Privacy Policy

1. Who we are

Harvex ("Harvex", "we", "our", "us") operates a B2B trade management platform for the fresh produce industry. For the processing described in this policy, Harvex is the controller unless section 3 says otherwise.

• Company name: Harvex
• Company number: BE1036228333
• Address: Grotesteenweg 131 #26, 2600 Antwerp, Belgium
• Email: info@harvextrading.com
• Phone: +32 475 61 56 41
• Website: www.harvextrading.com

We have not appointed a Data Protection Officer, as we are not legally required to do so. Privacy questions and requests are handled directly by our management team at info@harvextrading.com.

2. When this policy applies

This policy applies to visitors of our website, people who request a demo or otherwise contact us, users of the Harvex platform (buyers, suppliers and their colleagues), and contact persons at the companies we work with.

It does not apply to the websites, platforms or systems of your trading partners, or to third-party websites we link to, such as LinkedIn. Those parties process your data under their own privacy policies.

3. Our role: controller and processor

Harvex acts as a controller when we decide why and how personal data are processed. That is the case for our website, demo requests, marketing, customer administration, account management, billing and support.

Harvex acts as a processor for the content our customers put into the platform, such as trade programs, orders, quality reports, documents and the details of their own employees and trading partners. In that case your employer, or the company that invited you to the platform, is the controller. We process those data only on their documented instructions and under a data processing agreement.

We do not review or monitor whether our customers comply with their own privacy policies. If your request concerns data we process as a processor, we will refer you to the customer that is the controller and support them in answering you.

4. Where your personal data come from

• Directly from you: when you request a demo, contact us, create an account, or use the platform.
• From your employer or a trading partner: for example when your company creates a user account for you, or lists you as the contact person for an order or a trade program.
• Generated by us: account, usage and support history, and notes in our CRM about why you are interested in our services.
• From third-party and public sources: business information from company registers, company websites and professional networks such as LinkedIn, used for B2B prospecting. Those parties are responsible for providing us with data lawfully.

5. What personal data we process

We collect only what we need to run our business and deliver the platform. Depending on your relationship with us, this includes:

• Identity and contact data: name, job title, employer name, business email address, business phone number and business address.
• Company and trade data: VAT or company registration number, and the trade information, certificates and documents uploaded to the platform.
• Account data: login credentials (passwords are stored in hashed form), roles and permissions, language and notification preferences.
• Communication data: your demo request, emails, WhatsApp messages, support requests and our replies.
• Usage data: the actions you take on the platform, such as orders placed, documents uploaded and defects logged, with the related timestamps.
• Technical data: IP address and the approximate region derived from it, device and browser type, operating system, pages viewed, and server and security logs.
• Marketing data: your subscription status and communication preferences.

We do not process special categories of personal data, such as health or biometric data, and we ask you not to upload them to the platform.

6. Why we process your data and on what legal basis

• Providing and operating the platform, including accounts, orders, documents and notifications — performance of a contract with you or with your employer.
• Answering demo requests, quotes and questions — steps taken at your request before entering into a contract, and our legitimate interest in responding to business enquiries.
• Customer administration, invoicing and collection of unpaid invoices — performance of a contract and compliance with our legal obligations.
• Support, service messages and maintenance — performance of a contract and our legitimate interest in a reliable service.
• Security, fraud prevention, logging and backups — our legitimate interest in protecting the platform, our customers and their data.
• Understanding how our website and platform are used, and improving them — our legitimate interest in developing services that fit our users' needs.
• Sending marketing communications to business contacts — your consent, or our legitimate interest in promoting similar services to existing customers. You can opt out at any time.
• Complying with accounting, tax and other legal obligations, and answering lawful requests from authorities — compliance with a legal obligation.

Where we rely on legitimate interest, we have weighed that interest against your rights and freedoms. You can object to such processing at any time (see section 14).

7. What we do not do

• We do not sell or rent your personal data to anyone for advertising or marketing purposes.
• We do not process payments and never ask for or store bank or card details. Payments are settled directly between trading partners through their own banking arrangements.
• We do not use your personal data for automated decision-making or profiling that produces legal effects for you or similarly significantly affects you.
• We do not knowingly collect data from children. Our services are aimed at businesses and our website is not directed at anyone under 16. If we learn that we have collected such data, we will delete it — please contact us at info@harvextrading.com.

8. Who we share your data with

We share personal data only where it is necessary, and only with:

• Your trading partners on the platform: when you set up a trade program or place, confirm or discuss an order, the relevant contact and trade details become visible to the companies you have chosen to work with. Companies you are not connected to cannot see your data.
• Colleagues in your own company account: according to the roles and permissions your company has configured.
• Our service providers (processors): the providers listed in section 9, who act only on our instructions and are bound by a data processing agreement.
• Professional advisers: accountants, auditors, insurers and lawyers, where necessary and subject to confidentiality.
• Public authorities: tax authorities, supervisory authorities and law enforcement, where we are legally required to disclose data, or where disclosure is needed to enforce our agreements or to protect the rights and safety of our users, our staff or ourselves.
• A buyer or investor: if Harvex is involved in a merger, acquisition or transfer of all or part of its business. We will inform you, and your data remain protected by this policy.

We may also produce aggregated, anonymised statistics about how our services are used. These no longer identify you and may be shared, for example with partners or in marketing material.

