Privacy Policy

Controller

Roman Derkach is the data controller for this website. Contact: roman.derkach.business@gmail.com.

Data we collect

• Name, WhatsApp number, email
• UTM parameters (source/medium/campaign) from the link you arrived via
• IP address (used only for rate limiting and routing)
• Consent timestamp

You may submit this information through this website, Instagram, Facebook, or other platforms where Roman operates. We do not sell your personal information to third parties.

Purpose & legal basis

• Respond to your application — consent (GDPR Art 6(1)(a)), given when you submit the form.
• Conversion measurement via Meta — legitimate interest (GDPR Art 6(1)(f)) to measure the effectiveness of advertising. Identifiers sent to Meta are SHA-256-hashed. You may object to this processing at any time by emailing the address above.

Retention

Lead data is retained for up to 12 months, then deleted. You may request earlier deletion at any time. Telegram chat messages are retained per Roman's own chat settings; deletion from Telegram is manual on request.

Third-party processors

• Vercel — website hosting
• Telegram — message delivery for your application
• Meta Platforms Ireland Ltd. — conversion measurement (Meta Pixel and Conversions API). The Pixel loads from Meta's servers and sets the _fbp and _fbc cookies. The Conversions API sends hashed (SHA-256) identifiers (name, email, phone) and conversion events server-side. Meta's use of this data is governed by Meta's Data Policy.

Fonts are self-hosted on this domain. The only external requests are to Meta for conversion measurement, as disclosed above.

Third-country data transfer

Your application is delivered to Roman via the Telegram Bot API, whose servers are operated by Telegram (registered in the British Virgin Islands) with delivery routes that may include the United States. This constitutes a transfer of personal data to a third country outside the EU/EEA not subject to an adequacy decision. Legal basis: your explicit consent (GDPR Art 49(1)(a)), given when you submit the application form, and necessary for performing your request to be contacted (GDPR Art 6(1)(b)). You may withdraw consent and request deletion at any time by emailing the address above; withdrawal does not affect processing already carried out.

AI disclosure

By default, a human (Roman) reads and responds to every application. No AI automated responder is used. If an AI assistant is introduced to handle applications, this policy will be updated to disclose it, in line with EU AI Act Article 50.

Your rights

• Access, rectification, erasure, portability, objection
• Withdraw consent at any time
• Ask Roman to stop contacting you at any time — email the address above and your request will be honored
• Lodge a complaint with Datatilsynet (Norwegian Data Protection Authority)

Cookies & consent

This site uses the Meta Pixel for conversion measurement, which sets the _fbp and _fbc cookies. The Conversions API sends hashed identifiers server-side and does not set cookies. These only load after you accept marketing on the consent banner shown on first visit. If you decline, the Pixel does not run and no conversion data is sent to Meta. Your choice is stored locally in your browser (the rd_marketing_consent entry) and can be changed by clearing site data in your browser settings. UTM parameters are held in your browser session only and are not stored long-term. To manage or delete these cookies, use your browser's cookie controls.

Last updated: 2026-08-20.