Privacy policy

1. Controller

Kiril Karatitsyn Am Kuckuck 6 48455 Bad Bentheim, Germany Email: kiril@karatitsyn.com

2. Hosting

This website is hosted by Vercel Inc., USA. Each time a page is requested, Vercel automatically processes data your browser sends: IP address, date and time, the page requested, referrer URL, browser and operating system. This is needed to deliver the website and protect it against abuse.

The legal basis is Art. 6(1)(f) GDPR, my legitimate interest in a secure, working website. Vercel processes the data on my behalf. Vercel is certified under the EU-U.S. Data Privacy Framework, which is the basis for the transfer to the USA (Art. 45 GDPR). Vercel keeps these logs for this project for at most one day. Details: https://vercel.com/legal/privacy-policy

3. Contact by email and contact form

If you email me, I process what you send (name, email address, message) to answer your enquiry. My mailbox is hosted by Microsoft 365; Microsoft processes the messages on my behalf. Where data goes to the USA, the transfer relies on the EU-U.S. Data Privacy Framework, under which Microsoft Corporation is certified (Art. 45 GDPR). This also applies to the contact form and the free store check: the website sends what you enter in the form (email address, store address, message, optionally your name and how you found me, plus the page you write from) to me as an email through the service Resend (Resend, Inc., USA); nothing is stored on the website itself. Resend processes the data on my behalf and is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). For the store check I also look at the store whose address you give me. The legal basis is Art. 6(1)(b) GDPR where your enquiry aims at a contract, otherwise Art. 6(1)(f) GDPR. I delete the data once it is no longer needed, unless statutory retention periods apply.

4. Booking a call via Cal.com

You can book an introductory call through Cal.com (Cal.com, Inc., USA). The website loads the Cal.com booking window only when you click a booking button; at that point your IP address and device information are sent to Cal.com. When you book, Cal.com processes what you enter (name, email address, notes, chosen time).

The legal basis is Art. 6(1)(b) GDPR (steps prior to a contract). Cal.com is certified under the EU-U.S. Data Privacy Framework, which is the basis for the transfer to the USA (Art. 45 GDPR). In the booking window Cal.com sets cookies for the session and for abuse protection (Cloudflare) and keeps entries in local storage, for example for the time format and a held booking. These cookies and entries belong to Cal.com, not to this website. Details: https://cal.com/privacy

5. Fonts

The fonts are stored on this website’s own server. No connection to Google or other font providers is made when a page loads.

6. Cookies and analytics

This website sets no cookies of its own and uses no analytics or tracking tools.

7. Links to other websites

The website links to other services, such as Upwork, LinkedIn, GitHub and my clients’ shops. No data goes there until you click a link; from then on, that provider’s privacy policy applies.

8. Business emails to Shopify stores and agencies

I email Shopify stores and agencies in the USA, the United Kingdom and Australia to offer them my services as a Shopify developer: one email with the offer and at most one reminder.

For this I process the company’s name, the business email address the company has published itself, the name of the contact person if it appears on the company’s website, and the page where I found the address; as well as the dates of my emails and your reply if you answer. The source of this data is the company’s public website.

The legal basis is Art. 6(1)(f) GDPR, my legitimate interest in offering my services to businesses (direct marketing, Recital 47 GDPR). If you reply and are interested, section 3 applies.

If there is no reply, I delete the data no later than 12 months after the first email. If you object or are not interested, I keep only your email address and the domain on a “do not contact” list, so that I do not write to you again.

The contact list is kept in Notion (Notion Labs, Inc., USA) and I send the emails through Microsoft 365. Both process the data on my behalf. Where data goes to the USA, the transfer relies on the EU-U.S. Data Privacy Framework, under which Notion Labs, Inc. and Microsoft Corporation are certified (Art. 45 GDPR).

You can object to this processing at any time (Art. 21(2) GDPR): simply reply “no” to the email or write to kiril@karatitsyn.com. I will then not write to you again. Your rights of access, rectification and erasure and your right to complain are in the next section.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). To use them, write to kiril@karatitsyn.com.

You may also lodge a complaint with a data protection supervisory authority, for example the one responsible for me: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany, https://www.lfd.niedersachsen.de

Last updated: 15 October 2026