digital(R)evolution / Legal
Privacy & Cookie Policy
1. Scope
This Privacy & Cookie Policy (the “Policy”) explains how digital(R)evolution collects, uses, stores, discloses and protects personal data and personal information when you visit digital-r-evolution.com, use its language versions, submit a request through the Site, or otherwise communicate with us in connection with the Site (collectively, the “Site”).
The controller responsible for the processing described in this Policy is Oleh Artemovych Savytskyi, individual entrepreneur (FOP), Ukrainian tax identification number 2574105050, operating under the digital(R)evolution brand (“digital(R)evolution,” “we,” “us,” or “our”).
This Policy primarily covers processing for which we determine the purposes and means. If, as part of a client engagement, we process personal data solely on a client's documented instructions, that processing may instead be governed by the applicable services agreement, data processing agreement or other client-specific terms.
We are established in Ukraine. Ukrainian data protection law applies to our processing. The EU General Data Protection Regulation (GDPR) and national laws implementing the ePrivacy Directive may also apply where their territorial-scope requirements are met. U.S. federal and state privacy laws may apply depending on the location of the individual, the nature of the processing and the applicability criteria of the relevant law.
Visiting the Site or providing information to us does not constitute blanket consent to every possible use of your information. Where consent is required, it is requested separately for the specific processing concerned.
2. Controller and privacy contact
Oleh Artemovych Savytskyi, individual entrepreneur (FOP)
Trading name: digital(R)evolution
Ukrainian tax identification number: 2574105050
Postal address: 103 Sichovykh Striltsiv Street, Apt. 25, Kyiv, 04050, Ukraine
Telephone: +380 93 265 68 82
Email: [email protected]
We do not maintain an establishment or a separately designated privacy representative in the EU/EEA. EU/EEA users may send privacy requests directly to the controller using the contact details above.
3. Information we collect
3.1. Information submitted through the free audit form
The free GEO/SEO/AEO audit form may collect:
- full name;
- work email address;
- website URL;
- job title, if provided;
- the product or service to be reviewed;
- target market and language;
- information relevant to audit eligibility or scope, such as whether the business has active sales;
- other information voluntarily included in the request;
- technical records associated with submission, security and abuse prevention;
- a record that the privacy notice was presented and acknowledged at the time of submission.
A checkbox acknowledging that you have read this Policy is a notice acknowledgement. It is not consent to unrelated marketing, advertising, analytics or any other processing that requires a separate legal basis.
3.2. Communications
If you contact us by email, telephone, messenger or another channel, we may process your contact details, the content of your message, attachments and other information you voluntarily provide so that we can respond and manage the communication.
3.3. Technical and security information
When the Site is used, our hosting, application and security infrastructure may automatically process information needed to deliver, secure and troubleshoot the Site, including:
- IP address;
- date and time of a request;
- requested URL or resource;
- browser type and version, User-Agent and similar technical headers;
- device and operating-system information made available by the browser;
- referrer information where transmitted by the browser;
- security, error and diagnostic logs;
- signals used to detect bots, spam, fraud or malicious activity;
- privacy and analytics preferences.
3.4. Contract and business relationship information
If an inquiry develops into a business relationship, we may additionally process information reasonably necessary to identify the contracting party or its representative, prepare proposals and agreements, issue invoices, receive payments, maintain business records, communicate about the engagement and comply with legal obligations.
3.5. Publicly available business information
When reasonably necessary to respond to an inquiry or perform a requested audit, we may review publicly available information about the relevant business, website, product, service, market or professional contact. We seek to avoid collecting personal data that is not necessary for the requested work.
3.6. Sensitive information
The Site is not intended to collect sensitive personal data or sensitive personal information, such as government identification numbers, account passwords, precise geolocation, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric data used for identification, health information, information about sex life or sexual orientation, or information about criminal convictions and offences. Please do not submit such information unless it is genuinely necessary, lawful and specifically requested by us.
