Privacy Statement

This statement explains how HAVIT, s.r.o. processes personal data in connection with the Goran website (goran.eu, goran.cz) and the Goran cloud application. We comply with Regulation (EU) 2016/679 (GDPR) and the Czech Personal Data Processing Act No. 110/2019 Coll.

1. Who processes your data

HAVIT, s.r.o., company ID 25612697, VAT ID CZ25612697, registered office Budějovická 778/3a, 140 00 Prague 4 – Pankrác, Czech Republic, registered in the Commercial Register kept by the Municipal Court in Prague, section C, file 54808.

For any personal data matter, contact us at info@havit.cz or +420 222 746 060. We have not appointed a Data Protection Officer, as the law does not require us to.

2. Two roles: the website and the application

• Goran website – for the data you send us through the website forms and for website usage data, we are the controller.
• Goran application – the data a customer and its users enter into the application (employees, timesheets, contacts, business cases, invoices, etc.) belong to the customer. The customer is their controller, and HAVIT processes them as a processor under the contract with the customer and on its instructions. For questions about this data, please contact the organization that uses the application first.

3. Goran website

Contact form and trial requests

When you fill in the contact form, we process your name, email address and message. When you ask for a Goran trial or to be contacted by sales, we process your email address. The data is emailed to our team and used only to reply to you and to prepare an offer or trial access.

• Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering your enquiry (Art. 6(1)(f) GDPR).
• Retention: 2 years from the last contact if no cooperation follows; if it does, the customer rules below apply.

Analytics and ad measurement

The website uses Google Analytics and Google Ads conversion tracking. Using cookies and similar technologies, these tools record which pages you visit, where you came from, your device and browser type, your approximate location derived from your IP address and whether you submitted a form. We only see the results as aggregated statistics and use them to improve the website and evaluate ad campaigns.

• Legal basis: our legitimate interest in measuring website traffic and ad effectiveness (Art. 6(1)(f) GDPR).
• Retention: 14 months at most.
• You can opt out by deleting and blocking cookies in your browser or by installing the Google Analytics Opt-out add-on.

Technical cookies and server logs

To run the website, we store a cookie with your chosen language, a security cookie that protects the forms against misuse and the technical data needed to connect your browser to the server. For security and troubleshooting, the server briefly logs technical data about each request (such as the IP address, time and requested address). We do not use this data to identify visitors.

4. Goran application

Data we process for the customer

• User accounts: users sign in with the customer's Microsoft Entra ID (Microsoft 365). Goran receives the user's name, email address and identifier from Microsoft; it does not store passwords.
• Application content: data that the customer and its users enter into the application or import from other systems.
• Operational and diagnostic data: records of requests, errors and performance (including the user identifier and IP address) that we need for security, incident resolution and support.

We use this data solely to provide, support and secure the service for the customer. We do not sell it, use it for our own marketing or use it to train artificial intelligence models. We access customer data only when support or incident resolution requires it, or at the customer's request.

AI assistants and other integrations

Goran can make data available to AI assistants (such as Claude) through the Model Context Protocol (MCP) and connect to other systems (such as Azure DevOps or an accounting system). Such connections are always turned on by the customer or the user. An assistant only receives data that the signed-in user is allowed to see in Goran, and only when it asks for it. The provider of the AI assistant or the connected system then processes the data under its own terms and the agreement the customer or user has with it.

Where the data is stored

Goran instances operated by HAVIT run in the Microsoft Azure cloud in data centers located in the European Union. Data is encrypted in transit (HTTPS) and access to it is restricted to authorized persons.

Customer and billing data

We process the contact and billing details of customers and their contact persons as a controller in order to perform the contract (Art. 6(1)(b) GDPR) and to meet our accounting and tax obligations (Art. 6(1)(c) GDPR). We keep them for the term of the contract and 4 years after it ends; accounting records for 10 years.

5. Who we share data with

• Microsoft – cloud hosting (Azure), sign-in (Entra ID), email and office tools.
• Google – website analytics and ad measurement.
• Accounting, tax and legal advisors, where needed.
• Public authorities, where the law requires it.

Some of these providers may process data outside the European Economic Area, typically in the USA. Such transfers rely on the European Commission's adequacy decision (EU–US Data Privacy Framework) or on standard contractual clauses.

6. Your rights

You have the right to:

• access your data and get a copy of it,
• have inaccurate data corrected,
• have your data erased,
• restrict processing,
• data portability,
• object to processing based on legitimate interest,
• withdraw your consent, where you gave it, without affecting earlier processing.

Send requests to info@havit.cz; we will handle them within one month. If they concern data in the Goran application, we will forward them to the customer who controls that data.

You also have the right to lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz, or with the supervisory authority in your EU member state.

7. Changes

We may update this statement, for example when Goran gains a new feature or we start using a new provider. The current version is always available on this page.