Privacy notice

1. Who we are

This notice explains how personal data is handled on culmentech.com (the “site”). The site is run by FOP Kormysh Roman Ivanovich, registered in Ukraine, trading as Culmentech (“Culmentech”, “we”, “us”). FOP is the Ukrainian term for a sole proprietor.

We decide why and how your personal data is used, so we are its controller.

For anything about your data, write to info@culmentech.com or call +380 75 686 3849.

We have not appointed a data protection officer, because the law does not require one for our activity.

2. What this notice covers

It covers the main page, the offer pages, the discovery call page and its form, and the legal pages of this site, in English and Ukrainian. It also covers messages you send us directly by email, phone, WhatsApp or LinkedIn.

Work we do for a client is covered by the written agreement we sign with that client.

3. What data we collect and where it comes from

We collect only what we need. You give us some of it; the rest comes automatically from your browser or reaches our server with your request.

You do not have to give us any data. Without your name and phone number, though, we cannot arrange the discovery call. We never ask for sensitive data, such as health details, so please do not send it.

• From you, through the discovery call form: your first name, your last name and your phone number, with its country code. The form has no email field.
• Sent automatically with the form: the date and time, the page and offer you sent it from, the page language. Also the version of the page you saw, the site that linked to us, and your cookie choice for Marketing. If you accepted Marketing, it also includes the campaign tags in the link you arrived by (UTM tags). With them, the form sends the Meta click identifier from that link (fbclid, as a _fbc value). It also sends the Meta browser identifier (_fbp), if your browser has one.
• Received by our server with every request: your IP address and your browser’s user agent (a short text that names your browser and device type). Neither is written into the lead file: from the user agent we keep only the kind of device (phone, tablet or computer) with your request. They are used for the Meta events described below and for security.
• Server logs: like most websites, our web server records requests (IP address, date and time, the page requested, the referring page and the user agent) for security and to fix faults.
• Visit statistics: Plausible Analytics counts pages viewed (with the page address, including any campaign tags in the link), referring sites, browser, device type and country, how long a page stays in view and how far it is scrolled, and a few events: a click on a button that leads to the form, sending the form and switching the language. It uses no cookies and does not identify you: your IP address is used only briefly to tell visits apart and to estimate your country, and it is never stored.
• Only with your consent, each in its own cookie category: Microsoft Clarity (Statistics) and the Meta Pixel (Marketing) record how you use the site, such as the pages you view (including the discovery call page) and the page you came from, clicks, scrolling and sending the form, linked to their cookie identifiers. The Meta Pixel sends only the events this site asks for (page views, a click on a button that leads to the form, and sending the form); its automatic collection of button text and form field names is switched off. Clarity also creates recordings and heatmaps of how pages are used.
• When you contact us directly: your name, your contact details and whatever you choose to tell us.

4. Why we use your data, and on what legal basis

We use your data only for the purposes below. For each one we name the legal basis under the EU General Data Protection Regulation (GDPR) and the UK GDPR. The bases under Ukrainian law are in the next section.

Where we rely on our legitimate interests, we have weighed them against your rights and expectations. You can ask us for the details of that assessment.

• To answer your request for a discovery call: to call you, agree a time, hold the discovery call and, if you wish, send you a proposal. This includes storing your request, a copy of it in our Google Sheets spreadsheet and a notification of it sent to Roman through Telegram. Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).
• To keep the site and the form secure and free of spam, with automated checks of what is sent and with server logs. Legal basis: our legitimate interest in protecting the site and our systems (Article 6(1)(f) GDPR).
• To measure which ads and pages bring requests, only if you accept Marketing. Our server then sends Meta a “Lead” event when you send the form. It sends a “cta_click” event when you click a button that leads to the form. Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw it at any time in Cookie settings, at the bottom of every page.
• To count visits with Plausible, which uses no cookies and does not identify you. Legal basis: our legitimate interest in understanding how the site is used (Article 6(1)(f) GDPR).
• To see how pages are used with Microsoft Clarity (the Statistics category), and to measure ads with the Meta Pixel and the Microsoft Ads cookies Clarity may set (the Marketing category). Legal basis: your consent (Article 6(1)(a) GDPR, and the consent that the UK and EU rules on cookies require), given or refused for each category. You can withdraw it at any time.
• To reply to messages you send us directly. Legal basis: steps at your request before entering into a contract (Article 6(1)(b) GDPR) or our legitimate interest in replying to you (Article 6(1)(f) GDPR).
• To meet our legal obligations, and to establish, exercise or defend legal claims. Legal basis: legal obligation (Article 6(1)(c) GDPR) and our legitimate interest in protecting our rights (Article 6(1)(f) GDPR).