4. Why we use information and our GDPR legal bases
We use personal information only for specified purposes. Where the GDPR applies, each processing activity must have a valid legal basis under Article 6 GDPR.
| Purpose | Typical information | GDPR legal basis where applicable |
|---|---|---|
| Receive, assess and respond to a free audit request or other inquiry | Name, work email, website URL, job title, product/service, market, language, request content | Article 6(1)(b) where processing is necessary to take steps at the individual's request before entering into a contract; otherwise Article 6(1)(f), our legitimate interests in responding to business inquiries and developing business relationships |
| Perform research reasonably necessary for a requested audit | Publicly available business and professional information relevant to the request | Article 6(1)(b) where the research forms part of requested pre-contractual steps; otherwise Article 6(1)(f), our legitimate interests in providing a useful response to the request |
| Prepare, enter into and perform a contract | Identity, contact, contract, communication, billing and transaction information | Article 6(1)(b) where the individual is a party to the contract; Article 6(1)(f) for communications with representatives of corporate clients; Article 6(1)(c) for legal obligations |
| Maintain tax, accounting and legally required records | Contract, invoice, payment and other legally required records | Article 6(1)(c) — compliance with legal obligations |
| Operate, secure and troubleshoot the Site | IP address, request logs, browser information, security and diagnostic signals | Article 6(1)(f) — our legitimate interests in providing a reliable and secure Site, preventing abuse and protecting users and our systems |
| Protect forms from automated abuse using Cloudflare Turnstile | Browser, device and network signals necessary for bot detection | Article 6(1)(f) — our legitimate interests in fraud, spam and abuse prevention and Site security |
| Optional website analytics and measurement | Online identifiers and usage/interaction data depending on the analytics service actually enabled | Article 6(1)(a) — consent, where required; optional analytics for EU/EEA users are not activated before the required consent is obtained |
| Establish, exercise or defend legal claims and prevent misuse | Relevant communications, technical logs, contract and transaction records | Article 6(1)(f) — our legitimate interests in protecting our rights and resolving disputes; Article 6(1)(c) where processing is required by law |
Where we rely on legitimate interests, we consider whether the processing is necessary and whether those interests are overridden by your interests, rights or freedoms. Where the GDPR applies, you may object to processing based on legitimate interests as described in Section 10.
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing lawfully carried out before withdrawal and does not prevent continued processing where another legal basis independently applies.
6. Service providers and other recipients
We disclose personal information only where reasonably necessary for the purposes described in this Policy, under appropriate contractual or legal terms, or where disclosure is required by law.
| Provider / category | Function | Information that may be involved |
|---|---|---|
| Payload CMS and PostgreSQL | Application content and database functionality | Audit-form data and related application records stored in the Site infrastructure |
| Hosting / server infrastructure provider | Hosting, storage, networking and Site operation | Information stored in or transmitted through Site infrastructure; server and security logs |
| Plus Five Five, Inc. (Resend) | Transactional email delivery | Email address, delivery metadata and the content of the relevant transactional email |
| Cloudflare, Inc. (Turnstile) | Bot and abuse prevention | Browser, device and network security signals necessary for the service |
| Google LLC (Google Tag Manager) and any analytics provider identified in Analytics settings | Tag management and optional analytics after the required privacy choice | Technical and usage data depending on the particular tag, service and configuration |
| Professional advisers and business administration providers | Legal, accounting, audit and business administration where reasonably necessary | Only information necessary for the relevant professional or legal purpose |
| Government authorities, courts and law-enforcement bodies | Compliance with binding legal obligations or lawful requests | Information required by the applicable lawful process |
Payload CMS and PostgreSQL are software components rather than independent recipients by themselves. If those components are hosted by an external infrastructure provider, the provider may process information as necessary to provide the hosting service.
Provider privacy information: Resend Privacy Policy, Resend Data Processing Addendum, Cloudflare Privacy Policy, Cloudflare Turnstile Privacy Addendum, and Google Privacy Policy.
7. International data transfers
We are established in Ukraine, and some service providers are established in or process information from the United States or other countries. Personal information may therefore be processed outside the country or region in which you are located.
Where Chapter V GDPR applies to an onward transfer of personal data, we use an available lawful transfer mechanism as required, such as an adequacy decision, the European Commission's Standard Contractual Clauses (SCCs) together with appropriate supplementary safeguards where necessary, or another transfer mechanism permitted by the GDPR.
