Privacy Policy

Introduction

Harvst Capital ("we", "us", or "our") is committed to protecting the privacy of individuals who interact with our platform and to handling personal data with transparency, integrity, and in accordance with applicable law.

This Privacy Policy describes how we collect, use, store, and disclose personal information in connection with the Harvst Capital platform, website, and associated services (collectively, the "Service"). It applies to all visitors and authenticated users of the Service, regardless of the device or method used to access it.

This Policy should be read alongside our Terms of Service, which governs your use of the platform. If you have any questions about our data practices, please contact us using the details provided in Section 15.

By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, you must not use the Service.

Definitions

For the purposes of this Privacy Policy, the following terms have the meanings set out below.

• Personal Data: any information relating to an identified or identifiable individual. An individual is considered identifiable if they can be identified, directly or indirectly, by reference to a name, an identification number, location data, or one or more factors specific to their physical, economic, or social identity.
• Data Manager: Harvst Capital, the entity that determines the purposes and means of processing personal data collected through the Service.
• Data Processor: any third party engaged to process personal data on behalf of Harvst Capital and under our instruction.
• Processing: any operation or set of operations performed on personal data, whether by automated or non-automated means, including collection, recording, storage, use, disclosure, erasure, or destruction.
• Service: the Harvst Capital platform, website, dashboard, and associated services as described in Section 1.
• User: any individual who accesses or uses the Service, whether as a visitor or as an authenticated account holder.

Information We Collect

We collect only the minimum personal data necessary to operate the Service. The categories of information we collect are set out below.

Information You Provide Directly

• Account credentials: username and password used to authenticate access to the dashboard.
• Contact information: email address, if provided when contacting us directly.
• Correspondence: the content of any messages or enquiries submitted to us via email or other channels.

Information Collected Automatically

• Log data: server-side logs may capture IP addresses, browser type, operating system, referring URLs, pages visited, and timestamps of access events.
• Session data: session tokens used to maintain your authenticated state during a login session.
• Usage data: interactions with dashboard features, pages visited, and time spent on the Service.

Information We Do Not Collect

• Payment card details, bank account numbers, or any financial account credentials.
• Government-issued identification numbers or biometric data.
• Precise geolocation data.
• Sensitive personal data as defined under applicable law, including data relating to health, race, religion, or political views.

How We Use Your Information

We use the personal data we collect for clearly defined purposes that are necessary for the operation and improvement of the Service. These purposes include:

• Service operation: to authenticate users, maintain session state, and deliver the core functionality of the platform.
• Security and fraud prevention: to detect, investigate, and prevent unauthorised access, abuse, and other harmful or unlawful activity.
• Service improvement: to understand how the Service is used, identify technical issues, and improve the platform's reliability and features.
• Communications: to respond to your enquiries and provide support when requested.
• Legal and regulatory compliance: to meet our obligations under applicable laws, regulations, and valid legal processes.

Legal Basis for Processing

To the extent that applicable data protection law requires a lawful basis for processing personal data, we rely on the following grounds:

• Contractual necessity: processing required to provide the Service you have requested, including authentication and session management.
• Legitimate interests: processing necessary for our legitimate interests in operating, securing, and improving the Service, where those interests are not overridden by your rights and freedoms.
• Legal obligation: processing required to comply with applicable laws or to respond to valid legal requests from competent authorities.
• Consent: where we have sought and obtained your explicit consent for a specific processing activity. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Where processing is carried out on the basis of legitimate interests, you have the right to object. Please refer to the Your Rights section for further information.

Data Sharing & Disclosure

We do not sell, rent, or trade your personal information. We treat the confidentiality of your data as a core obligation. We may share your information only in the following limited and defined circumstances:

• Service providers: third-party vendors engaged to process data on our behalf and under our instruction, such as cloud infrastructure providers. These parties are bound by confidentiality obligations and are prohibited from using your data for their own purposes.
• Legal requirements: where disclosure is required by applicable law, court order, or a valid request from a law enforcement or regulatory authority with jurisdiction over the matter. We will, to the extent permitted by law, notify you of any such disclosure.
• Protection of rights: where disclosure is necessary to protect the rights, property, or safety of Harvst Capital, other users, or the public.
• Business transfers: in the event of a merger, acquisition, or transfer of assets, your information may be transferred as part of that transaction. We will notify you of any such transfer and any material changes to this Policy.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required to meet our legal, regulatory, or reporting obligations. Retention periods are determined by reference to the nature of the data and the purpose of processing.

