Privacy Policy

The controller is ФОП Гаталович Олександр Олександрович (a Ukrainian sole proprietor), operating under the commercial brand “HatalyX”.

Taxpayer registration number (RNOKPP): 3965902319.

Place of registration and actual residence: 90223, Ukraine, Zakarpattia region, Berehove district, Koson village, vul. Barabash 77.

E-mail: hatalyxweb@gmail.com · Phone: +380 99 454 1071 · Telegram: @Hata_073.

This is the primary contact point for any question about the processing of personal data.

We deliberately limit the data to what is genuinely needed to answer an enquiry. The website has no user registration, no accounts, and does not collect data about visitors' interests.

Enquiry form: your name or your business name; the contact detail you choose to give (phone number or e-mail address); the message text, if you fill it in; and the interface language the enquiry was sent from.

Technical data: while an enquiry is processed, the server uses the sender's IP address solely as a technical key to limit submission frequency (protection against automated submissions). This value exists only in the server's memory, as a counter, without the message text, and disappears automatically after a short period.

Bot protection: the form contains a hidden technical field that must remain empty. If it is filled in, the enquiry is not delivered through any channel. This is a technical filter, not an assessment of a person.

Hosting logs: like any web server, the hosting provider's infrastructure may automatically record service entries about requests (such as IP address and browser type) to keep the service running and secure.

Handling your enquiry, replying, and preparing and agreeing a proposal. Legal basis: steps taken at your request prior to entering into a contract, and the conclusion and performance of a contract to which you are, or intend to become, a party (Article 11(1)(5) of Law No. 2297-VI).

Keeping the website functional and secure, including limiting form submission frequency and filtering automated enquiries. Legal basis: the operator's legitimate interest in protecting its own service from abuse, which does not override your rights and freedoms.

Complying with statutory obligations, in particular accounting and tax requirements, where a contractual relationship has arisen between us. Legal basis: compliance with an obligation imposed on the operator by law.

We do not process your data for advertising, profiling, or commercial transfer to third parties.

We do not sell personal data and do not pass it to third parties, other than the technical providers needed to run the website and deliver your enquiry to us:

Hosting and serving the website: Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA.

Delivery of the enquiry by e-mail: Resend (Plus Five Five, Inc., USA).

Delivery of the enquiry notification via messenger: Telegram (Telegram Messenger Inc.).

These providers receive data only to the extent needed to supply the relevant service and act under their own terms of service. Data may also be disclosed to public authorities where the law expressly requires it.

Analytics: Google Analytics 4 (Google Ireland Limited) — only if you have enabled the “Analytics” category. See section 5 below.

We use Google Analytics 4 to understand how visitors use the site. Analytics is off by default.

No Google script is loaded and no request reaches Google until you explicitly enable the “Analytics” category in the consent banner. Until then, no analytics cookie is created on your device.

If you consent, Google Analytics processes anonymous usage information: the pages viewed, an approximate referring source, the device and browser category, an approximate region (determined by Google from the IP address; the IP address itself never reaches us), and two technical events — a successful contact form submission and a click on a link to a client project. The IP address is passed to Google in anonymised mode.

We deliberately send nothing you type into analytics: not your name, not your contact details, not the message text. Page addresses are sent without query parameters.

No advertising features are used: consent for advertising cookies, advertising user data and ad personalisation always remains denied. We do not use Google Signals or remarketing, and we do not link analytics to any advertising account.

Provider: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Data may be processed on Google servers outside Ukraine, in particular in the EU and the USA.

User- and event-level data retention in our GA4 property is set to 14 months. This applies to the detailed data; aggregated statistics in Google's standard reports are retained under Google's own rules.

You can withdraw your consent at any time using the “Cookie settings” link at the bottom of the site. After withdrawal, further collection stops and the Google Analytics cookies set on our domain are deleted. We cannot instantly delete data already transmitted to Google — contact us about that and we will submit the corresponding request.

The providers named above are foreign companies, so your data may be processed and stored on servers outside Ukraine, in particular in the United States and the European Union.

We choose providers that publicly commit to appropriate technical and organisational protection measures. We do not claim that any separate adequacy decision, standard contractual clauses, or certifications are in place where such documents have not been separately concluded and verified by us.

If you would prefer your enquiry not to pass through these channels, you can contact us directly by phone.

Enquiries sent through the form: retained in our communication channels for as long as needed to deal with the matter. If no cooperation begins, we delete the correspondence no later than one year after the last contact.

Contractual and settlement documents: retained for the periods required by Ukrainian accounting and tax legislation.

Rate-limiting counters: exist only in the server's memory and disappear automatically within minutes; no separate deletion is required.

The record of your consent choice: kept in your browser's local storage until you delete it or change your choice.

Under Article 8 of the Law of Ukraine “On Personal Data Protection”, you have the right to:

know the sources of collection and the location of your personal data, the purpose of their processing, and the location of the controller or processor, or to give an authorisation on this matter to an authorised person;

receive information about the conditions of access to your personal data, including information about third parties to whom your data is transferred;

access your personal data;

receive, no later than thirty calendar days from the date the request is received, a reply as to whether your personal data is processed, and to receive the content of such data;

raise a reasoned objection with the controller against the processing of your personal data;

make a reasoned request to any controller or processor for the amendment or destruction of your personal data if that data is processed unlawfully or is inaccurate;

protection of your personal data against unlawful processing and accidental loss, destruction or damage caused by intentional concealment, failure to provide, or untimely provision, and protection against the provision of information that is inaccurate or damages honour, dignity and business reputation;

lodge complaints about the processing of your personal data with the Ukrainian Parliament Commissioner for Human Rights or with a court;

apply legal remedies in the event of a breach of personal data protection legislation;

make reservations restricting the right to process your personal data when giving consent;

withdraw consent to the processing of personal data;

know the mechanism of automatic processing of personal data;

protection against an automated decision that produces legal effects for you.

To exercise any of these rights, write to hatalyxweb@gmail.com.

The supervisory authority for personal data protection in Ukraine is the Ukrainian Parliament Commissioner for Human Rights (Уповноважений Верховної Ради України з прав людини). You have the right to lodge a complaint with the Commissioner and to seek judicial protection of your rights.

We apply appropriate technical and organisational protection measures: the website transmits data over an encrypted connection (HTTPS), access to the enquiry delivery channels is restricted, and service access keys are stored strictly server-side and never reach the website's code.

That said, no system of transmitting data over the internet can be completely secure. We do not claim one hundred per cent security and do not guarantee that breaches are impossible.

We do not take decisions about you that produce legal effects concerning you, or similarly significantly affect you, based solely on automated processing.

The hidden-field technical filter and the submission rate limit protect the form against automated submissions; they are not an assessment of a person or profiling.

The website is a business communication resource addressed to businesses and professionals. We do not knowingly collect children's personal data through the enquiry form. If you believe a child has sent us their data, please tell us and we will delete it.

We may update this Policy if our processes or legal requirements change. The current version is always available on this page, and the date of the last update is shown at the top.