Resend's current Data Processing Addendum is incorporated into its service terms and includes the EU SCCs for covered transfers. Resend states that Module Two applies where the customer is a controller and Resend acts as processor. For other providers, the applicable transfer mechanism depends on the service, contractual terms, configuration and destination involved.
You may contact us for information about safeguards relevant to a particular transfer, subject to legitimate confidentiality and security restrictions.
8. Data retention
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, to comply with law, resolve disputes, enforce agreements or establish, exercise or defend legal claims.
| Category | Typical retention period / criterion |
|---|---|
| Free-audit requests that do not become a client relationship | Until the request and reasonable follow-up are completed, generally no longer than 12 months after the last substantive contact unless another lawful reason requires longer retention |
| Business correspondence and pre-contractual records | For the business relationship and generally up to 3 years after the last substantive contact or end of the relationship, unless a longer period is required by law or a legal claim |
| Contracts, invoices, accounting and tax records | For the period required by applicable Ukrainian law and any other law that validly applies |
| Security and technical logs | For the period reasonably necessary for security, troubleshooting and incident investigation; records linked to a specific incident may be retained until the incident or related claim is resolved |
| Privacy-choice records | For as long as reasonably necessary to demonstrate the choice made and comply with legal obligations, after which the record is deleted or de-identified unless continued retention is required by law |
| Optional analytics data | According to the retention configuration disclosed in Analytics settings; future collection stops after consent is withdrawn where consent is the basis for processing |
When information is no longer required, we delete, destroy or de-identify it unless continued retention is permitted or required by applicable law.
9. Security
We use reasonable technical and organisational safeguards appropriate to the nature of the processing and the risks involved. Depending on the system, measures may include:
- HTTPS/TLS encryption in transit;
- access controls and limiting access to authorised persons who need it;
- administrative and server access controls;
- backup and recovery measures;
- security and diagnostic logging;
- anti-bot and abuse-prevention controls;
- confidentiality obligations for persons with authorised access;
- appropriate contractual safeguards with service providers.
No method of transmission or storage can guarantee absolute security. If a personal data breach occurs, we assess it and provide any notifications required by applicable data-breach law, including GDPR notification requirements where applicable.
10. EU/EEA privacy rights
Where the GDPR applies to our processing of your personal data, you may have the following rights, subject to the conditions and exceptions provided by law:
- Access: obtain confirmation whether we process your personal data and receive a copy.
- Rectification: ask us to correct inaccurate or incomplete personal data.
- Erasure: ask us to delete personal data where the legal requirements are met.
- Restriction: ask us to restrict processing in circumstances provided by law.
- Portability: receive certain data in a structured, commonly used, machine-readable format where the right applies.
- Objection: object to processing based on legitimate interests on grounds relating to your particular situation.
- Direct marketing objection: object at any time to processing for direct marketing.
- Withdraw consent: withdraw consent at any time where processing is based on consent.
- Automated decisions: exercise rights relating to qualifying decisions based solely on automated processing.
- Complaint: lodge a complaint with a competent data protection supervisory authority.
We do not currently use Site visitor information to make decisions based solely on automated processing that produce legal effects or similarly significantly affect the individual.
We normally respond to GDPR rights requests within one month of receipt. The period may be extended where permitted by Article 12 GDPR, in which case we will inform you as required by law. We may request information reasonably necessary to verify your identity.
An EU/EEA individual may lodge a complaint with a supervisory authority, in particular in the Member State of habitual residence, place of work or place of the alleged infringement. A list of supervisory authorities is available from the European Data Protection Board .
11. United States privacy disclosures
This section provides additional information for individuals in the United States. U.S. privacy laws vary by state, and comprehensive state privacy laws generally apply only when statutory thresholds or other applicability criteria are met. Where a particular law applies to us and to your information, we provide the rights and disclosures required by that law.
