// PRIVACY POLICY

Who processes your data

This site belongs to Specvybuhprom. We are the owner of personal data under Ukraine's Law on the Protection of Personal Data, and the data controller under the GDPR for visitors from the European Union.

Questions about this policy, or about your data, go to specvybuh@ukr.net or to the phone numbers on the Contact page.

What we receive

This is a static site. There are no accounts, no basket, no visitor counters and no behavioural tracking. Data appears only when you send us something yourself.

• The contact form — your name, email address, subject and message. Exactly what you typed. It reaches us as an ordinary email and settles in no database, because this site has no database.
• Your IP address — it goes into a technical line of that same email, and is used to limit how often one address may submit. For the limit itself it is stored not as an address but as an irreversible SHA-256 hash.
• Web server logs kept by the hosting provider: the requested address, the time, the IP and the browser string. We do not analyse them and do not match them against submitted forms.

On what basis

Processing the contact form rests on your own approach to us: you send an enquiry, we answer it. For visitors in the EU that is Article 6(1)(b) GDPR — steps taken at your request before entering a contract.

Protecting the form from automated submissions, and the server logs, rest on our legitimate interest in keeping the site working — Article 6(1)(f) GDPR.

Cookies

We use no cookies for analytics, advertising or profiling. The site sets exactly one cookie of its own, and it is not there to recognise you.

• sv_stamp — our own cookie, on the Contact page. It holds a signed timestamp and nothing else, and exists to tell a person apart from a bot that fills the form in half a second. Lifetime 12 hours, HttpOnly, SameSite=Lax.
• The fact that you dismissed the cookie notice is kept in your browser's localStorage rather than in a cookie. It is never sent to the server.
• YouTube's and Cloudflare's cookies are covered in the next section. We do not set them, and they are not set on arrival.

Third-party services

Two parts of this site reach other people's servers. Each does so at its own moment, and neither does so for nothing.

• YouTube (Google Ireland Limited). Gallery videos do not load until you press play: until then you are looking at an ordinary image served from our own server. There is one exception — the background film in the home page header, which starts by itself; it is not loaded at all if your system asks for reduced motion or data saving. Once the player has loaded, YouTube receives your IP address and sets its own cookies. Terms: policies.google.com/privacy
• Cloudflare Turnstile — the check that a human is sending the form. It loads only on the Contact page, and only once you start filling it in. Turnstile does not track you across sites; Cloudflare receives your IP address and browser details. Terms: cloudflare.com/privacypolicy
• SiteGround — the hosting the site sits on, which keeps the server logs.

How long any of it is kept

As long as the reason it appeared still holds, and no longer.

• Emails from the contact form — in the mailbox for as long as the correspondence runs and your enquiry requires.
• IP hashes for the rate limit — two hours at most, after which the file is deleted automatically.
• Hosting logs — for the period the provider sets.

Your rights

To exercise any of these, write to specvybuh@ukr.net. We answer within thirty days.

• Find out what data of yours we hold, and receive a copy of it.
• Have inaccurate data corrected, or incomplete data completed.
• Ask for your data to be deleted.
• Restrict the processing, or object to it.
• Withdraw consent where the processing rests on consent.
• Complain to the Ukrainian Parliament Commissioner for Human Rights, or — if you are in the EU — to your country's supervisory authority.

Changes to this policy

If this policy changes we will update the revision date at the top of this page. Anything substantial will be announced on the site itself, not only in this text.