ENESDEPTFR

Privacy Policy

Last updated: 17 October 2026

This Privacy Policy explains how Harpy Enterprise Inc. ("Harpy Enterprise", "we", "us", "our") collects, uses, and protects personal data when you visit our website at harpy-enterprise.com (the "Website"). It does not cover our agent portal at portal.harpy-enterprise.com, which has its own separate privacy policy.

This policy is available in English, Spanish, German, Portuguese, and French. The English version is the authoritative one; the translations are provided for your convenience.

We have written this policy to meet the standards of the EU General Data Protection Regulation (GDPR), the Panamanian Personal Data Protection Law (Law No. 81 of 2019), the Brazilian General Data Protection Law (LGPD), and other applicable data protection laws in the regions we serve.

1. Who is responsible for your data

The controller responsible for the processing of your personal data is Harpy Enterprise Inc. (lawfully registered as H3 Grob Aircraft Latin America Corporation), a company incorporated under the laws of the Republic of Panama, represented by its CEO Leonardo Schulze Wierling.

  • Registered office: Edificio El Colegio, Local 1, Calle José Obaldía, entre calle 8va y 9na Oeste, San Felipe, Panama City, Panama
  • Tax/registration number (RUC): 155738741-2-2023 DV 14
  • Email: info@harpy-enterprise.com
  • Phone: +507 6310 5888

For any data-protection matter, contact us at info@harpy-enterprise.com. We have not appointed a Data Protection Officer, as we are not legally required to do so for this Website.

2. What data we collect, why, and on what legal basis

We keep data collection on this Website to a minimum. The Website consists of information pages and one enquiry form, described below. We do not operate user accounts, logins, or online payments on this Website, and we do not sell your personal data.

When you visit the Website (server logs)

When you load a page, our hosting provider automatically processes technical data needed to deliver the page and keep the service secure, including your IP address, the requested URL, date and time, referring page, and basic browser/device information.

  • Purpose: delivering the Website, ensuring stability and security, preventing abuse.
  • Legal basis (GDPR): Article 6(1)(f), our legitimate interest in operating a secure, functioning website.
  • Retention: these logs are kept only as long as necessary for operation and security, then deleted.

Audience and performance measurement (no cookies)

We use Vercel Web Analytics and Vercel Speed Insights to understand, in aggregate, how the Website is used and how fast it performs (for example, page views, referrer, device type, approximate country derived from the IP address, and loading-speed metrics).

  • These tools are cookieless and do not store or read information on your device.
  • Your IP address is used transiently to derive a coarse location and is not stored. The data is aggregated and does not identify you personally.
  • Legal basis (GDPR): Article 6(1)(f), legitimate interest in privacy-friendly, cookieless measurement of our audience.

Optional analytics that require your consent

If you accept analytics cookies in our cookie banner, we additionally use:

  • Google Analytics 4 (provided by Google LLC), measures how visitors use the Website using cookies and online identifiers.
  • Microsoft Clarity (provided by Microsoft Corporation), produces heatmaps and anonymised session replays to show how pages are used. Recordings are configured to mask text input and personal details.
  • Purpose: understanding usage patterns to improve the Website.
  • Legal basis (GDPR): Article 6(1)(a), your consent. These tools load only after you click "Accept" and never before. You can withdraw consent at any time (see section 6).
Both tools are active on the Website, and both are switched off until you accept them. Until you do, their cookies are not set and no data is sent to Google or Microsoft.

When you send us an enquiry through the Website

The Website has one enquiry form. You can open it on the coverage map, to ask for a short analysis of the buyers your company could reach in one country, or on the list of sectors, to ask what we have delivered in one sector. When you send it, we store your name and email address, the country or sector you asked about, the language of the page, the time, and your IP address, which we use to limit repeated submissions and keep with the enquiry so that abuse of the form can be recognised.