11.1. Categories of personal information
In the preceding 12 months, the Site may have collected the following categories of personal information:
| Category | Examples relevant to the Site | Sources | Purposes | Categories of recipients |
|---|---|---|---|---|
| Identifiers | Name, work email address, IP address, online identifiers | Directly from you; automatically from browser/device | Respond to inquiries, deliver requested services, security, optional analytics after the applicable choice | Hosting/infrastructure providers, Resend, Cloudflare, analytics providers where enabled, professional advisers where necessary |
| Commercial information | Product or service of interest, website URL, target market, audit request, relationship history | Directly from you; relevant public business sources | Assess and respond to requests, provide audits/services, manage business relationships | Infrastructure providers, professional advisers and authorised persons where necessary |
| Internet or other electronic network activity | Request logs, browser/device information, Site interactions when optional analytics are enabled | Automatically from browser/device and Site infrastructure | Site delivery, security, diagnostics and optional analytics | Hosting/infrastructure providers, Cloudflare and analytics providers where enabled |
| Professional or employment-related information | Job title, company role or professional contact details when provided | Directly from you; public business sources where relevant to a requested audit | Business communication, audit scoping and client relationship management | Infrastructure providers, professional advisers and authorised persons where necessary |
| Approximate geolocation | Approximate region that may be inferred from an IP address | Browser/device/network | Security, technical operation and optional analytics | Infrastructure/security providers and analytics providers where enabled |
| Communications and customer records | Emails, messages, attachments, inquiry content, contract or billing records where applicable | Directly from you; created during the business relationship | Respond to requests, provide services, maintain records, billing, legal compliance and dispute resolution | Resend where used for delivery, infrastructure providers, professional advisers and authorities where legally required |
We do not intentionally collect sensitive personal information through ordinary use of the Site beyond technical information that applicable law may classify as sensitive in a particular jurisdiction.
11.2. Sale, sharing and targeted advertising
We do not sell personal information as the term “sale” is defined by applicable U.S. state comprehensive privacy laws. We do not use Site personal information for cross-context behavioural advertising or targeted advertising and do not intentionally share personal information for those purposes.
Optional analytics are configured for measurement rather than advertising personalisation. If we introduce a configuration or service that constitutes a sale, sharing, targeted advertising or qualifying profiling under applicable U.S. law, we will provide the required notice and opt-out mechanism before or when that processing begins.
We have not knowingly sold or shared for cross-context behavioural advertising the personal information of individuals under 16 through the Site.
11.3. Universal opt-out signals
Global Privacy Control (GPC) and other recognised universal opt-out mechanisms may be used under certain U.S. state privacy laws to opt out of sale or targeted advertising. Because we do not currently engage in the activities described in Section 11.2, there is no separate sale or targeted-advertising opt-out to apply to current Site processing. If such processing is introduced and applicable law requires us to recognise a qualifying universal opt-out signal, we will honour that signal as required.
11.4. Financial incentives
We do not currently offer a financial incentive, price difference or service difference in exchange for the collection, sale or sharing of personal information through the Site.
11.5. U.S. state privacy rights
Depending on your state and whether the relevant law applies to us and to the particular processing, you may have rights to:
- confirm whether we process your personal information and access it;
- correct inaccuracies;
- request deletion, subject to lawful exceptions;
- obtain a portable copy of certain personal information;
- opt out of the sale of personal information;
- opt out of targeted advertising or cross-context behavioural advertising;
- opt out of certain qualifying profiling or automated decision-making;
- limit certain uses or disclosures of sensitive personal information where the right applies;
- appeal a refusal of a privacy request where state law provides an appeal right;
- exercise privacy rights without unlawful discrimination or retaliation.
If permitted by applicable law, an authorised agent may submit a request on your behalf. We may require reasonable evidence of the agent's authority and may independently verify your identity where permitted.
12. California disclosures
12.1. California Online Privacy Protection Act (CalOPPA)
For California users, this Policy describes the categories of personally identifiable information collected through the Site, the categories of third parties with whom the information may be shared, how to request review or correction, how we communicate material changes to the Policy and the effective date of the current Policy.
12.2. Do Not Track
Some browsers transmit a legacy Do Not Track (“DNT”) signal. There is no universally adopted DNT response standard. We do not currently interpret the legacy DNT header as a separate instruction. You can refuse or withdraw optional Site analytics through Analytics settings.