• Account credentials: retained for the duration of your access to the Service and deleted upon account closure or removal.
• Server logs: retained for up to 90 days for security monitoring and diagnostic purposes, after which they are deleted or anonymised.
• Correspondence: retained for up to two (2) years, or for such longer period as may be required by applicable law.

When personal data is no longer required for its original purpose and no legal obligation requires its continued retention, we will securely delete or anonymise it so that it can no longer be associated with you.

Security

As the Data Manager, we have a responsibility to apply technical and organisational measures capable of protecting personal data against unauthorised access, alteration, disclosure, loss, or destruction. Our measures include:

• Authentication-gated dashboard access with secure credential storage.
• HTTPS encryption for all data transmitted between your browser and the Service.
• Access controls limiting data access to authorised personnel only.
• Regular review of security practices as the platform evolves.

Your Rights

Under applicable data protection law, including Bahrain's Personal Data Protection Law (PDPL), you have the following rights in relation to your personal data. To exercise any of these rights, we may require you to verify your identity with adequate proof before processing your request.

• Right to Enquire: you may request information about the personal data we hold about you, the purposes for which it is processed, and how long it will be retained.
• Right to Rectification: you may request correction of any personal data that is inaccurate, incomplete, or out of date. It is your responsibility to keep us informed of any changes to your personal data.
• Right to Erasure or Blocking: you may request that we delete or block your personal data where processing is no longer justified, where the data is unlawfully held, or where processing contravenes applicable law.
• Right to Object: you may object to the processing of your personal data at any time, including where processing is carried out on the basis of our legitimate interests.
• Right to Withdraw Consent: where we process your data on the basis of your consent, you may withdraw that consent at any time. Withdrawal will not affect the lawfulness of any processing carried out prior to withdrawal.
• Right to Complain: you may submit a complaint to the relevant data protection supervisory authority if you believe we have processed your personal data in contravention of applicable law.

To exercise any of the above rights, please contact us at privacy@harvstcapital.com. We will respond to all legitimate requests within thirty (30) days.

Cookies

The Service uses session cookies that are strictly necessary for authentication. These cookies enable the platform to maintain your logged-in state during a session and are automatically deleted when you close your browser or log out.

• Session cookies: temporary cookies that expire at the end of your browser session. They are required for the platform to function and cannot be disabled without preventing login.
• No advertising or tracking cookies: we do not use cookies for behavioural advertising, cross-site tracking, or third-party analytics.

You may configure your browser to refuse or delete cookies. Please note that doing so may affect your ability to access certain parts of the Service.

Children's Privacy

The Service is not directed at individuals under the age of 18 and is not intended for use by minors. We do not knowingly collect personal data from children under the age of 18. If we become aware that we have inadvertently collected personal data from a minor, we will take immediate steps to delete that data.

If you believe we may have inadvertently collected personal data from or about a child, please contact us at privacy@harvstcapital.com.

Changes to This Policy

We may update this Privacy Policy from time to time in response to changes in our data practices, applicable law, or the nature of the Service. When we do, the revised Policy will be published at this URL with the "Last Revised" date updated accordingly.

Where changes are material, we will take appropriate steps to inform you prior to the changes taking effect. Your continued use of the Service following the publication of an updated Policy constitutes your acceptance of the revised terms. We encourage you to review this Policy periodically. If you do not agree with any changes, you must stop using the Service.

Governing Law

This Privacy Policy and any matters arising from or related to it are governed by the laws of the Kingdom of Bahrain. The Service is operated from the Kingdom of Bahrain and is subject to Bahrain's Personal Data Protection Law (PDPL) and any regulations made thereunder.

Where you access the Service from within the European Economic Area (EEA), we acknowledge and respect the requirements of the General Data Protection Regulation (GDPR) as they apply to your use of the Service. The rights described in Section 9 reflect obligations under both the PDPL and the GDPR where applicable.

Contact

If you have any questions, concerns, or requests relating to this Privacy Policy, or wish to exercise any of your data rights, please contact us using the details below.

We aim to respond to all privacy enquiries within five (5) business days. For formal data subject requests, we may require verification of your identity before processing.

All formal legal correspondence, including data subject access requests, regulatory notices, and legal process, should be directed in writing to privacy@harvstcapital.com.