Privacy Policy

This page explains which data is processed when you visit lishchuk.com, for what purpose, on what legal basis, who receives it and what rights you have (Art. 13 GDPR, § 165(3) Austrian TKG 2021).

Contents

1. Controller
2. Hosting
3. Visitor statistics without cookies (Cloudflare Web Analytics)
4. Contact form
5. Chat
6. Email, WhatsApp and phone
7. Cookie consent
8. Google Analytics and Google Ads
9. Meta Pixel
10. OpenAI Ads Pixel
11. YouTube videos
12. Data stored in your browser
13. Recipients and transfers to third countries
14. Retention
15. Your rights
16. Changes

1. Controller

Aleksandr Lishchuk
Sole proprietor (FOP) under Ukrainian law
Starokyivska Street 25, 04116 Kyiv, Ukraine
Email: lischuk.a@gmail.com

For any privacy question, an email to this address is enough. No data protection officer has been appointed.

I have no establishment in the EU. The GDPR still applies (Art. 3(2)) because the website targets clients in Austria and the DACH region. I have not appointed a representative under Art. 27 GDPR because processing is only occasional, does not involve special categories of data and is unlikely to result in a risk to your rights (Art. 27(2)(a) GDPR).

2. Hosting

The website is hosted by Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA. On every page view Netlify processes technically necessary data: IP address, date and time, page requested, referrer, browser and operating system.

• Purpose: delivering the website, stability and security.
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working website).
• Netlify is my processor and is certified under the EU-U.S. Data Privacy Framework.
• Retention: I do not analyse these logs. Netlify keeps them only as long as needed for operation and security.

Fonts, images and scripts are served from this server. Simply opening a page sends no data to Google or Meta.

3. Visitor statistics without cookies (Cloudflare Web Analytics)

To see how many visits the website gets, I use Cloudflare Web Analytics (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). The script sets no cookies, stores nothing in your browser and builds no user profiles. It transmits the page viewed, referrer, browser and device type and load times. Cloudflare uses your IP address only for transmission and rough country detection and does not store it. I only see aggregated numbers.

• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in privacy-friendly statistics).
• Cloudflare is certified under the EU-U.S. Data Privacy Framework.

4. Contact form

When you submit a form, I process your name and email (required) and, optionally, phone number, company, website and your message. The data is stored at Netlify and I receive an email notification (Google). Netlify checks incoming messages with the Akismet spam filter (Automattic Inc., USA).

• Purpose: answering your enquiry, preparing an offer.
• Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps); for enquiries unrelated to a project, Art. 6(1)(f) GDPR.
• Without your name and email I cannot reply.
• If you have accepted marketing cookies, your email and phone number are sent to Google Ads in hashed form after submission, so the enquiry can be matched to an ad (see section 8). Without your consent this does not happen.

5. Chat

The website has a chat window where an AI assistant answers first questions about services and prices, and where I can reply myself.

• Data is only transmitted once you send a message. The chat server runs at Render Services, Inc. (USA, EU-U.S. Data Privacy Framework) and keeps the conversation only briefly, at most 24 hours after the last message.
• Your messages are delivered to me via Telegram (Telegram Messenger Inc.; according to Telegram, EEA data is stored in the Netherlands) so I can reply. I delete these conversations after 12 months at the latest.
• For automatic replies, the latest messages are sent to OpenAI. According to OpenAI, this data is not used for training and is kept for at most 30 days.
• AI answers can be wrong. Please do not enter sensitive data in the chat, such as health data or passwords.
• Purpose: answering your questions. Legal basis: Art. 6(1)(b) and (f) GDPR.

6. Email, WhatsApp and phone

When you write to me or call me, I process your contact details and message in order to reply (Art. 6(1)(b) or (f) GDPR). My mailbox is run by Google, WhatsApp by WhatsApp Ireland Limited (Meta). Links to Instagram, LinkedIn, Facebook or YouTube are plain links: data only goes to the provider after you click.

