1. Name and Contact Data of the Controller
This privacy policy applies to the data processing by:
Controller: Hyvä Themes B.V.
Dutch CoC: 80794343
VAT id: NL861802329B01
Directors: Willem Wigman
Address: Kloosterweg 1, 6412CN, Heerlen, The Netherlands
Email: info@hyva.io.
2. Collection and storage of personal data as well as manner and purpose of their use
a) When visiting the website
When you open our website on your terminal device, the used browser will automatically send data to the server of our website. This information will be stored temporarily in a so called log file. The following information will automatically be stored:
IP address of the terminal device,
Date and time of the request,
Name and URL of the requested file,
Website from which access is obtained (Referrer URL),
used browser and the operating system of your terminal device as well as the name of the access provider.
The listed information will be processed by us with the following purpose:
To ensure a smooth connection to our website,
To ensure a comfortable use of our website,
To evaluate the system security and stability as well as
further administrative purposes.
The the legal basis of the processing is GDPR Art. 6(1). Our legitimate interest follows from the above listed purpose of the data gathering. In no case will we use the collected data to draw conclusions to your person.
Furthermore, we use website cookies as well as analysis services for website visitors. Further information can be found here under numbers 4. and 5. of this privacy policy.
b) When signing up for our newsletter
If you have given explicit consent according to GDPR Art 6(1)(a), we will use your email address to regularly send you our newsletter. In order to receive the newsletter, it is sufficient to provide an email address. The newsletter is sent out as follows:
When you sign up for the newsletter, we send you an email to confirm your email address. Thereby we are able to confirm that you are the owner of that address and consent to receive the newsletter. Further information is not gathered. This data is only used for the sending of our newsletter and will only be shared with the newsletter service MailChimp.
When signing up for the newsletter, your IP address will be saved as well as the date of the sign-up. This data storage serves solely the purpose to prevent the sign-up of your email address by an unauthorized third party.
The newsletter can be unsubscribed and revoked at any time by the customer without any costs. The revocation can be done via the link included in the newsletter itself or with a message to the above listed contact.
c) When using the contact form
For questions of any kind we offer the possibility to use the contact form provided on the website. It is necessary to provide a valid email address and your name so we know who send the request and so we are able to reply.
Further information can be provided but is not required.
The data will be transferred in an encrypted manner.
The data processing for the purpose of contacting you happens in accordance with GDPR Art 6(1)(a) based on your voluntarily provided consent.
The personal data obtained for the use of the contact form will be deleted once your request as been solved.
d) When creating an account and purchasing our products
When you create an account, purchase a license, or subscribe to our services, we collect necessary B2B information such as your name, company name, email address, and billing details. We process this data to provide our services, fulfill our contractual obligations, and manage our customer relationships. This data is securely stored in our Accounting Software and Customer Relationship Management (CRM) systems. The legal basis for this data processing is the performance of a contract according to GDPR Art 6(1)(b) and our legitimate interest in managing our business operations (GDPR Art 6(1)(f)).
e) Payment Processing (Mollie)
For the processing of online payments, we use the external payment service provider Mollie. When you make a purchase, the payment details you provide are processed directly via Mollie’s secure environment. We do not process or store your full credit card or bank details on our own servers. Mollie acts as an independent Data Controller for this payment data. The data processing is strictly necessary for the fulfillment of our contract with you (GDPR Art 6(1)(b)). For more information on how Mollie handles your personal data, please refer to Mollie's privacy policy.
f) Community and Development Platforms (Slack & GitLab)
As a Hyvä customer or partner, you may optionally join our community and access our code repositories via Slack and GitLab. If you choose to create an account and participate, your name, email address, and any profile information you provide will be processed.
GitLab: Our GitLab environment is self-hosted on our own virtual private servers provided by Hetzner (located in the EU). Your data in GitLab remains under our strict and direct control.
Slack: Slack is a third-party service. Please review Slack's privacy policy for more details on how they handle your data.
This processing is based on your consent and the performance of our services (GDPR Art 6(1)(a) and (b)).
3. Sharing Data
A transmission of your personal data to third parties only happens for the purposes listed below.
We only disclose your personal data to third parties if:
you have given us explicit consent based on GDPR Art 6(1)(a),
the disclosure is necessary due to the establishment, exercise or defense of legal claims in accordance with GDPR Art 6(1)(f) and when there is no reason to assume that you have an overriding and legitimate interest in the non-communication of your data,
there is a case of a legal obligation according to GDPR Art 6(1)(c), as well as
it is permitted by law and according to GDPR Art 6(1)(b) necessary for the processing of a contractual relationship with you.
the disclosure is necessary for the provision of our services and business operations, in which case we share specific data with trusted third-party service providers (such as our Accounting Software Moneybird, CRM provider Attio, our payment processor Mollie, and our cloud infrastructure provider Hetzner). These providers act under our strict instruction as Data Processors or as independent Data Controllers in accordance with GDPR Art 6(1)(b) and (f).
