1. Who is responsible for your data?
The data controller for this independent pre-launch landing page is Harmony, a project led by Christelle Marchese in Luxembourg. This landing page, its private launch dashboard, and its mailing list are separate from any other Harmony product or platform.
Privacy requests can be sent to hello@charmony.eu or made by telephone at +352 621 561 812. No data protection officer has been appointed because the present pre-launch processing does not require one.
The publisher’s full statutory identity and geographic address are described in the Legal Notice. They must be kept current whenever the operating structure changes.
2. Scope and data collected
Harmony limits collection to what is needed for this pre-launch site:
- your email address;
- whether you joined as a general visitor or a practitioner;
- the form used (hero, practitioner handbook, or final call to action);
- the date and time of your request, consent, and email confirmation where available;
- limited technical request and security data processed by the hosting infrastructure, such as IP address, user agent, date, and request status;
- anonymous first-party counts of page views and visits reaching 90% of the page.
The landing page does not ask for health information, therapy notes, payment data, account credentials, or questionnaire answers. Please do not enter clinical or other sensitive information in the email field.
3. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Send launch information, practitioner updates, and the handbook when available | Email, audience, signup source, confirmation status | Your consent (GDPR Art. 6(1)(a)); emails are sent only after the applicable confirmation process |
| Record and demonstrate the signup request and consent | Email, audience, source, consent timestamp | Legal compliance and Harmony’s legitimate interest in accountability and dispute handling (GDPR Arts. 5(2), 6(1)(c) and 6(1)(f)) |
| Operate, secure, and protect the forms and private dashboard | Technical logs, rate-limit events, strictly necessary dashboard session | Harmony’s legitimate interest in providing a secure and reliable service (GDPR Art. 6(1)(f)) |
| Understand whether the landing page is being viewed and read | Anonymous aggregate page-view and deep-scroll events, without a visitor identifier | Harmony’s legitimate interest in measuring the usefulness of this pre-launch page (GDPR Art. 6(1)(f)) |
You can refuse newsletter consent without losing access to the public site. You may withdraw consent at any time by using the unsubscribe link in an email or contacting Harmony. Withdrawal does not affect processing that was lawful before it.
4. Recipients and service providers
Access is restricted to Christelle Marchese and authorised people who need it for the pre-launch operation. The principal processors are:
- Netlify, Inc. — website hosting, serverless form processing, private data storage, security, and technical delivery;
- Brevo / Sendinblue SAS — double opt-in, mailing-list administration, email delivery, and unsubscribe management.
Harmony does not sell personal data and does not disclose the launch list to advertisers. Processor access must be governed by data-processing terms under GDPR Article 28.
5. International transfers
Providers may process limited data outside the European Economic Area. Where this occurs, Harmony must rely on a valid transfer mechanism such as an adequacy decision, the European Commission’s Standard Contractual Clauses, and supplementary safeguards where required. Information about the applicable safeguards can be requested using the privacy contact above.
6. Retention
- Active mailing-list contact: until you unsubscribe, withdraw consent, or the pre-launch purpose ends, with inactive contacts reviewed at least every 24 months.
- Landing-dashboard signup record: up to 24 months from signup, unless it must be removed earlier following a valid request.
- Minimal proof of consent or suppression: only what is necessary for up to three years after withdrawal or the last communication, where needed to demonstrate compliance or respect an opt-out.
- Anonymous aggregate measurement: up to 13 months.
- Technical and security logs: according to the shortest period needed for security, fault diagnosis, and provider obligations.
Data is deleted or irreversibly anonymised when the relevant period ends, unless a legal obligation or a current legal claim requires limited longer retention.
7. Your GDPR rights
Subject to the conditions in the GDPR, you can request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You can withdraw newsletter consent at any time.
Send a request to hello@charmony.eu. Harmony may ask for proportionate information to verify identity and normally responds within one month. Requests are free unless they are manifestly unfounded or excessive.
You may also lodge a complaint with the Commission nationale pour la protection des données (CNPD), 15 Boulevard du Jazz, L-4370 Belvaux, Luxembourg, or with the supervisory authority where you live or work.
8. Cookies, measurement, and automated decisions
The public landing page does not use optional analytics, advertising, or profiling cookies. Aggregate measurement sends two first-party events without setting a visitor identifier and respects the browser’s Do Not Track and Global Privacy Control signals. The private administrator dashboard uses one strictly necessary authentication cookie. Full details are in the Cookie Notice.
Harmony does not use the landing-page data for automated decision-making, scoring, matching, or profiling.
9. Security and confidentiality
Harmony applies data minimisation, access restrictions, encrypted HTTPS transport, secure server-side credentials, a protected administrator session, request validation, same-origin checks, and rate limiting. No online service can guarantee absolute security; suspected incidents are assessed and documented, and the CNPD and affected people are notified where the GDPR requires it.
10. Changes to this notice
This notice will be reviewed whenever the landing page, processors, data uses, or operating entity changes. Material changes affecting consent will be communicated before the new processing begins and, where necessary, fresh consent will be requested.