7. Cookie consent

On your first visit a banner asks whether you allow statistics and marketing cookies. I store your choice only in your browser, without any external service. After 12 months I ask again.

• Legal basis: Art. 6(1)(c) in conjunction with Art. 7(1) GDPR; storing your choice is strictly necessary (§ 165(3) TKG 2021).
• Withdrawal: use “Cookie settings” at the bottom of every page to change your choice at any time. Processing before withdrawal remains lawful (Art. 7(3) GDPR).

8. Google Analytics and Google Ads

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework. Google Tag Manager only loads after your consent.

• Statistics (Google Analytics 4): page views and events such as “form submitted”, to improve the website. Cookies _ga and _ga_*, 2 years each. Google Analytics deletes the data after at most 14 months.
• Marketing (Google Ads): measuring whether an ad led to an enquiry, and remarketing. Cookie _gcl_au, 90 days. Enhanced conversions: email and phone number are sent hashed (see section 4).
• Legal basis: your consent, Art. 6(1)(a) GDPR and § 165(3) TKG 2021.

9. Meta Pixel

Only with your consent to marketing do I use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Data may be transferred to Meta Platforms, Inc. in the USA (EU-U.S. Data Privacy Framework).

• Purpose: measuring ad results on Facebook and Instagram, remarketing. Cookie _fbp, 90 days.
• Legal basis: Art. 6(1)(a) GDPR and § 165(3) TKG 2021.
• For collecting and transmitting data to Meta, I am jointly responsible with Meta (Art. 26 GDPR, agreement in Meta's business terms). Meta alone is responsible for any further processing.

10. OpenAI Ads Pixel

Only with your consent to marketing do I use the Measurement Pixel of OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. It measures whether an ad in ChatGPT led to an enquiry. It transmits a click ID from the ad, technical device and browser data and the event “enquiry sent”, without name, email or message. Data may be transferred to OpenAI OpCo, LLC in the USA.

• Cookies: first-party cookies of the pixel.
• Legal basis: Art. 6(1)(a) GDPR and § 165(3) TKG 2021.

11. YouTube videos

Video thumbnails are served from this server. Only when you click a video is the player loaded in YouTube's privacy-enhanced mode (Google Ireland Limited). Your IP address and usage data are then sent to YouTube. Legal basis: Art. 6(1)(f) GDPR, since you request the video yourself.

12. Data stored in your browser

• Always, because strictly necessary: your cookie choice.
• Only if you use the feature: chat history and a random visitor ID (chat), game state and sound setting (chess widget, runs entirely in your browser, entered data is not sent to me).
• Only after your consent: statistics and marketing cookies from Google, Meta and OpenAI (sections 8 to 10).

You can delete cookies and stored website data in your browser at any time.

13. Recipients and transfers to third countries

Your data only goes to the providers named above, to the extent described: Netlify, Cloudflare, Automattic, Render (all USA), Google, Meta and OpenAI (Ireland/USA) and Telegram (EEA data in the Netherlands). Transfers to the USA are based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) or, where a provider is not certified, on EU Standard Contractual Clauses (Art. 46 GDPR). I am based in Ukraine and handle your requests myself.

14. Retention

• Enquiries without a project (form, email): up to 3 years after the last contact. If a project follows, statutory retention periods apply.
• Chat: server up to 24 hours, Telegram up to 12 months, OpenAI up to 30 days.
• Cookies: _ga 2 years, _gcl_au and _fbp 90 days; Google Analytics at most 14 months.
• Cookie choice: 12 months. Other browser data: until you delete it.

15. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on Art. 6(1)(f) (Art. 21). You can withdraw consent at any time (Art. 7(3)). An informal email to lischuk.a@gmail.com is enough.

You can also lodge a complaint with a supervisory authority (Art. 77 GDPR); in Austria this is the Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at.

I do not make automated decisions within the meaning of Art. 22 GDPR. The AI assistant in the chat only answers questions.

16. Changes

I update this policy when the website or the services used change. The version published here applies.

Change cookie settings