A text-processing service based on artificial intelligence then sorts the enquiry by who most likely sent it (a technology company that may want us to represent it, a sales agent, or someone else) and recognises automated spam, so that the right colleague answers you. We record the enquiry and your contact details in our customer-relationship-management (CRM) system, and our team is notified of it in our internal messaging. The sorting only routes your enquiry inside our company and produces no decision with legal or similarly significant effects for you within the meaning of Article 22 GDPR.

  • Purpose: answering your enquiry and handling any business relationship that follows.
  • Legal basis (GDPR): Article 6(1)(b), taking steps at your request prior to a possible business relationship; and Article 6(1)(f), our legitimate interest in handling the enquiries sent to us efficiently and in keeping automated spam out.
  • The requests to the AI service are configured so that the content we send is not used to train its models. The provider may hold the content briefly under its own standard operating and abuse-prevention practices.
  • Retention: we keep the enquiry and the CRM record for as long as needed to handle your enquiry and any resulting relationship, plus any statutory retention period. You can ask us to delete them at any time, using the contact details in section 1.

When you contact us

If you email info@harpy-enterprise.com or call us, we process the contact details and the content you provide (for example, your name, email address, and message) to handle your enquiry.

  • Legal basis (GDPR): Article 6(1)(b), taking steps at your request prior to a possible business relationship; and/or Article 6(1)(f), our legitimate interest in responding to enquiries.
  • Retention: for as long as needed to handle your enquiry and any resulting relationship, plus any statutory retention period.

Short links that show us which channel you came from

Some of our links (for example in a social-media profile or an email) point to a short address on our own domain, such as harpy-enterprise.com/go/instagram. Opening one immediately forwards you to the matching page on this Website and adds a marker to the address that names the channel you arrived from, for example "instagram" or "email".

When you open such a link, we also record the click on our own server. We store which channel and campaign the link belongs to, the page you were sent to, a coarse country and a "mobile or desktop" indication that our hosting provider derives from the request, whether the request looked like an automated crawler rather than a person, and the time. We do not store your IP address. Where we sent the link to you individually by email, it can also carry a reference that tells us that this particular recipient clicked.

We write the same record when you open our booking page or a booking address from an email signature directly, and when you download our company profile from this Website. In those cases the channel we note is only whether you came from one of our own pages or opened the address directly.

  • Purpose: understanding which of our channels and campaigns bring visitors to the Website, and whether an individual message we sent was followed up.
  • The short link itself sets no cookie and reads nothing from your device. This record is written on our own server, so it does not depend on your cookie choice.
  • Legal basis (GDPR): Article 6(1)(f), our legitimate interest in measuring how effective our own outreach is. You can object at any time using the contact details in section 1, and we will delete the records that relate to you.
  • Retention: we keep these click records for as long as they are useful for this purpose, and we delete them on request.
  • The marker added to the address is additionally read by the optional analytics described above, but only if you have consented to those.

Language preference

We store your selected language in a strictly necessary first-party cookie (NEXT_LOCALE) so the Website shows the right language. This does not require consent.

What we do NOT do

  • We do not collect special categories of data (such as health, religion, or biometrics).
  • We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.
  • We do not use advertising, retargeting, or social-media tracking pixels.
  • We do not knowingly collect data from children (see section 10).
  • Our fonts are served from our own domain, so loading the Website does not send a request to Google's font servers.

3. Cookies and similar technologies

A cookie banner appears on your first visit when optional analytics are enabled. You can accept or reject non-essential cookies, and change your choice at any time (see section 6).

  • NEXT_LOCALE (first-party cookie, about 12 months), strictly necessary: remembers your language. No consent required.
  • harpy.consent (browser local storage, until you clear it), strictly necessary: remembers your cookie choice.
  • _ga, _ga_* (Google, up to 24 months), analytics; set only after you consent.
  • _clck, _clsk, CLID, MUID (Microsoft, session to about 12 months), Clarity analytics; set only after you consent.

Strictly necessary cookies are needed for the Website to work and do not require consent. Vercel Web Analytics and Speed Insights do not set cookies.

