Privacy policy

1. Who we are

Cloverity is operated by LLC “Cloverity”, a company registered in Ukraine under registration number 46030869, with its registered office at 77 Sichovykh Striltsiv St., office 803, Kyiv 04053, Ukraine (“Cloverity”, “we”, “us”, “our”).

For the purposes of the General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”) we are the controller of the personal data described in this policy. You can contact us about anything in it at hello@cloverity.co.

2. Scope

This policy applies to the website at cloverity.co, including its Ukrainian-language pages, and to the business contact data we receive when you write to us or book a call.

It covers this website only — not the systems we build for clients, which are governed by the contract for that project. Where we process personal data inside a client's system we act as a processor on that client's documented instructions, and that client, not us, is the controller.

It does not cover third-party websites we link to. Once you follow a link you are on someone else's site, under their own policy.

3. What data we collect

We collect the following categories of personal data:

• Technical and usage data — your IP address, the approximate location looked up from it by one of the services listed in section 6, your device and browser type, the pages you view, the site or search that referred you, and a small number of click events such as pressing “book a call”.
• Business identification data — the organisation your IP address is attributed to and, where our identification tools can establish it, a professional profile associated with the visit.
• Contact data you provide — the email address and message you submit through the contact form, and any details you enter when booking a call.
• Your consent record — whether you accepted or declined optional analytics, kept so that we do not ask you again.

4. Why we process it, and on what legal basis

Consent — Article 6(1)(a) GDPR. Google Analytics, RB2B and the cookies set by Leadfeeder (Dealfront) are used only if you press Accept on the consent banner. We use them to understand where our visitors come from, which pages they read, and which organisations are interested in our services. You may withdraw your consent at any time, as described in section 5; withdrawal does not affect the lawfulness of processing carried out before you withdrew it.

RB2B is described separately because it goes further than the others: it is the only tool on this site capable of identifying you as an individual rather than only the organisation you visit from. It is not loaded at all unless you accept.

Legitimate interests — Article 6(1)(f) GDPR. Umami Cloud and Cloudflare Web Analytics run for every visitor and store nothing in your browser. Leadfeeder's identification of the organisation behind an IP address also runs for every visitor: it happens on your first page view, before you answer the banner, and declining does not switch it off — the banner controls Leadfeeder's cookies, not its company lookup. Our legitimate interest is in understanding which pages of a business-to-business site are read and by what kind of organisation, and in keeping the site available and fast. We have weighed that against your interests: this processing produces aggregate or organisation-level reporting rather than a profile of you as an individual. You have the right to object to it — see section 9.

Legitimate interests and pre-contractual steps — Articles 6(1)(f) and 6(1)(b) GDPR. When you send us a message or book a call, we process what you give us in order to reply to you and to discuss possible work.

We do not use personal data for automated decision-making producing legal or similarly significant effects, and we run no advertising or retargeting pixels on this site. We do not ask for, and do not knowingly collect, special categories of personal data.

5. Cookies and consent

This site uses cookies and equivalent browser storage only for the analytics described above. There are no advertising cookies.

Some measurement runs for every visitor and stores nothing in your browser. What the consent banner controls is this:

• Google Analytics — not loaded at all unless you accept.
• RB2B — not loaded at all unless you accept.
• Leadfeeder (Dealfront) — sets no cookies unless you accept. Its identification of the organisation you visit from runs either way, before you answer the banner, and declining does not switch it off.
• Your answer either way — accepting and declining are both recorded, by us and by Leadfeeder, so that the banner and the trackers stop asking.

Reset my consent choice

7. International transfers

We are established in Ukraine, which is outside the European Economic Area. Most of the recipients listed above are established in the United States: Google, Cloudflare, RB2B, Web3Forms and Umami Software. NeetoCal is operated from the United States and India. Dealfront (Leadfeeder) is established in the European Union and processes the data there. ip-api.com is operated from Romania, also in the European Union, but answers requests from a global network whose locations it does not publish.

Where personal data is transferred outside the European Economic Area, we rely on the transfer mechanism the provider offers in its data processing terms — in practice the standard contractual clauses adopted by the European Commission and, for some providers, their certification under the EU–US Data Privacy Framework. Data protection law in those countries is not identical to EU law, and public authorities there may have rights of access that differ from those in the EEA. You can obtain details of the safeguards applying to a particular transfer by writing to us.

If this matters to you, declining the banner keeps Google Analytics and RB2B off entirely, and the remaining tools can be blocked with a content blocker or your browser's tracking protection.

8. How long we keep it

We do not host analytics data ourselves. Each provider retains it under its own settings and deletes it on its own schedule; we keep no separate copy of visitor-level analytics data.

Cookies expire on their own: the RB2B session identifier after 30 minutes, the Leadfeeder identifier and the record of your consent answer after about a year, the RB2B visitor identifier after 360 days and the Google Analytics cookies after 400 days. You can delete all of them sooner by clearing cookies and site data for cloverity.co in your browser.

Emails you send us through the contact form, together with our replies, are kept for 24 months from the last message in the exchange and then deleted — unless the exchange leads to a contract, in which case the retention terms of that contract apply instead.

Your consent choice stays in your browser's local storage until you clear it or use the button in section 5.

9. Your rights

To exercise any of the rights below, write to us at hello@cloverity.co. We will respond within one month of receiving your request. If the request is complex, or you have made several, we may extend that period by up to two further months and will tell you within the first month if we do. We may ask you for information to confirm your identity. Exercising these rights is free of charge.

In relation to personal data we hold about you, you have the following rights:

• Access — to be told whether we process your personal data and to receive a copy of it.
• Rectification — to have inaccurate data corrected and incomplete data completed.
• Erasure — to have your personal data deleted where there is no overriding reason for us to keep it.
• Restriction — to have our processing limited while a dispute about accuracy or lawfulness is resolved.
• Objection — to object at any time to processing based on our legitimate interests, including the organisation-level identification described in section 4, and at any time to processing for direct marketing.
• Portability — to receive the data you provided to us in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible.
• Withdrawal of consent — to withdraw your consent at any time, without affecting processing already carried out on the basis of it.
• Complaint — to lodge a complaint with a supervisory authority, as set out in section 10.

10. Complaints

If you believe we have handled your personal data unlawfully, you have the right to lodge a complaint with a supervisory authority. Our supervisory authority is the Ukrainian Parliament Commissioner for Human Rights, Ukraine's data protection authority. If you are in the European Economic Area you may also complain to the supervisory authority of the country where you live, where you work, or where the alleged infringement took place.

We would rather hear from you first, at hello@cloverity.co, so that we have the chance to put it right.

11. Children

This is a business-to-business website. It is not directed at children and we do not knowingly collect personal data from anyone under 16.

If you believe a child has provided us with personal data, write to us and we will delete it.

12. Security

We keep the amount of personal data we hold deliberately small: we run no analytics database of our own, and the contact form is delivered to an email inbox rather than to a system we operate. The site is served over HTTPS, and access to that inbox is limited to the people who need it.

No method of transmitting or storing data over the internet is completely secure, and we do not claim otherwise.

13. Changes to this policy

We may update this policy when the site, the tools on it, or the law change. The current version is always at this address, and the date it was last changed is shown at the top of the page.

Where a change materially affects how we use personal data we will make it prominent on the site, and where it concerns a tool covered by the consent banner we will ask for your consent again.