5. Legal bases under Ukrainian law

We are registered in Ukraine, so the Law of Ukraine “On Personal Data Protection” also applies. Under Article 11 of that law, we process your personal data on these grounds:

• your consent as the data subject, to the processing of your personal data for the purposes in this notice. Sending the form gives it (the line next to the form’s send button says so). You give separate consent to Statistics (Microsoft Clarity) and to Marketing (the Meta Pixel and our server’s Meta events). You give it with Accept all in the cookie banner or in Cookie settings;
• steps taken at your request before a contract is made, such as the discovery call;
• the need to protect our legitimate interests, such as the security of the site and protection from spam. This ground gives way where your fundamental rights and freedoms outweigh those interests.
• You can withdraw your consent at any time. This does not affect processing carried out before you withdrew it.

6. Who receives your data

We do not sell your data. We share it only with the providers below, and only as described. Meta also uses what it receives for its own purposes, as explained below.

• Oracle (Oracle Cloud Infrastructure) hosts our server: a virtual machine we rent in the US West (San Jose) region, in the USA. Everything the site receives is processed and stored there: the form, the lead file, the server logs and our Plausible statistics. Oracle processes this data for us as our processor.
• Plausible Analytics is open-source software that we run ourselves on that server, so no visit data goes to its makers.
• Telegram delivers a notification of each new request to Roman. It contains your name, your phone number, the offer, page and language, the version of the page and where your visit came from. Telegram keeps the message in Roman’s chat under its own terms and privacy policy.
• Lead records are also kept in Culmentech’s own business account (Google Sheets).
• Meta Platforms Ireland Ltd receives the “Lead” and “cta_click” events and the Meta Pixel data only if you accepted Marketing. The “Lead” event carries your phone number, first name and last name in hashed form (encoded on our server with SHA-256, so the plain values are not sent), plus your IP address, user agent, the page address, the Meta click and browser identifiers, and the campaign, source and offer you came from. The “cta_click” event carries your IP address, user agent, the page address and the Meta click and browser identifiers. Meta uses hashed data to match events with Meta accounts. For collecting and sending this data, we and Meta Platforms Ireland Ltd act as joint controllers; Meta alone decides how it uses the data after it receives it, as described in its Privacy Policy (facebook.com/privacy/policy). The arrangement between us and Meta is set out in Meta’s Controller Addendum (facebook.com/legal/controller_addendum). In short, we are responsible for telling you about the collection and sending, and for asking your consent where it is needed; Meta is responsible for how it uses the data after it receives it, and handles requests about that use. You can use your rights against either of us.
• Microsoft receives usage data through Microsoft Clarity only if you accepted Statistics, and handles it under the Microsoft Privacy Statement (privacy.microsoft.com).
• The provider of our business email receives the messages you send to our address.
• WhatsApp, a Meta company, delivers the messages you send us on WhatsApp. LinkedIn delivers those you send us there. Each does so under its own terms and privacy policy.
• Public authorities, courts or professional advisers, when the law requires it or when we need them to protect our rights.

7. International transfers

We are based in Ukraine, and our server is in the USA. Google, Meta, WhatsApp, Microsoft, LinkedIn and Telegram also process data in other countries, including the USA. So your data is transferred outside the UK, the EU and the European Economic Area (EEA), and outside Ukraine.

Where the law requires safeguards for these transfers, we rely on those our providers offer: the European Commission’s Standard Contractual Clauses (with the UK Addendum for data from the UK) and, where a US provider is certified under it, the EU–US Data Privacy Framework and its UK Extension. Under Ukrainian law, we transfer data abroad on the grounds that law allows, in particular where we provide appropriate safeguards for your private and family life, or where you have given your unambiguous consent to the transfer.

You can ask us for more information about these safeguards at info@culmentech.com.

8. How long we keep your data

We keep your data only as long as we need it for the purposes above.

• Discovery call requests: 24 months after you sent the form, then deleted. Our server deletes each request from the lead file automatically when that time is up. Roman deletes the Telegram notification, the request’s row in our Google Sheets spreadsheet and any copy we export to follow up by hand, within the same period. You can ask us to delete them sooner.
• Messages you send us directly: up to 24 months after our last contact with you, then deleted.
• If you become a client, the records of our work together are kept for as long as our agreement and the law require.
• Server logs: our web server keeps its request logs for 14 days, then deletes them automatically. The site program’s own logs hold only errors and routine notices, not your form data; they are limited to three files of 10 MB each, and the oldest entries are overwritten as new ones arrive.
• Plausible statistics: kept as visit records that do not identify you (the visitor code they carry changes every day, so one person cannot be followed from one day to the next).
• Data sent to Meta and Microsoft: kept by them under their own retention rules. Their cookies on this site expire as listed in the cookie table below.
• We keep data longer only when the law requires it, or when we need it to establish, exercise or defend a legal claim.

9. How we protect your data

We take technical and organisational measures that fit the data we hold. No method of storing or sending data is completely secure, but we work to protect yours.