12.3. Third-party online tracking
Security and optional analytics providers may receive technical information from the Site as described in Sections 5 and 6. We do not intentionally permit third parties to collect personally identifiable information through the Site over time and across unrelated websites for cross-context behavioural advertising or targeted advertising.
12.4. California Consumer Privacy Act (CCPA)
The CCPA is threshold-based. Nothing in this Policy is an admission that digital(R)evolution meets the statutory definition of a “business” subject to the CCPA. If and to the extent the CCPA applies to us and to your personal information, the disclosures in Sections 8, 11 and 12 describe relevant categories, purposes, retention criteria, disclosure practices and consumer rights.
Because we do not currently sell or share personal information for cross-context behavioural advertising as described in Section 11.2, we do not currently provide a “Do Not Sell or Share My Personal Information” link. If that changes and applicable law requires such a mechanism, we will provide it.
We do not currently use sensitive personal information collected through the Site for purposes that would require a California “Limit the Use of My Sensitive Personal Information” mechanism.
13. Marketing communications
Providing an email address for an audit or inquiry does not by itself subscribe you to unrelated marketing campaigns.
Service-related and transactional communications may be sent where necessary to respond to a request, provide an audit, perform a contract, issue administrative notices or otherwise manage the relationship.
If we send direct marketing, we do so only where permitted by applicable law. Where EU/EEA electronic-marketing rules require prior consent, we obtain that consent separately unless a specific statutory exception applies. You may object to direct marketing at any time.
U.S. commercial email is handled in accordance with applicable requirements of the CAN-SPAM Act. Covered marketing emails include an effective opt-out method and a valid postal address where required, and applicable opt-out requests are honoured within 10 business days.
14. Children
The Site and digital(R)evolution services are designed for business and professional users and are not directed to children. We do not knowingly collect personal information through the Site from children under 13 in the United States or intentionally seek consent-based processing from children where parental authorisation would be required by applicable law.
If you believe a child has provided personal information to us in circumstances where we should not hold it, please contact us so that we can review and, where appropriate, delete the information.
15. Third-party links
The Site may contain links to websites, social networks, messaging services or other third-party resources. When you leave our Site, the third party's own privacy terms apply to its processing unless we jointly determine the purposes and means of a particular processing activity. We encourage you to review the relevant third-party privacy notice before providing personal information.
16. How to exercise your privacy rights
You may submit a privacy request, including a request to access, review, correct or delete information, by emailing [email protected] or by writing to:
Oleh Artemovych Savytskyi, individual entrepreneur (FOP)digital(R)evolution
103 Sichovykh Striltsiv Street, Apt. 25
Kyiv, 04050
Ukraine
Please describe the right you wish to exercise and provide enough information for us to locate the relevant records. We may request information reasonably necessary to verify your identity and prevent unauthorised access or deletion. We do not require excessive identity information where a less intrusive verification method is sufficient.
Where required by applicable law, privacy requests are handled free of charge, subject to statutory exceptions for manifestly unfounded, excessive, repetitive or otherwise qualifying requests.
If applicable U.S. state law gives you a right to appeal our decision on a privacy request, you may submit an appeal to the same email address and clearly identify the message as a “Privacy Request Appeal.”
17. Changes to this Policy
We may update this Policy to reflect changes in law, technology, service providers or our processing practices. The current version is posted on this page with its “Last updated” date.
If a material change affects privacy rights or materially changes how previously collected personal information will be used, we will provide additional notice through the Site or another appropriate channel and obtain any new consent required by applicable law before the new processing takes effect.
Silence, inactivity or continued browsing is not treated as blanket consent to new processing where applicable law requires an affirmative consent.
18. Key legal framework
Depending on the individual and the processing activity, this Policy is designed to provide transparency relevant to:
- the Law of Ukraine “On Personal Data Protection” ;
- Regulation (EU) 2016/679 — the General Data Protection Regulation (GDPR) , where applicable;
- national laws implementing Directive 2002/58/EC (ePrivacy Directive) , where applicable;
- the California Online Privacy Protection Act (CalOPPA);
- the California Consumer Privacy Act (CCPA) , if its applicability requirements are met;
- other applicable U.S. state comprehensive privacy laws where their scope requirements are met;
- the CAN-SPAM Act for covered U.S. commercial email.