Privacy notice

Last updated: 13 October 2026

This notice explains how I handle personal data when I contact businesses about my services, when you write to me, and when you visit this website. It is written for the UK GDPR and the Privacy and Electronic Communications Regulations (PECR), and for the EU General Data Protection Regulation (GDPR).

1. Who is responsible for your data

The controller is Oleksandr Bratuta, a freelance developer working as an individual.

2. What data I use

For people I contact or who contact me in a business capacity, I use:

• your name and your job title or role;
• the name, website and public business information of your organisation;
• your business email address;
• our correspondence: the messages, their dates, and whether you replied or asked not to be contacted.

I do not collect private contact details, and I do not collect sensitive data (such as health, religion or political views).

3. Where the data comes from

I collect business contact data from public sources where it was published for business purposes: your organisation’s website, public business directories and public business registers. If you write to me first, the data comes from you. You do not have to give me any data, but I need your email address to reply.

4. Why I use it and on what legal basis

Purpose. I use the data to send you a short, relevant message about my services (AI chatbots, document assistants, automation and data collection), to follow up if you reply, and to keep a record of our correspondence and of any request not to be contacted.

Legal basis. I rely on legitimate interests: Article 6(1)(f) of the UK GDPR and of the EU GDPR. My interest is to find business customers for my services.

Balancing test, in short. I use only contact details that were published so that businesses can be contacted, and only about matters linked to your professional role. I keep the data to a minimum and do not combine it with other sources to build a profile of you. I do not sell it. Every message tells you how to opt out, and opting out takes one reply. I therefore consider that your interests and rights do not override my interest. You can still object at any time (see section 9).

If you write to me or we work together. I use your data to answer your request and to carry out the project with your organisation, on the basis of legitimate interests (Article 6(1)(f)). If you are personally my client, for example as a sole trader, the basis is the contract between us (Article 6(1)(b)). I keep invoices and accounting records because the law requires it (legal obligation, Article 6(1)(c)).

Rules on electronic marketing. These rules apply as well as data protection law:

• UK: under PECR, I send a first unsolicited email only to corporate subscribers, such as companies and limited liability partnerships. I do not send one without consent to sole traders or to partnerships other than Scottish partnerships and LLPs, because PECR treats them as individuals.
• European Union: some countries, including Italy (Article 130 of the Italian Privacy Code), require prior consent for marketing emails even when the address belongs to a business. I do not send unsolicited marketing emails where prior consent is required. In those countries I reply only when you contact me first or when you have agreed to be contacted.

5. How long I keep it

• No reply, or the conversation ends without a project: deleted no later than 12 months after our last contact.
• We work together: kept for as long as the project and our business relationship last. Invoices and accounting records are kept for 10 years, as Italian law requires (Article 2220 of the Civil Code).
• You ask not to be contacted: I keep only your email address, the date and a “do not contact” note, for as long as needed to respect your request.

6. Who receives the data

I do not sell or rent personal data or share it with others for their marketing. I use these service providers (processors):

I may also disclose data where the law requires it, for example to a public authority.

7. Transfers outside the UK and the EEA

Cloudflare may process data outside the UK and the European Economic Area. Its customer data processing addendum (version 6.4, effective 3 April 2026) covers such transfers in three ways: Cloudflare’s certification under the EU-U.S. Data Privacy Framework and its UK extension, the EU Standard Contractual Clauses, and the UK International Data Transfer Addendum.

Zoho stores my mailbox in its EU data centre. Zoho’s privacy policy says data may also be processed in other countries where the Zoho group operates.

You can ask me by email for more information about these safeguards and for a copy of them.

8. Visitors to this website

This website sets no cookies and uses no analytics, trackers or third-party scripts. When you open a page, your browser sends technical data to Cloudflare, which delivers and protects the site: your IP address, the page requested, the time and your browser type. Cloudflare uses this data to serve the page and to block attacks and abusive traffic. My legal basis is legitimate interests: keeping the website available and secure. I do not keep my own server logs for this site.

9. Your rights and how to opt out

You can ask me to:

• give you a copy of your data (access);
• correct it (rectification);
• delete it (erasure);
• limit how I use it (restriction);
• give you the data you provided in a machine-readable format, when I use it on the basis of a contract with you (portability).

You have the right to object. You can object at any time to the use of your data for direct marketing. When you do, I stop. You do not need to give a reason (Article 21 of the UK GDPR and of the EU GDPR).

How to opt out: reply “unsubscribe” to any of my emails, or write to oleksandr@bratuta.net. I will not contact you again. I keep only the minimum record described in section 5.

Exercising your rights is free. I reply within one month, as Article 12(3) requires. I do not make decisions about you based solely on automated processing.

10. Complaints

If you think I have mishandled your data, please write to me first so I can put it right. You also have the right to complain to a data protection authority:

• in Italy, where I am based: the Garante per la protezione dei dati personali, garanteprivacy.it;
• in the UK: the Information Commissioner’s Office (ICO), ico.org.uk/make-a-complaint;
• or the authority in the EU country where you live or work.

11. Changes

If this notice changes, I will update the date at the top of the page.