Privacy Policy

This Privacy Policy explains what personal data HABACHA collects, why, how it is stored, and what rights you have. It applies to clients, suppliers, and visitors.

HABACHA is the "data controller" for the personal data described here.

1. Who is responsible for your data

Controller: HABACHA, registered in the Netherlands.
Contact for privacy matters: use the contact form and select "Legal, privacy, or GDPR request". We respond within 30 days.

2. What data we collect

2.1 From clients

• Full name.
• Email address.
• The details of your request (division, HB-Code, and any optional preferences you provide).

2.2 From suppliers

• Company name, contact email, and website URL.
• Unique contract link.
• A hashed version of your password (we never store the plain-text password).
• Division and application status.

2.3 From all visitors

• Technical data generated by your browser (IP address, browser type, pages visited), processed by our hosting provider (Vercel) for security and performance.
• Any data you voluntarily submit via the contact form.

2.4 What we do not collect

• We do not collect payment card data. Payments are handled directly between clients and suppliers.
• We do not collect ID documents, driver's licenses, or boat licenses. Those are verified by the supplier directly.
• We do not collect health, biometric, or other special category data.

3. Why we process your data (legal basis)

Processing activity	Legal basis (GDPR Art. 6)
Generating and emailing your HB-Code	Performance of a contract (6(1)(b))
Routing your request to the matched supplier	Performance of a contract (6(1)(b))
Supplier onboarding and commission tracking	Performance of a contract (6(1)(b))
Fraud prevention and platform security	Legitimate interest (6(1)(f))
Responding to your contact form	Legitimate interest (6(1)(f))
Password reset and service emails	Performance of a contract (6(1)(b))
Optional translation via Google Translate	Consent (6(1)(a))

4. How long we keep your data

• Client request data (HB-Codes): 24 months from the request date, then deleted.
• Supplier account data: for as long as the account is active. After termination, 7 years to comply with Dutch tax law, then deleted.
• Contact form submissions: 12 months, then deleted.
• Technical logs: 30 days, deleted by the hosting provider.

5. Who we share your data with

5.1 The matched supplier

When you submit a request, your name, email, HB-Code, and request details are sent to the supplier you are matched with. This is necessary for the supplier to contact you and complete the booking.

5.2 Service providers (sub-processors)

Provider	Purpose	Location
Supabase	Database (HB-Codes, requests, supplier accounts)	EU / US
Vercel	Hosting and content delivery	Global (primary US)
Resend	Transactional email delivery	US

We do not sell your data, and we do not share it with advertisers.

5.3 International transfers

Some providers are based in the United States. When data is transferred outside the European Economic Area, we rely on the European Commission's Standard Contractual Clauses (SCCs). You can request a copy through the contact form.

6. Your rights

Under the GDPR you have the following rights:

• Right of access — receive a copy of the personal data we hold about you.
• Right to rectification — have incorrect data corrected.
• Right to erasure ("right to be forgotten") — have your data deleted, subject to legal retention obligations.
• Right to restriction — limit how we process your data.
• Right to data portability — receive your data in a machine-readable format.
• Right to object — object to processing based on legitimate interest.
• Right to withdraw consent — where processing is based on consent, withdraw it at any time.

To exercise any right, use the contact form and select "Legal, privacy, or GDPR request". We respond within 30 days. We may ask you to verify your identity before acting.

7. Security measures

• All data is transmitted over HTTPS.
• Passwords are hashed with SHA-256 before storage. We cannot recover your password.
• Access to the database is restricted to the founder and protected by multi-factor authentication.
• Suppliers can only see the leads assigned to their own division.
• Payment data (card numbers, etc.) never reaches our servers — the platform does not process payments.

8. Children

HABACHA is intended for adults. We do not knowingly collect data from anyone under 18. If you believe a minor has submitted data through the platform, contact us and we will delete it.

9. Changes to this policy

We may update this Privacy Policy when our practices change. The "Last updated" date reflects the most recent change. If a change is material, we will notify active suppliers by email.