Privacy Policy
Last updated: June 2026
1. Introduction
Handeva ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our video consultation platform connecting homeowners with skilled tradespeople in the DACH region.
We process your personal data in accordance with the General Data Protection Regulation (GDPR — EU 2016/679) and the German Federal Data Protection Act (BDSG).
2. Data Controller
Handeva UG (haftungsbeschränkt)
[Registered Address — to be completed]
Email: privacy@handeva.com
3. Data We Collect
3.1 Account Information
When you register, we collect your name, email address, phone number (optional), and account role (homeowner or tradesperson). If you register as a tradesperson, we additionally collect your business name, service categories, location, and verification documents.
3.2 Booking & Consultation Data
When you book a video consultation, we collect the service requested, scheduled time, communication notes, and transaction records. Video consultations may be recorded with your explicit consent.
3.3 Payment Information
Payment processing is handled by Stripe. We do not store full credit card numbers. We retain transaction IDs, payment amounts, and payment status for accounting and dispute resolution purposes.
4. Legal Basis for Processing
We process your data under the following GDPR legal bases:
- Art. 6(1)(a) — Your consent (e.g., marketing communications, video recording)
- Art. 6(1)(b) — Contract performance (e.g., account registration, booking services)
- Art. 6(1)(c) — Legal obligations (e.g., tax records, regulatory compliance)
- Art. 6(1)(f) — Legitimate interests (e.g., fraud prevention, platform security)
5. Data Storage & Security
Your data is stored on servers located in Frankfurt, Germany (AWS eu-central-1). We implement appropriate technical and organizational measures including:
- Encryption in transit (TLS 1.3) and at rest (AES-256)
- Access controls and audit logging for sensitive operations
- Regular security assessments and penetration testing
- Data minimization — we only collect what is necessary
6. Your Rights
Under the GDPR, you have the right to:
- Access — Request a copy of your personal data (Art. 15)
- Rectification — Correct inaccurate data (Art. 16)
- Erasure — Request deletion of your data (Art. 17)
- Restriction — Limit processing of your data (Art. 18)
- Portability — Receive your data in a machine-readable format (Art. 20)
- Objection — Object to processing based on legitimate interests (Art. 21)
- Withdraw Consent — Withdraw consent at any time (Art. 7(3))
7. Data Retention
We retain your personal data only as long as necessary:
- Account data: until account deletion (plus 30-day grace period)
- Booking records: 3 years after the consultation (for dispute resolution)
- Payment records: 10 years (German tax law requirement)
- Video recordings: 30 days from recording date unless extended by consent
8. Third-Party Services
We use the following service providers who may process your data:
- Stripe — Payment processing (Stripe Payments Europe, Ltd.)
- Daily.co — Video streaming infrastructure (EU servers)
- Pusher — Real-time notifications (EU cluster)
- Vercel — Application hosting (EU region — fra1)
- PostgreSQL — Database hosting (AWS eu-central-1)
All processors are bound by Data Processing Agreements (DPAs) compliant with Art. 28 GDPR.
9. Contact
For privacy-related inquiries or to exercise your rights, contact:
Email: privacy@handeva.com
You have the right to lodge a complaint with your local data protection supervisory authority.