01Who is responsible

This website is operated by SEROKUZE, an independent SEO consultancy based in Kyiv, Ukraine. For the purposes of the EU General Data Protection Regulation (GDPR) and the Ukrainian Law on Personal Data Protection, I am the data controller for the personal data described here.

Contact for any privacy matter: contact@serokuze.com. There is no data protection officer — the site is run by one person, and that person answers the mail.

02What data is collected

Data you give me directly. When you use the contact form or write by email, I receive your name, email address, the website you mention and the content of your message. If we start working together, I also process the business contact details and access credentials needed to do the work.

Data collected automatically. Like every web server, the hosting provider records technical log data: IP address, browser and device type, referring page, requested URL, and the date and time. Analytics adds anonymous usage statistics — pages viewed, approximate country, and how you arrived.

What is never collected: payment card numbers (invoices are settled through a bank or payment provider that handles this directly), special categories of data, and anything about children.

03Why it is processed, and on what legal basis

To answer you (Art. 6(1)(b) GDPR — steps prior to a contract). Your message and contact details are used to reply and to prepare a proposal if one is requested.

To deliver the work (Art. 6(1)(b) GDPR — performance of a contract). Client data is processed to run audits, write specs and report on results.

To keep the site secure and working (Art. 6(1)(f) GDPR — legitimate interest). Server logs are used to detect abuse, debug errors and defend against attacks.

To understand what people read (Art. 6(1)(a) GDPR — consent). Analytics only runs after you accept it in the cookie banner. Decline and the site works exactly the same.

04How long it is kept

Enquiries that do not turn into a project: 12 months, then deleted. Enough time for a conversation to resume without me having lost the context.

Client records, contracts and invoices: kept for as long as the applicable tax and accounting rules require — generally up to 7 years — then deleted.

Server logs: rotated by the hosting provider, typically within 30 days. Analytics data: retained for 14 months in aggregate form.

05Who else can see it

The data is not sold, rented or traded. It is shared only with the service providers that make the site and the work possible, and only to the extent they need it:

Hosting and CDN — to serve the site and store its files. Email provider — to receive and send correspondence. Google Analytics 4 — anonymous usage statistics, only with your consent. Invoicing and banking — to issue and settle invoices.

Each of these acts as a processor under a data processing agreement. If a legal obligation ever requires disclosure to an authority, I comply — and, unless legally prevented, I tell you.

06Transfers outside the EEA

I work from Ukraine, and some providers are based in the United States. Where personal data leaves the European Economic Area, the transfer relies on the European Commission's Standard Contractual Clauses or an adequacy decision, together with the technical measures each provider documents.

Ukraine is recognised as a country with an adequate level of protection for personal data by the Council of Europe Convention 108+, to which it is a party.

07Your rights

Under the GDPR you can ask me to: give you a copy of the data I hold about you; correct anything inaccurate; delete it; restrict how it is used; send it to you or another provider in a portable format; or object to processing based on legitimate interest.

Where processing is based on consent — analytics, essentially — you can withdraw it at any time, and withdrawal does not affect what happened before.

One email to contact@serokuze.com is enough. No form, no template, no identity theatre beyond what is needed to be sure it is you. I answer within 30 days, usually the same week.

If you believe I have handled your data badly, you can complain to your national supervisory authority — for example the Bundesbeauftragte für den Datenschutz in Germany, or the Ukrainian Parliament Commissioner for Human Rights. I would rather you wrote to me first.

08Cookies and similar technologies

This site sets a small number of cookies and stores a language preference in your browser. Analytics cookies run only after consent. The full list, with purpose and lifetime, is on the Cookie Policy page.

09How the data is protected

The site is served over HTTPS only. Access to email, project files and client systems is protected by unique passwords in a password manager and two-factor authentication. Client credentials are stored in an encrypted vault and deleted when an engagement ends.

No system is perfect. If a breach affects your rights, I will notify you and the supervisory authority within 72 hours of becoming aware of it, as the GDPR requires.

10Children

This is a business-to-business consulting site. It is not directed at children, and I do not knowingly collect data from anyone under 16. If you believe a child has sent me personal data, write and it will be deleted.

11Changes to this policy

When the site changes — a new analytics tool, a new form, a new provider — this page is updated and the date at the top changes with it. Material changes affecting how your data is used are announced on the site before they take effect.

Previous versions are available on request.