4. Cookies
We use cookies on our website. These are small files which your browser automatically creates and stores on your terminal device (laptop, tablet, smart phone, etc.) when you visit our website. Cookies do not harm your device.
In these cookies, information is stored based on the context of your specific terminal device. However, this does not mean that we thereby obtain knowledge of your identity.
The use of cookies serves the purpose to make the use of our offerings more comfortable. We use so called session cookies to recognize which particular site of our website you have already visited. These will be automatically deleted when you leave our site.
Moreover, we use temporary cookies to optimize the usability. These are stored for a defined period of time on your device. If you visit our website again, these cookies automatically recognize that you have been on our site before and which entries and settings you made, so you do not have to do them again.
We also use cookies to create statistics about the usage of our website, in order evaluate the optimization of our offering for you. (see number 5) These cookies allow us to recognize returning visitors and these cookies will be deleted automatically after a predefined period of time.
The data processed by cookies are necessary for the named purposes for the protection of our legitimate interests and the legitimate interests of third parties based on GDPR Art 6(1)(f).
Most browsers accept cookies automatically. You can configure your browser in a way that it does not store cookies on your device or so that it prompts a notice before creating a new cookie. The complete deactivation of cookies may lead to you being unable to make us of all features on our website.
5. Analysis Tools (Tracking Tools)
The following listed and used tracking measures are executed based on GDPR Art 6(1)(f). With the use of these tracking measures we want accomplish a needs-based design and a continuous optimization of our website. Further, we use tracking tools to statistically evaluate the use of our website and to optimize our offerings. These interests are to be regarded valid in the aforementioned regulation.
The specific purpose of the data processing and data categories can be found under the listed tracking tools.
a) Matomo Analytics (Self-Hosted)
We use Matomo, an open-source web analytics platform, to measure and analyze the usage of our website. To protect your privacy, we self-host Matomo on our own virtual private servers provided by Hetzner (located in the EU). This means that all analytics data remains entirely under our direct control and is not shared with third parties (like Google).
We use first-party cookies to collect data such as your IP address (which is anonymized), browser information, and the pages you visit. The information generated by these first-party cookies is used solely to evaluate website usage, improve our offerings, and ensure a seamless user experience. This processing is based on our legitimate interest in continuously optimizing our website (GDPR Art 6(1)(f)).
6. Online Services
Based on GDPR Art 6(1)(f) we use the online services and advertisement features of the following companies on our website with the purpose of an optimal marketing of our offerings. The promotional purpose behind it is to be regarded as a legitimate interest within the meaning of GDPR. The responsibility for the running these plug-ins in compliance with data privacy laws is guaranteed by the specific providers.
a) Google reCAPTCHA
On this website we use the function „reCAPTCHA“ by the provider Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, to recognize bots (e.g. for contact forms).
Further information about the privacy policy of Google can be found here:
https://www.google.com/policies/privacy/
7. Rights of the Individuals Affected
You have the right to obtain from us:
access to your personal data (GDPR Art 15),
the rectification of your personal data (GDPR Art 16),
the erasure of your personal data (GDPR Art 17),
the restriction of the processing of your personal data (GDPR Art 18) and
the portability of your personal data (GDPR Art 20).
You also have the right to revoke given consent at any time in accordance with GDPR Art 7(3). This means that we are no longer allowed to continue the processing of the data which was based on said consent.
You also have the right to lodge a complaint with a supervisory authority in accordance with GDPR Art 77, if you are of the opinion that the processing of your data was done unlawfully. Usually, you can direct your complaint to the supervisory authority of your usual residence or workplace or our location.
8. Right to Object
If your personal data has been processed based on the legitimate interest based on GDPR Art 6(1)(f), you have the right to declare your objection as stated in GDPR Art 21, if there are reasons present which result from your special situation or if the objection is directed against direct advertising. In the latter case you have a general right to object, which will be followed without the need to disclose a special situation.
If you would like to make use of your right to object or your right to revoke, it is sufficient to send us an email to the address provided in the imprint.
9. Data Security
During your visit to our website, we use secure, modern encryption methods (such as TLS) in connection with the highest encryption level supported by your browser (generally 256-bit encryption). You can recognize that a single page of our website is transmitted securely by the closed display of the lock symbol in the status bar of your browser.
In general, we use the appropriate technical and organizational security measures to secure your data from accidental or intentional manipulation, partial or complete loss, destruction or unauthorized access by third parties. Our security measures are constantly adjusted and improved to be in accordance with technological advancement.
10. Actuality and Change of this Privacy Policy
This privacy policy is currently valid and was last updated in August 2026.
Due to the further development of our website and offerings or due to changed legal or official requirements it may be necessary to change the privacy policy. The current privacy policy is available at any time on this website for you to view and print.
