Privacy Policy
Last updated: June 2026
1. Data Controller
The data controller responsible for processing your personal data is:
Olive Projects
Email: info@oliveprojects.eu
Web: vcard.oliveprojects.eu
2. Data We Process
- Account data: email address, password (encrypted with bcrypt)
- Profile data: name, title, company, phone, email, website, social media
- Profile photo: image you upload (stored on our server)
- Technical data: session ID, IP address (in server logs, max 7 days)
We do not process any special categories of personal data (GDPR Article 9).
3. Purposes and Legal Basis
| Purpose | Legal basis |
|---|---|
| Providing the digital business card service | Contract (art. 6.1.b) |
| Authentication and account security | Contract (art. 6.1.b) |
| Sending welcome and password reset emails | Contract (art. 6.1.b) |
| Server logs for operational security | Legitimate interest (art. 6.1.f) |
4. Retention
- Account and profile data: until you delete your account
- Server logs: maximum 7 days
- Session data: 30 days
- Password reset tokens: 1 hour (automatically purged after 7 days)
5. Recipients and Third Parties
- Bahnhof AB (server hosting, Sweden) — servers located in Sweden within the EU/EEA. DPA in place.
- Resend Inc. (transactional email, USA) — data transferred under EU Standard Contractual Clauses (SCC). Resend's DPA.
6. Your Rights
- Access (art. 15): download your data via Settings → Download my data
- Rectification (art. 16): update your profile directly in the dashboard
- Erasure (art. 17): delete your account under Settings → Delete my account
- Portability (art. 20): download as JSON under Settings
- Objection (art. 21): contact us to object to processing based on legitimate interest
Contact us at info@oliveprojects.eu. We respond within 30 days.
7. Complaints to the Supervisory Authority
You have the right to lodge a complaint with the Swedish Authority for Privacy Protection:
Integritetsskyddsmyndigheten (IMY)
www.imy.se · imy@imy.se
8. Security
We protect your data with bcrypt-encrypted passwords, HTTPS encryption, UUID-based profile links, and session management via PostgreSQL. Our server is located in Sweden (Bahnhof, Stockholm).
9. Changes to This Policy
For material changes, we will notify active users by email at least 30 days in advance. The current version is always available on this page.