Who is responsible for your data
Ivan Hryniuk is the data controller for personal data collected through this website. That means decisions about why and how your data is used are made here, and any question or request about it should come to the contact details below.
Business details
- Name
- Ivan Hryniuk
- info@ivanhryniuk.com
- Phone
- +44 7778 390423
What this notice covers
This notice applies to ivanhryniuk.com and to the email correspondence that follows an enquiry made through it.
It does not cover other websites you may reach from links here. Those sites have their own privacy notices, and this one has no control over what they collect.
What personal data is collected
Only three things, and two of them are unavoidable technical records rather than anything you are asked for.
- What you type into the contact form: your name, your email address, optionally a company name and website, the subject of your enquiry, your message, and your acknowledgement of this notice.
- Standard server records created by every website visit: your IP address, the time of the request and your browser user agent. These are used for security and to make the contact form rate limit work.
- Two cookies stored in your own browser: the language you chose and the cookie choices you made. Both are listed in full in the cookie policy.
Why it is collected, and the lawful basis
UK data protection law requires a specific lawful basis for each use of personal data. These are the ones relied on here.
The lawful basis relied on for each purpose
| What is done | Lawful basis | Why it applies |
|---|---|---|
| Reading and replying to your enquiry | Taking steps at your request before entering into a contract — UK GDPR Article 6(1)(b) | You contacted a business about its services, so replying and discussing the work is the very thing you asked for. |
| Keeping the site available and preventing abuse: server logs, rate limiting and the spam checks on the contact form | Legitimate interests — UK GDPR Article 6(1)(f) | There is a genuine interest in the site staying online and the contact form not being used to send spam. The data involved is minimal, it is kept briefly, and it is not used to build any profile of you. |
| Setting the strictly necessary cookies listed in the cookie policy | No consent required — PECR regulation 6(4) | Both cookies exist only to deliver something you asked for: the language you selected, and the cookie choices you made. No other cookie is set. |
| Keeping accounting and tax records | Legal obligation — UK GDPR Article 6(1)(c) | Where work is invoiced, the record has to be kept for the period UK tax law requires. |
How long data is kept
Nothing is kept indefinitely. Where the law sets the period, that period applies; otherwise data is deleted once the reason for holding it has passed.
How long each kind of data is kept
| Data | Kept for | Why |
|---|---|---|
| Contact form enquiries and the email correspondence that follows | Up to 12 months after the last message | Long enough to pick up a conversation that goes quiet and restarts, and no longer. Deleted sooner on request. |
| Records of work carried out: proposals, contracts, invoices and related correspondence | 6 years after the end of the financial year the work ended in | HMRC requires business records to be kept for six years, so this data cannot be deleted earlier even on request. |
| Server and security logs, including IP address, request time and browser user agent | Up to 30 days | Enough to investigate an outage or an attack, and to keep the contact form rate limit working. |
| The language and cookie-choice cookies stored in your own browser | 12 months and 6 months respectively, or until you delete them | These sit on your device, not on any server here, and you can clear them at any time. |
Who else is involved
Running a website means other companies process data on this site’s behalf. Each one is listed below with what it does. They act on instructions only and may not use your data for their own purposes.
Your data is not sold, rented, or shared with anyone for their own marketing.
Companies that process data on behalf of this site
| Role | Provider | What it does | Where data is processed | Transfer safeguard |
|---|---|---|---|---|
| Hosting and content delivery | Vercel, Inc. | Serves the website and runs the code that processes a contact form submission. | United Kingdom, European Union and United States | Covered by Vercel's data processing agreement, which incorporates the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses. |
| DNS and network security | Cloudflare, Inc. | Resolves the domain name, routes traffic to the site and filters malicious requests. | Global edge network, including the United States | Covered by Cloudflare's data processing agreement, which incorporates the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses. |
| Not yet selected | Receives and stores the enquiry correspondence sent to and from info@ivanhryniuk.com. | To be confirmed | To be confirmed once the mailbox provider is named. | |
| Contact form delivery | Not yet selected | Receives a validated enquiry from the contact form and passes it on for a reply. | To be confirmed | To be confirmed once the delivery endpoint is selected. |
| Analytics | None used | Not used. No analytics, measurement or session-recording service is installed on this site. | Not applicable | Not applicable |
| Customer relationship management | None used | Not used. Enquiries are handled by email; no CRM system holds your details. | Not applicable | Not applicable |
Sending data outside the United Kingdom
Some of the providers above are based in the United States or operate global networks, so your data may be processed outside the UK.
Where that happens it is covered by the UK International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses, agreed with each provider. That is the mechanism UK law provides for transfers to countries without an adequacy decision.
How your data is protected
Security is built into how this site works rather than added afterwards.
- The site is served only over HTTPS, with HSTS, a Content Security Policy and a full set of security headers.
- Everything submitted through the contact form is validated on the server before it is used, with length limits and control characters stripped.
- The contact form is rate limited and carries spam checks, so it cannot be used to send mass messages.
- Enquiry content and full email addresses are never written to server logs.
- No credentials or API keys are contained in the website code or sent to your browser. Secrets are held only as environment variables in the hosting platform.
- Access to the mailbox and the hosting account is limited to Ivan Hryniuk and protected by strong, unique passwords and two-factor authentication.
- When a retention period ends, the correspondence is deleted from the mailbox including its deleted-items folder.
If something goes wrong
If a personal data breach occurs, it is recorded and assessed immediately. Where it is likely to result in a risk to people’s rights and freedoms it is reported to the Information Commissioner’s Office within 72 hours of becoming aware of it, as UK GDPR Article 33 requires.
Where a breach is likely to result in a high risk to you, you will be told directly and without undue delay, along with what happened and what to do about it.
Marketing and newsletters
There is no newsletter and no marketing email list. Your details are used to reply to your enquiry and to carry out any work that follows, and for nothing else.
If an email newsletter is ever introduced, it will be opt-in only: a separate, unticked box you actively choose, never a condition of sending an enquiry. Every message would carry a working unsubscribe link, unsubscribing would take effect immediately, and your address would not be used for marketing again.
Your rights
Under UK GDPR you have the following rights over your personal data. They are free to exercise, and a request is answered within one month.
- Access — ask for a copy of the personal data held about you.
- Rectification — have inaccurate or incomplete data corrected.
- Erasure — ask for your data to be deleted, unless it has to be kept for tax or legal reasons.
- Restriction — ask for processing to be paused while a concern is resolved.
- Objection — object to processing based on legitimate interests, including the security logging described above.
- Portability — receive the data you provided in a structured, machine-readable format.
- Withdraw consent — where anything relies on consent, withdraw it at any time. Withdrawing is as easy as giving it, and does not affect what was done before.
- Complain — raise a concern with the Information Commissioner’s Office.
How to make a request or complain
Send any privacy request to info@ivanhryniuk.com with enough detail to identify what you are asking about. There is no form to fill in and no fee. If more information is needed to confirm your identity, you will be asked for it before data is released.
If you are not satisfied with the response, you can complain to the Information Commissioner’s Office, the UK supervisory authority for data protection, at ico.org.uk/make-a-complaint or on 0303 123 1113. You are welcome to raise the issue here first, but you do not have to.
Changes to this notice
If this notice changes, the updated version is published on this page with a new date at the top. Where a change materially affects how your data is used, you will be told directly if there is an ongoing conversation.