European Economic Area (EEA). Where this happens, we rely on one of the following safeguards:

• Standard Contractual Clauses approved by the European Commission
• The EU-U.S. Data Privacy Framework adequacy decision, where the provider is certified under it

Our services are not intended for individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date.

We encourage you to review this policy periodically to stay informed about how we protect your data.

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:

You also have the right to lodge a complaint with a supervisory authority if you believe your data protection rights have been violated. The authority responsible for us is: