Privacy Policy
Last updated: 17 September 2026.
This Policy explains how personal data of visitors to snitynskyi.online, people submitting enquiries and clients of Taras Snitynskyi is processed. Services are provided through Whowhere.online s.r.o..
1. Controller and contact
Controller: Whowhere.online s.r.o., company ID 19638434, Tylova 749/38, Jižní Předměstí, 301 00 Plzeň, Czech Republic, data box j8q4g54. Privacy and data-rights contact: info@snitynskyi.online.
2. Data we receive
- name, company name, email and optional telephone number;
- website address, market, type of business, project description, budget, timeline and other information you voluntarily provide;
- data required for contracts, invoices, accounting and tax duties;
- technical data such as IP address, browser and device type, visited URLs, date and time, referral source and cookie identifiers as described in the Cookie Policy.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Responding to an enquiry, assessing a project and preparing an offer or audit | Steps requested before entering into a contract — Article 6(1)(b) GDPR |
| Entering into and performing a contract, project communication and support | Performance of a contract — Article 6(1)(b) GDPR |
| Invoices, accounting and tax records | Legal obligation — Article 6(1)(c) GDPR |
| Website security, abuse prevention and protection of legal claims | Legitimate interests in secure operation and legal protection — Article 6(1)(f) GDPR |
| Website statistics through Google Analytics 4 | Consent to the Statistics category — Article 6(1)(a) GDPR |
| Temporary storage of a UTM tag ID or AI source name before a form is submitted | Consent to the Statistics category — Article 6(1)(a) GDPR |
| Linking a campaign source or AI recommendation to a submitted enquiry and assessing channel effectiveness | Legitimate interests in improving services and measuring results — Article 6(1)(f) GDPR |
Contact details from enquiries are not used for promotional email campaigns without a separate legal basis.
4. Required fields
Required fields are necessary to identify and answer your enquiry. Without them, the form cannot be submitted or we cannot prepare a meaningful response. Other fields are voluntary.
5. Recipients and processors
- ACTIVE 24 / Websupport — hosting, server infrastructure and email;
- Google Ireland Limited — Google Analytics 4, only after Statistics consent;
- accountants, legal advisers, banks or payment services where necessary;
- trusted project contractors, limited to what is necessary and subject to confidentiality;
- public authorities where disclosure is required by law.
Enquiries are sent to the business email inbox and stored in a protected administration area of the website so they can be handled. Only an administrator has access. Requests blocked by the security system may be kept temporarily in a separate quarantine in a limited and truncated form; the raw IP address is not stored there. Personal data is not sold.
6. Transfers outside the EU/EEA
Google may process data outside the EU/EEA, including in the United States. Google states that it relies on the EU–US Data Privacy Framework and Standard Contractual Clauses where required. Other transfers are not made without an appropriate safeguard.
7. Retention
- enquiries, the attached UTM journey snapshot or AI source name and related correspondence — up to 24 months after the last substantive contact unless a contract or dispute follows;
- first touch, last touch and valid UTM-touch history in localStorage — up to 90 days from the first touch or until Statistics consent is withdrawn;
- the anonymous already-counted UTM marker or AI source name in sessionStorage — until the browser tab is closed or Statistics consent is withdrawn;
- blocked requests in quarantine — up to 14 days;
- contract, accounting and tax records — for statutory periods, generally 5 or 10 years depending on the document;
- GA4 user and event data — 14 months; aggregated reports may remain longer without a direct identifier;
- Complianz consent choice — up to 12 months;
- technical logs — for the provider-configured period necessary for security, and longer only for an incident or legal requirement.
8. Cookies and analytics
Google Analytics 4 and statistical cookies are activated only after consent. You can change your choice at any time through “Manage consent”. Details are in the Cookie Policy.
To evaluate tagged external links and AI recommendations, the website keeps an anonymous aggregated daily server-side count for saved UTM parameters or the name of a known AI service. A UTM visit is confirmed only after JavaScript runs and the tab remains visible for at least 3 seconds; known preview bots and crawlers are filtered. User-Agent data is checked transiently for this technical filter and is not retained. The counter does not retain IP addresses, the full referrer address or an individual visitor history.
Separately, and only after consent to the Statistics category, the website stores first touch, last touch and a limited history of valid UTM arrivals in localStorage for up to 90 days from the first touch. sessionStorage keeps only markers showing that a UTM has already been processed in the current tab. When a form is submitted, the server checks each touch ID, time, path and digital signature against its own allow-list and attaches the verified journey snapshot to the enquiry. Withdrawing Statistics consent clears these browser data. They are not sent to GA4 together with your name, email address, telephone number or enquiry text.
9. Your rights
You may request access, correction, erasure, restriction, portability, object to legitimate-interest processing and withdraw consent. Withdrawal does not affect earlier lawful processing. Contact info@snitynskyi.online.
You may also complain to the Czech supervisory authority: Úřad pro ochranu osobních údajů, uoou.gov.cz, Pplk. Sochora 27, 170 00 Praha 7.
10. Automated decisions
We do not make solely automated decisions producing legal or similarly significant effects and do not use form data for automated profiling.
11. Security and updates
We use access controls, encrypted connections, updates, backups and other proportionate technical and organisational measures. The current revision date is shown at the top of this page.