Legal
Privacy notice
Last updated:
Who we are and what this notice covers
Hivesco Innovation Software AB, Drottninggatan 61, 111 21 Stockholm, Sweden (“Hives”, “we”) is the controller of the personal data described in this notice. You reach us on data protection matters at alexander@hives.co.
This notice covers the processing for which Hives decides the purposes and means:
- visitors to www.hives.co;
- people who contact us, book a demo or subscribe to our updates;
- our customers’ representatives: the people who sign agreements, administer a Hives.co workspace, receive invoices or contact our support;
- aggregated statistics about how the service is used.
When we are a processor, not a controller
The ideas, comments, votes, attachments and user accounts inside a customer’s Hives.co workspace belong to that customer, usually your employer. For that data Hives acts as a processor on the customer’s instructions, under the Personal Data Processing Terms that form part of every customer agreement. If you want to exercise your rights over data in a workspace, contact the organisation that invited you; we help them respond. The sub-processors we use for that data are listed on our sub-processor page.
What we process, why, and for how long
Visiting www.hives.co
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Page views, referrer, browser and device type, country derived from a truncated IP address | Understanding which pages are read and where visitors come from, through Ahrefs Web Analytics, a cookieless tool that stores no personal data | Legitimate interest in operating and improving the website | Stored only in aggregated form |
| IP address, user agent, requested URL, time | Serving the site securely and diagnosing errors (web server logs at our hosting provider) | Legitimate interest in security and operation | Up to 30 days |
| Your language preference | Showing you the right language version | Necessary for the website to work as you asked | Stored in your browser until you clear it |
| LinkedIn Insight Tag: cookies and a hashed identifier read by LinkedIn on each page view | Measuring whether our LinkedIn campaigns lead to visits and demo requests, and reaching visitors of this site on LinkedIn | Our interest in measuring marketing. You can object at any time; see the cookies section for how to opt out | Set by LinkedIn; see the cookies section |
Contacting us, booking a demo, subscribing
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, email address, company, role and anything you write in a demo or contact form | Answering you, preparing and holding the demo, following up | Steps taken at your request before entering a contract, and our legitimate interest in responding to enquiries | 24 months after our last contact, longer if a customer relationship follows |
| Email address for our updates | Sending occasional product and company news | Consent, withdrawn by the unsubscribe link in every email | Until you unsubscribe |
| Email address for sub-processor notices | Notifying you at least 30 days before we change a sub-processor | Performance of the customer agreement that requires the notice | Until you unsubscribe or the customer agreement ends |
Customer relationship and billing
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, role, work email, phone number and employer of signatories, administrators and contact persons | Entering into and managing the agreement, provisioning the workspace, sending notices and product information relevant to the service | Performance of the agreement with the customer, and legitimate interest where the contact person is not the contracting party | Term of the agreement and up to 10 years after, for the limitation period of legal claims |
| Invoice recipient, reference, invoicing address, payment records | Invoicing and accounting | Performance of the agreement; legal obligation under the Swedish Bookkeeping Act | 7 years after the end of the financial year |
| Correspondence and contract documents | Keeping a record of what was agreed | Performance of the agreement; legitimate interest in documenting the relationship | Term of the agreement and up to 10 years after |
Support
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, email address, the content of support requests and our replies | Resolving the request and improving the service | Performance of the agreement; legitimate interest in resolving issues | 24 months after the request was closed |
Aggregated statistics
We compile statistics on how the service is used, such as which features are used and how the service performs. The statistics are anonymised so that they do not contain customer data and cannot be linked to any individual or customer. Once anonymised they are no longer personal data. The anonymisation itself rests on our legitimate interest in operating and improving the service.
Cookies and similar technologies
Our own analytics tool is cookieless and sets nothing. The only cookies on www.hives.co are set by LinkedIn through the LinkedIn Insight Tag, which loads on every page view. The following storage is used:
| Name | Type | Purpose | Duration |
|---|---|---|---|
| hives-locale | Browser storage (localStorage), necessary | Remembers the language version you chose | Until you clear your browser storage |
| Cookies set by LinkedIn, such as bcookie, lidc, UserMatchHistory and li_sugr | Third-party advertising cookies, set on every visit | Let LinkedIn measure conversions from our campaigns and, where you have a LinkedIn account, match visits to it. LinkedIn’s own use is described in LinkedIn’s cookie policy. | Up to 2 years, set by LinkedIn |
To stop LinkedIn from setting these cookies, block third-party cookies in your browser, use a tracker-blocking extension, or opt out of LinkedIn’s ad tracking in LinkedIn’s guest controls. None of this affects how the website works.
Who receives your data
We share personal data only with the service providers below, who process it on our instructions under written data processing agreements, and with authorities where the law requires it.
| Recipient | What for | Location |
|---|---|---|
| Google Ireland Limited (Google Workspace) | Email, documents and contract files | EU |
| Google Cloud EMEA Limited | Hosting of the Hives.co service and its database | EU (Frankfurt, Germany) |
| Netlify, Inc. | Hosting of www.hives.co and receipt of form submissions | United States, under Standard Contractual Clauses |
| Resend, Inc. | Sending transactional email from the service | United States, under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
| Ahrefs Pte. Ltd. | Cookieless website analytics; receives no personal data that is stored | Singapore, under Standard Contractual Clauses |
| LinkedIn Ireland Unlimited Company | Advertising measurement and audience building through the LinkedIn Insight Tag | EU, with onward transfer to LinkedIn Corporation in the United States under the EU-U.S. Data Privacy Framework |
| Our accountants and auditors | Bookkeeping and audit | Sweden |
We do not sell personal data and we do not use it to train AI models.
Transfers outside the EU and EEA
Our own systems and the Hives.co service run in the EU. Where a provider listed above processes data in the United States or Singapore, the transfer rests on an adequacy decision, including the EU-U.S. Data Privacy Framework where the provider is certified, or on the Standard Contractual Clauses adopted by the European Commission, together with supplementary measures where needed. You can ask us for a copy of the safeguards in place.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected and incomplete data completed;
- have your data erased where there is no longer a legal ground to keep it;
- restrict processing while a question about it is resolved;
- receive the data you gave us in a machine-readable format and have it transmitted to another controller;
- object to processing based on legitimate interest, and to direct marketing at any time;
- withdraw consent at any time, without affecting processing that took place before.
Write to alexander@hives.co. We answer within one month, and tell you if we need longer for a complex request. We may ask you to confirm your identity before releasing data.
Complaints
You can complain to a supervisory authority, in particular in the EU country where you live or work. In Sweden this is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), imy.se.
Changes to this notice
We update this page when our processing changes and show the date of the latest change at the top. Substantial changes affecting customers’ representatives are also announced by email to the contact persons named in the customer agreement.