Home / Privacy Policy

Privacy Policy

How we process your personal data. GDPR-compliant document. Last updated: 25 May 2026.

This Privacy Policy describes what personal data we collect, why we use it, who we share it with, and what rights you have. This document complies with the requirements of the GDPR (Regulation (EU) 2016/679) and the Law of Ukraine "On the Protection of Personal Data" No. 2297-VI.

1. Who we are (Data Controller)

The website overchenko.studio is owned and operated by OVERCHENKO STUDIO — a sole trader (individual entrepreneur) registered in Ukraine, providing web development, design, and branding services.

Controller contact details:

2. Personal data we collect

2.1 Data from the contact form

When you submit an enquiry through the form on the /contact page, we collect:

  • Name — to address you in subsequent communication
  • Email or phone number — to respond to your request
  • Project type and budget — for preliminary assessment
  • Message text — details of your request

The website field in the form is a honeypot for blocking bots; filling it in results in a silent rejection of the request.

2.2 Technical data (collected automatically)

Cloudflare (our hosting and CDN provider) automatically logs:

  • IP address (for rate limiting and DDoS protection)
  • User-Agent (browser type and OS)
  • Referrer (the page you came from)
  • Date and time of visit

2.3 Analytics

Where Google Analytics 4 or other analytics tools are active, they collect anonymised behavioural metrics: pages viewed, time on site, device type, geographic area (country/region, not precise address).

3. Legal bases for processing (Art. 6 GDPR)

  • Performance of a contract (Art. 6(1)(b)) — processing your contact details to respond to a service enquiry.
  • Legitimate interests (Art. 6(1)(f)) — protecting the site against attacks, analytics for product improvement, rate limiting.
  • Consent (Art. 6(1)(a)) — processing analytics cookies (withdrawn by opting out via the cookie banner once implemented).
  • Legal obligation (Art. 6(1)(c)) — retaining contract documents in accordance with Ukrainian tax law.

4. Cookies and tracking

The site uses a minimal number of cookies:

  • Functional cookies — sessionStorage keys os-loaded and os-from-transition (for preloader and page-transition animation logic), and localStorage for the interface language (UA/EN). Not shared with third parties.
  • Cloudflare technical cookies — __cf_bm (Bot Management) and similar, lifetime ~30 min. Required for site security to function.
  • Analytics cookies — Google Analytics (if enabled): _ga, _gid with lifetimes of 24 hours to 2 years.

You may disable cookies in your browser settings. This may affect site functionality (for example, the interface language preference will not be remembered).

5. Sharing data with third parties

We use the following data processors:

  • Cloudflare, Inc. (USA, Privacy Shield + SCCs) — hosting, CDN, protection. Privacy policy →
  • Telegram FZ-LLC (UAE) — receiving messages from the contact form via Bot API. Your message is forwarded to our private administrator chat. Privacy policy →
  • Google LLC (USA, EU-US Data Privacy Framework) — analytics (GA4) and fonts (Google Fonts). Privacy policy →

We do not sell your personal data. We do not share it with advertising networks or data brokers.

6. Data retention

  • Form submissions — in our Telegram archive: up to 24 months from the last contact, then deleted.
  • Contract documents — in accordance with Ukrainian tax law (minimum 3 years after project completion).
  • Cloudflare logs — approximately 30 days by default.
  • Analytics — in line with Google Analytics settings (14 months of anonymised data by default).

7. Your rights (GDPR Art. 15–22)

As a data subject you have the right to:

  • Access your data (Art. 15) — request a copy of everything we hold about you.
  • Rectify inaccurate data (Art. 16).
  • Erase your data ("right to be forgotten", Art. 17) — provided there is no legal obligation to retain it.
  • Restrict processing (Art. 18).
  • Data portability (Art. 20) — receive your data in a machine-readable format.
  • Object to processing (Art. 21) — especially for marketing purposes.
  • Not be subject to automated decision-making (Art. 22). We do not use profiling.

To exercise any of these rights, write to [email protected]. We respond within 30 calendar days. Requests are free of charge.

If you are unsatisfied with our response, you have the right to lodge a complaint with:

  • In Ukraine: the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua)
  • In the EU: the supervisory authority of your country (list here)

8. Data security

We apply technical and organisational measures to protect data:

  • HTTPS/TLS 1.3 for all traffic (via Cloudflare).
  • HSTS, CSP, X-Frame-Options and other security headers.
  • Rate limiting on the contact form API endpoint (5 seconds between requests from the same IP).
  • Honeypot bot protection on forms.
  • Secure storage of secrets (Telegram Bot Token etc.) in Cloudflare Environment Variables.
  • Restricted data access: only the founder of OVERCHENKO STUDIO has access to the Telegram enquiry archive.

Despite our efforts, no system is 100% secure. In the event of a data breach that poses a risk to your rights, we will notify you and the relevant supervisory authority within 72 hours (Art. 33 GDPR).

9. Children

Our services are not intended for persons under the age of 16. We do not knowingly collect personal data from children. If you discover that we have received a child's data without parental consent — please write to us and we will delete it immediately.

10. International data transfers

Some of our processors (Cloudflare, Google, Telegram) are located outside the EU/EEA. We ensure an adequate level of protection through:

  • EU-US Data Privacy Framework (Cloudflare, Google).
  • Standard Contractual Clauses (SCCs) approved by the European Commission.
  • Vendor security certifications (SOC 2 Type II, ISO 27001 for Cloudflare).

11. Changes to this Policy

We may update this Policy from time to time. The date of the last update is shown at the top of the page. Material changes will be announced by email (to active clients) or via a prominent banner on the site at least 14 days before taking effect.

An archive of previous versions is available on request.

12. Privacy contact

For any questions about the processing of your personal data, the exercise of GDPR rights, or complaints — please contact us:

We are not required to appoint a dedicated Data Protection Officer (DPO) under Art. 37 GDPR, as we do not engage in large-scale processing of special categories of data. All requests are handled directly by the studio founder.

Have a question?

We'll respond within 24 hours.