• The site is served only over an encrypted connection (HTTPS).
• Leads are stored in a file on our server that is not publicly reachable and is opened only by the site’s server program and by us. The export of leads is protected by a username and password.
• Only we can access the server, and signing in requires a cryptographic key.
• The form limits how often it can be used, and automated checks reject submissions that look machine-made.
• Your phone number and names are hashed on our server before anything is sent to Meta.
• Access keys for our providers are kept only on the server, never in the site’s code.
• If a breach puts your data at risk, we will tell the supervisory authority and you where the law requires it.

10. Your rights

Depending on where you live, the GDPR, the UK GDPR and the Law of Ukraine “On Personal Data Protection” give you these rights:

• Access: to know whether we process your data, and to get a copy of it with information about how we use it.
• Rectification: to have inaccurate or incomplete data corrected.
• Erasure: to have your data deleted, for example when we no longer need it or when you withdraw your consent.
• Restriction: to have the use of your data limited, for example while we check whether it is accurate.
• Portability: to receive the data you gave us in a common, machine-readable format, or to have it sent to another controller, where we process it by automated means on the basis of your consent or of steps towards a contract.
• Objection: to object at any time to processing based on our legitimate interests.
• Withdrawal of consent: to withdraw your consent at any time through Cookie settings at the bottom of every page (for one category, or for all of them with Withdraw your consent), or by writing to us. This does not affect processing carried out before.
• No solely automated decisions: not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on you. We make no such decisions. The only automated step is the anti-spam check on the form, which only blocks submissions that look machine-made. If it blocks you by mistake, contact us directly.
• Under Ukrainian law, also: to know the sources of your data, where it is kept, why it is processed and which third parties receive it; to send us a reasoned objection to its processing; and to have your data protected from unlawful processing and from accidental loss, destruction or damage.

11. How to use your rights

Write to info@culmentech.com. It costs you nothing. We will reply within one month of receiving your request (for a request under Ukrainian law, within 30 calendar days). If a request is complex, we may need longer where the law allows it (never for a request under Ukrainian law), and we will tell you why within that month.

To protect your data, we may ask you to confirm who you are before we act on a request, for example with a call to the phone number you gave us.

You can change your cookie choice at any time with Cookie settings at the bottom of every page.

12. Complaints

If you think we have mishandled your data, please tell us first at info@culmentech.com, so we can put it right. We will acknowledge your complaint within 30 days and tell you the result without undue delay. You also have the right to complain to a supervisory authority, and to go to court:

• in the UK: the Information Commissioner’s Office (ico.org.uk);
• in the EU or the EEA: the data protection authority of the country where you live or work, or where the issue happened (the list is on edpb.europa.eu);
• in Ukraine: the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua).

13. Cookies and similar technologies

Cookies are small files a site stores in your browser. Session storage is similar, but your browser clears it when you close the tab. Local storage is similar too, but it stays until you clear your browser data. We use the ones in the table below.

Nothing optional loads before you choose. The cookie banner offers Accept all, Reject all and Settings side by side, and rejecting takes one click, like accepting. Cookie settings, at the bottom of every page, shows your current choice for each category, lets you switch Statistics and Marketing on or off, and lets you withdraw your consent for both at once. Switching a category off deletes its cookies and its entries in local storage on this site; if its tool ran during the same visit, the page also reloads.

When their tools run, Microsoft Clarity, Microsoft and Meta also set cookies on their own domains. Examples are CLID and MUID for Clarity and Microsoft, and fr for Meta. Their own policies cover those cookies. You can block or delete cookies in your browser settings too.

We sort ours into three categories, the same ones as in Cookie settings:

• Necessary, always on: the cmt_consent cookie, which remembers your choice, the leak calculator’s cmt_calc_v1 in local storage, which keeps the numbers you enter there in your browser, and the discovery call form, which stores nothing in your browser. The site needs them to work.
• Statistics, only with your consent: Microsoft Clarity, to see how pages are used (clicks, scrolling, session recordings and heatmaps). Its cookies are _clck and _clsk. Plausible, our visit statistics, sets no cookies and stores nothing in your browser, so it is not behind this switch: it always runs.
• Marketing, only with your consent: the Meta Pixel, to measure which ads bring requests (its cookies _fbp and _fbc, and three entries in local storage), and the Microsoft Ads cookies Clarity may set when Statistics is on too (_uetvid, _uetsid, _uetmsclkid). Marketing also lets our server send the Meta events and keeps where you came from in session storage (cmt_fbclid, cmt_utm). Switching it off stops both and deletes those entries.

14. Children

The site is meant for business owners and is not directed at children. We do not knowingly collect data from children. If you think a child has sent us their details, write to us and we will delete them.

15. Changes to this notice

We may update this notice when the site or the law changes. The effective date at the top shows the current version. If a change significantly affects how we use data you have already given us, we will tell you before it applies, where we can reach you.