9. Service providers and where your data are stored

We work with a small number of trusted providers to run our website and platform:

• Supabase — database, authentication and file storage, hosted in the European Union.
• Vercel — hosting of our website and platform, served from the European Union.
• Resend — sending transactional emails such as demo requests and platform notifications.
• Microsoft 365 (Outlook) — business email and customer administration.
• WhatsApp (Meta) — optional communication channel when you choose to contact us that way. Your use of WhatsApp is also governed by Meta's own privacy policy.

Your data are stored in the European Union. Some of our providers are US-based companies whose staff may access data from outside the EEA for support or maintenance. Where such a transfer takes place, it is covered by appropriate safeguards under Article 46 GDPR — in particular the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. You can request details of the safeguards we have in place at info@harvextrading.com.

10. The Harvex ERP helper browser extension

Customers whose ERP runs in a web browser can install our browser extension, the Harvex ERP helper, to enter purchase orders from the Harvex platform into their ERP. It only acts when a user starts it from the Harvex platform, and only on the Harvex platform and on the one ERP website the user allows in their browser.

• What it records: while a user records how a purchase is entered in their ERP, which field of the ERP's purchase form they filled with which value, which buttons they clicked, and, after saving, where the ERP shows the order number. It does not record keystrokes or mouse movements, never records passwords, and records nothing outside the ERP website the user allowed.
• What it does: when a user pushes an order, it fills those fields with the order's data, saves the purchase in the ERP when the user's recording included saving, and passes the order number the ERP shows back to the Harvex platform.
• Where the data go: only to the user's own Harvex account, over an encrypted connection, to learn and complete their pushes. They are kept with their company's platform data and handled as described in this policy; for that data we act as a processor on behalf of the customer (see section 3).
• What it does not do: it does not track browsing, does not sell or share data with third parties, and does not use data for advertising or for anything other than entering purchases.
• Your control: you can withdraw the extension's access to your ERP website, or remove the extension, at any time in your browser.

11. How long we keep your data

We keep personal data only for as long as necessary for the purposes described above, unless the law requires otherwise:

• Account and platform data: for as long as your company's account is active, and up to 12 months after it is closed.
• Trade programs, orders, documents and other customer content: for as long as instructed by the customer that is the controller, and in line with the retention periods that apply to their administration.
• Invoicing and accounting records: 7 years, as required by Belgian law.
• Demo requests and prospect data in our CRM: up to 24 months after our last meaningful contact.
• Marketing data: until you unsubscribe, after which we keep a minimal record so that we can honour your opt-out.
• Technical and security logs: up to 12 months.

12. Cookies and similar technologies

Our website uses only strictly necessary cookies, for example to route requests and keep the site secure. We do not use advertising cookies and we currently do not run third-party analytics or tracking on our website, which is why you do not see a cookie banner.

The Harvex platform uses essential cookies and local storage to keep you signed in, secure your session and remember practical preferences such as your language. If we ever introduce analytics or other non-essential cookies, we will ask for your consent first.

Read our Cookie Policy

13. How we protect your data

We apply technical and organisational measures to protect personal data against destruction, loss, alteration, unauthorised access and any other unlawful processing. These include encryption in transit and at rest, hashed passwords, role-based access control, strict separation between company accounts on the platform, logging, regular backups, and access limited to the people who need it. Our staff and the third parties we engage are bound by confidentiality obligations.

No system can be completely secure. If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify you and the competent supervisory authority within the deadlines set by the GDPR.

14. Your rights under the GDPR

You have the following rights in relation to the personal data we process about you:

• Right of access — ask whether we process your data and receive a free copy, together with information about the purposes, the categories of data, the recipients, the retention period, the source of the data and whether automated decision-making is involved.
• Right to rectification — have incomplete, inaccurate or outdated data corrected.
• Right to erasure ('right to be forgotten') — have your data deleted, for example when they are no longer necessary, when you withdraw your consent, when you object and no overriding grounds remain, or when they were processed unlawfully.
• Right to restriction — ask us to limit the processing, for example while we verify the accuracy of your data or assess an objection.
• Right to data portability — receive the data you provided to us in a structured, commonly used and machine-readable format, where the processing is based on consent or on a contract.
• Right to object — object to processing based on our legitimate interest, and object to direct marketing at any time, without giving a reason.
• Right to withdraw consent — withdraw your consent at any time. This does not affect the lawfulness of the processing that took place before the withdrawal.

To exercise your rights, email info@harvextrading.com. We may ask for information to verify your identity, and we will reply within one month of receiving your request. Our reply is free of charge unless a request is manifestly unfounded or excessive. If your request concerns data we process on behalf of a customer (see section 3), we will forward it to that customer. If you believe we do not handle your data correctly, please contact us first — we will do our best to resolve it. You also have the right to lodge a complaint with the Belgian Data Protection Authority: Gegevensbeschermingsautoriteit, Drukpersstraat 35, 1000 Brussels, +32 (0)2 274 48 00, contact@apd-gba.be. If you live or work in another EU country, you can also contact your local supervisory authority.

15. Marketing communications

We may send you occasional updates about Harvex: new features, product news and invitations to events. You can unsubscribe at any time using the link in every email or by emailing info@harvextrading.com. You will still receive essential service messages about your account, such as security, billing or availability notices, as these are part of the service.

16. Changes to this policy

We may update this Privacy Policy from time to time, for example when we add features or change providers. The current version is always available on this page, with the date of the last update at the top. If a change materially affects you — for example a change to the legal basis on which we process your data — we will notify you by email or through the platform and, where required, ask for your consent again.

17. Contact

For any question, request or complaint about this Privacy Policy or the way we handle your personal data, contact us at info@harvextrading.com or write to Harvex, Grotesteenweg 131 #26, 2600 Antwerp, Belgium.