Privacy policy

This page describes how the harvest.agency website collects and processes the personal data of its visitors. This English version is a translation; the French version prevails. Last updated: September 2026.

Data controller

The data controller is HA! (Harvest Agency), 21 rue d’Algérie, 69001 Lyon, France. For any question about your data, write to or call 04 82 53 39 99. Full company details are given in the legal notice (in French).

Data collected and purposes

Contact form : name, email address and message content. This data is used solely to handle your enquiry. Legal basis: your consent, given by submitting the form and ticking the accompanying consent box.
Audience measurement : pages viewed, referral source, device type, aggregated by Google Analytics 4. Legal basis: your consent, collected through the cookie banner. No measurement takes place if you decline.
Crisp contact chat : content of the conversation and a technical session identifier, if you open the chat window. Legal basis: your consent. The chat is not loaded until you have accepted.
Form protection : the hCaptcha service analyses your browsing on the form page to tell a human submission from an automated one. Legal basis: our legitimate interest in protecting the site against abusive submissions.
Server logs : IP address, date, requested page and browser, kept for security and troubleshooting. Legal basis: our legitimate interest in keeping the service secure.

Recipients and processors

Your data is never sold or transferred. It is accessible to the Harvest Agency team and to the following technical providers, acting as processors:

OVH SAS (France): hosting of the website and of messages received.
Google Ireland Limited : Google Analytics 4 audience measurement, only after consent.
Crisp IM SAS (France): contact chat, only after consent.
Intuition Machines, Inc. : hCaptcha form protection service.

Transfers outside the European Union

Google Analytics and hCaptcha processing may involve transferring data to the United States. These transfers are covered by the European Commission’s standard contractual clauses and, for the organisations concerned, by the EU-US Data Privacy Framework. Website hosting and the Crisp chat remain in France.

Retention periods

Messages received through the contact form: 3 years from the last exchange.
Audience measurement: 14 months maximum.
Audience measurement cookies: 13 months maximum.
Record of your cookie choice: 6 months.
Server logs: 12 months.

Your rights

You have the right to access, rectify, erase, restrict and object to the processing of your data, as well as the right to data portability and the right to withdraw your consent at any time. To exercise these rights, write to stating your request. You will receive a reply within one month.

If, after contacting us, you believe your rights are not being respected, you may lodge a complaint with the CNIL, the French data protection authority, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or via www.cnil.fr.

Cookies and trackers

On your first visit, a banner lets you accept or decline non-essential cookies. Declining is as easy as accepting, and the site remains fully accessible if you decline. Until you have accepted, no audience measurement or chat cookie is set.

You can change your choice at any time from the “Manage cookies” link in the footer, or by deleting the site’s cookies in your browser settings.

Security

The site is served exclusively over HTTPS. Access to the administration area is restricted and protected against automated intrusion attempts. Backups are encrypted and stored outside the server’s public web root.