Privacy Policy
Who is responsible
Dan Burdetsky is responsible for the personal data described on this page. He works as an individual practitioner. There is no VAT registration.
Everything on this page can be raised with him directly — on WhatsApp using the number published beside it, or through the contact form. Whichever you use, it goes to him and to nobody else.
What this notice covers
This notice is about visiting this website and sending an enquiry through it. Work carried out for a client under a signed agreement is governed by that agreement, and the data handling in it is separate from anything described here.
What is collected, and where it comes from
Four things collect anything at all. Each is listed with what it actually carries rather than with a category.
The contact form asks for:
- name
- work email
- company / project name
- website (optional) (optional)
- what are you trying to improve?
- where is the process manual or breaking?
- preferred contact method
- privacy acknowledgement (a real, labelled control, not only a sentence of microcopy)
- company size (optional)
- project type (optional)
- budget range (optional)
- target timeline (optional)
- how did you hear about me? (optional)
Two of those fields are free text, and it is worth saying plainly what that means: a free-text field contains whatever the sender chooses to put in it, and there is no way to know in advance what that will be. Please describe the process rather than the data. Do not paste customer records, personal details about other people, passwords, API keys, tokens or document links. There is no attachment field and no file is accepted. Anything that looks like a credential is rejected before it is stored, with a message asking you to remove it and send again.
- Measurement
- Page views and a small set of events describing how the site is used — which pages are opened, which buttons are pressed. The measurement tool sets no cookie, writes nothing to your browser’s storage and generates no identifier that follows you between visits. It processes the IP address in transit to work out a country, region and city, and does not store it.
- Pressing the WhatsApp button opens WhatsApp and hands the conversation to Meta, which processes it under its own terms and its own privacy policy. Dan is not responsible for that part. What he does with the conversation afterwards is what he does with any enquiry, and the retention below applies to it.
- Server logs
- The platform that serves this site records the ordinary details of each request, including the IP address it came from, so that pages can be delivered and the site kept available.
- Nothing else
- There is no account, no login, no payment, no advertising pixel and no third-party tracker. There is no form provider storing a copy of what you send: the form posts to this site’s own code, and no third party holds the message.
Why it is processed, and on what basis
- Answering an enquiry and preparing a proposal
- Steps taken at your request before any contract, and the legitimate interest in replying to somebody who asked to be replied to.
- Spam prevention, rate limiting and keeping the site up
- The legitimate interest in a contact form that is not abused and a site that stays available.
- Measuring how the site is used
- The legitimate interest in knowing which pages are useful. No consent is asked for because none is required: nothing is stored on or read from your device, so there is no cookie to consent to. You can object to this, and how to do that is below.
- Keeping a record of enquiries
- The legitimate interest in remembering who got in touch and what was discussed, for the period stated under retention.
Who else is involved
- Plausible — Measurement
- page views and the site’s own events. The vendor states that it sets no cookie, writes nothing to the browser’s storage and generates no persistent identifier, and that IP addresses are processed in transit to derive a country, region and city and are not stored. Where it processes data: European Union — the vendor states EU-only processing on European-owned infrastructure.
- Cloudflare — Serving this site
- every request to this site. Request metadata, including the IP address the request arrives from, is processed to deliver the page and to keep the site available. Where it processes data: a global edge network — the platform decides which location serves a given request.
- Cloudflare — Short-lived values this site stores itself
- exactly two values when the contact form is used, both of which expire on their own: a one-way hash of the submitted message, kept for the double-submit window, and a counter keyed on the sending IP address, kept for the rate-limit window. Neither is the enquiry itself and neither is joined to one. Where it processes data: a global edge network — the platform decides which location serves a given request.
Two are not named yet, and this page says so rather than leaving you to assume the list is complete. The provider that will send automated replies from the site has not been chosen. The provider of the mailbox that receives enquiries is known but is not published, because publishing it would say more about a private address than has been agreed. Both will be named here when they are settled.
Where the data is
The measurement provider states that the data it processes stays in the European Union, on European-owned infrastructure, and does not leave it. That is the provider’s own statement rather than something independently verified here, and it is repeated as such. The platform serving the site is a global network and decides for itself which of its locations answers a given request, so a request may be served from anywhere it operates. The remaining transfers cannot be described until the two providers above are settled.
How long it is kept
- Unconverted enquiries are deleted after 12 months.
- Server logs are kept for 30 days.
- An enquiry lives in one place: the owner's mailbox.
- Responsible for applying both: Dan.
An enquiry that reaches Dan lives in exactly one place, his mailbox. There is no second copy in a form provider’s dashboard, because there is no form provider. An enquiry that turns into work is kept for as long as that work and the periods any tax or limitation rule requires afterwards.
When the contact form is used, this site stores exactly two values, and both expire on their own:
- a hash of the normalised submission, held for the double-submit window (FR-12).
- a per-source counter keyed on the client IP, held for the limiter window (FR-15). AD-16 labels the key personal data in as many words: pseudonymous, short-lived, never joined to a submission, and described in the privacy notice.
Your rights, and how to use them
All of these are exercised the same way: ask, through the contact form or on WhatsApp. There is no form to fill in and no procedure to follow, and you will not be asked to justify the request.
- Access
- Ask what is held about you and get a copy of it.
- Rectification
- Ask for anything wrong or incomplete to be corrected.
- Erasure
- Ask for it to be deleted. Where there is no reason to keep it, it is deleted.
- Restriction
- Ask for it to be held but not used while something is being sorted out.
- Objection
- Object to anything done on the basis of a legitimate interest — including the measurement and the IP address processed with it — and it stops for you unless there is a compelling reason it cannot, which would be explained.
- Portability
- Ask for what you provided in a form you can take elsewhere.
- Withdrawing consent
- Where anything is ever done on the basis of consent, withdraw it at any time. Nothing on this site currently runs on consent, which is why there is no banner.
An access request is answered within 30 days. Everything else is answered on the same terms as any other message, which are these.
Contact form: I reply within one business day.
WhatsApp: Normally a reply the same business day.
If you are not satisfied
Raise it with Dan first, through the same route. He would rather fix it than have you go elsewhere, and it is faster. That does not take anything away from you: you keep the right to complain to the data protection authority that supervises this processing, and, where the GDPR or the UK GDPR applies to you, to the supervisory authority where you live or work.
Automated decision-making
None. No decision about you is made automatically, and there is no profiling. A person reads every enquiry.
Children
This site is aimed at businesses and is not directed at children. No data is knowingly collected from anyone under 18. If you believe a child has sent something through the form, say so and it will be deleted.
How to raise anything on this page
There is no email address published on this site, and that is deliberate rather than an omission — an address that nobody watches is worse than none, and this one is not published anywhere else either. The two routes are WhatsApp and the contact form.
Contact form: I reply within one business day.
WhatsApp: Normally a reply the same business day.
Representative in the EU and the UK
None is appointed. This site is published in English only, prices nothing in euros, runs no campaign aimed at any European market and has no European contact details, so on the European regulators’ own test it is not offering services into the Union or the United Kingdom. If that changes — a German or French version of the site, pricing in euros, a page written for a European market — a representative is appointed and named here before it ships.
Version and effective date
This version took effect on 2026-08-01.
If this notice changes in a way that affects what is collected or why, the date above changes with it. Nothing is applied retrospectively to data already collected under an earlier version.