4. Who we share data with

We share personal data only with service providers ("processors") that help us run the Website, under contracts that require them to protect your data:

  • Vercel Inc. (USA), website hosting, content delivery, cookieless analytics, performance measurement, and the AI gateway that passes the sorting of enquiries to the provider of the AI model.
  • Microsoft Corporation (USA / EU), email service for our info@ address (handling emails you send us), the booking calendar embedded on our booking page, which is loaded from Microsoft when you open that page, and, only if you consent, Microsoft Clarity analytics.
  • Google LLC (USA), Google Analytics, only if you consent.
  • Neon Inc. (USA), the database that holds the click records and the enquiries described in section 2, provisioned through Vercel.
  • Attio Limited (United Kingdom), our customer-relationship-management (CRM) system, in which we record enquiries and contacts.
  • Supabase Inc. (USA), the database of our agent portal, which keeps a record of how each enquiry was handled, without your name or email address.
  • Slack Technologies, LLC (USA), our internal messaging, in which our team is told that an enquiry arrived.

We do not sell your personal data and do not share it for third-party advertising. We may disclose data where required by law or to protect our legal rights.

5. International data transfers

We are based in Panama, and some of our processors are located in the United States. This means your personal data may be transferred to and processed outside your country, including outside the EU/EEA.

Where we transfer personal data of EU/EEA visitors to a country without an EU adequacy decision, we rely on appropriate safeguards under Chapter V GDPR, namely the EU-US Data Privacy Framework (where the recipient is certified) and/or the European Commission's Standard Contractual Clauses, together with additional technical and organisational measures. You can request a copy of the relevant safeguards using the contact details in section 1.

6. Your choices and how to withdraw consent

For the optional analytics described above, you can:

  • accept or reject them in the cookie banner shown on your first visit; and
  • change your choice at any time via the "Cookie settings" link in the Website footer, or by clearing site data in your browser.

Withdrawing consent is as easy as giving it and does not affect the lawfulness of processing carried out before withdrawal.

7. Your data protection rights

Depending on where you live, you have the following rights regarding your personal data. We honour these rights for all visitors regardless of location.

  • Under the EU GDPR, you have the right to access your data; correct inaccurate data; erase your data; restrict processing; data portability; object to processing based on legitimate interests; withdraw consent at any time; and not be subject to solely automated decisions.
  • Under Panama's Law No. 81 of 2019, you have the rights of access, rectification, cancellation (deletion), opposition, and portability of your personal data.
  • Under Brazil's LGPD, you have the rights of, among others, confirmation and access; correction; anonymisation, blocking or deletion; portability; deletion of data processed with consent; information about sharing; and to withdraw consent.

Residents of other Latin American countries (such as Argentina, Colombia, and Mexico) and other jurisdictions may have equivalent rights under their local laws, which we also respect.

To exercise any right, contact us at the address in section 1. We will respond within the time limits set by applicable law (under the GDPR, normally within one month).

Right to lodge a complaint

You may lodge a complaint with a supervisory authority, in particular:

  • EU/EEA: your local data protection authority.
  • Panama: the National Authority for Transparency and Access to Information (ANTAI).
  • Brazil: the National Data Protection Authority (ANPD).

8. California residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, to request its deletion, to correct it, and to opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined under California law. To exercise your rights, contact us using the details in section 1. We will not discriminate against you for exercising them.

9. How we protect your data

We use appropriate technical and organisational measures to protect personal data, including encryption in transit (HTTPS/TLS), access controls, and working only with reputable processors bound by data-processing agreements. No method of transmission over the internet is completely secure, but we work to protect your data using industry standards.

10. Children's privacy

This Website is intended for a business audience and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the "Last updated" date above. Where required by law, we will notify you of material changes.

12. Contact

Questions about this Privacy Policy or your personal data:

Harpy Enterprise Inc. Edificio El Colegio, Local 1, Calle José Obaldía, San Felipe, Panama City, Panama Email: info@harpy-enterprise.com

Back