Privacy
policy

1.1.Personal data controller (володілець): individual entrepreneur (sole proprietor, FOP) [FOP full name], taxpayer identification number (RNOKPP) [RNOKPP], address: [registered address], brand spacebar (hereinafter “we”).

1.2.Contacts for personal data matters: email hello@spacebar-tech.com (subject line “Personal data”), Telegram [@handle], phone [phone].

1.3.Data protection matters are handled personally by [FOP full name]. We are not required to appoint a separate person responsible for data protection or to notify the Ukrainian Parliament Commissioner for Human Rights, because we do not process data whose processing poses a particular risk (Art. 9 and Art. 24(2) of the Law of Ukraine “On Personal Data Protection” No. 2297-VI).

1.4.For visitors from the EU / EEA. We are based in Ukraine and have no establishment in the EU. The GDPR may apply to us when we offer services to individuals in the EU (Art. 3(2) GDPR). [EU representative under Art. 27 GDPR: not appointed, in view of Art. 27(2) GDPR / or: name, address.]

2.1.This Policy covers data that we process:

• when you visit the website https://spacebar-tech.com;
• when you fill in the brief on the website;
• when you message us on Telegram, Instagram Direct or by email, or call us;
• when you use our demo bot [@spacebar_demo_bot] (if it is running);
• when you or your company are our client.

2.2.This Policy does not cover data of users of the websites, bots and apps that we build for clients. Our client is the controller of that data, and we act as a processor on the client’s instructions. For such data, please read the privacy policy of the product concerned.

2.3.Telegram, Instagram, Google and other platforms also process your data under their own rules. For example, when you message us on Telegram, Telegram processes the correspondence as a separate controller.

We do not ask for, and ask you not to send us, data concerning health, religious or political beliefs, biometric data, payment card numbers or passwords to personal accounts. If such data reaches us by accident, we delete it.

Legal bases under Ukrainian law are given according to Art. 11(1) of Law No. 2297-VI, and under the GDPR according to Art. 6(1) GDPR.

4.1.We do not make decisions that have legal consequences for you solely by automated means (item 13 of Art. 8(2) of Law No. 2297-VI; Art. 22 GDPR).

4.2.Note for visitors from the EU. Obligations under Ukrainian law are not a “legal obligation” within the meaning of Art. 6(1)(c) GDPR, so for record-keeping purposes we rely on legitimate interest. You may object to processing based on legitimate interest (section 9). Data that we are required by law to keep will not be deleted as a result, but we will restrict its use to record-keeping purposes only.

4.3.Do you have to provide data? You are not obliged to provide data. Without a contact, we cannot reply to your brief. Without your details, we cannot enter into a contract or issue an invoice.

5.1.Cookies are small files that a website stores in your browser. We use two categories:

• Necessary. Without them, the website does not work or cannot remember your cookie choice. They do not require consent and cannot be switched off in the banner.
• Analytics. Google Analytics 4 counts visits and shows which pages are useful. Switched on only with consent.

5.2.The analytics script is not loaded until you consent. The website uses no advertising or marketing cookies. For Google, we use Consent Mode v2 in basic mode: all parameters (analytics_storage, ad_storage, ad_user_data, ad_personalization) are set to denied by default.

5.3.List of cookies (to be checked against the actual implementation before publication):

5.4.How to change or withdraw consent. Click “Cookie settings” in the website footer and switch off analytics. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal (Art. 7(3) GDPR; item 11 of Art. 8(2) of Law No. 2297-VI). You can also:

• delete or block cookies in your browser settings;
• install the Google Analytics opt-out browser add-on.

5.5.We ask for consent again after 6 months, and whenever the list of tools changes significantly.

5.6.Google Analytics settings: data retention [2 months], Google Signals disabled, data sharing for ad personalisation disabled.

6.1.Processors (process data on our behalf):

6.2.Other recipients (independent controllers):

6.3.We do not sell personal data and do not share it with third parties for their own marketing.

6.4.Where Art. 21 of Law No. 2297-VI requires it, we notify you of the transfer of your data to a third party within 10 business days. This Policy already contains information about our regular recipients (Art. 12(2) of Law No. 2297-VI).

7.1.Some of our processors and recipients are located outside Ukraine and outside the European Economic Area, in particular in the USA and the UAE.

7.2.Under Ukrainian law, EEA states and states that have signed Council of Europe Convention No. 108 are deemed to provide an adequate level of protection (Art. 29(3) of Law No. 2297-VI). For other states, including the USA, we rely on Art. 29(4) of that Law:

• for analytics — on your unambiguous consent, which you give in the cookie banner (item 1 of Part 4);
• for hosting, email and notifications — on the need to enter into or perform a transaction in your favour (item 2 of Part 4) and on the processors’ contractual data protection guarantees (item 6 of Part 4).

7.3.Under the GDPR (for visitors from the EU), transfers to the USA take place on the basis of the European Commission’s adequacy decision on the EU–US Data Privacy Framework (for certified companies: Vercel, Google, Meta) and/or EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Telegram is not DPF-certified. Therefore, in the notification to the founder via Telegram we send only the minimum needed to reply [to confirm: name and contact, or only the enquiry number], and keep the full text of the brief [in Google Workspace / other storage].

7.4.You can obtain a copy of the information on the safeguards by writing to us (section 1).

When the retention period expires, we delete or anonymise the data (Art. 6(8) and Art. 15 of Law No. 2297-VI).

9.1.Under Art. 8 of the Law of Ukraine “On Personal Data Protection”, you have the right:

1. to know the sources of collection and the location of your data, the purpose of processing, and the location of the controller or processor;
2. to receive information on the conditions of access to the data, in particular on the third parties to whom the data is transferred;
3. to access your data;
4. to receive, no later than 30 calendar days from the date of the request, a reply as to whether your data is being processed, and to receive its contents;
5. to submit a reasoned objection to the processing;
6. to submit a reasoned request to change or destroy data that is processed unlawfully or is inaccurate;
7. to protection of your data against unlawful processing, accidental loss, destruction or damage, and against the provision of false information that discredits your honour and dignity;
8. to lodge complaints with the Ukrainian Parliament Commissioner for Human Rights or with a court;
9. to apply legal remedies if data protection legislation is violated;
10. to make reservations restricting the right to process your data when giving consent;
11. to withdraw consent to processing;
12. to know the mechanism of automated data processing;
13. to protection against an automated decision that has legal consequences for you.

9.2.Under the GDPR (where it applies), you also have the right to: access (Art. 15); rectification (Art. 16); erasure, the “right to be forgotten” (Art. 17); restriction of processing (Art. 18); data portability in a machine-readable format (Art. 20); object to processing based on legitimate interest and to direct marketing (Art. 21); not be subject to decisions based solely on automated processing (Art. 22); withdraw consent at any time (Art. 7(3)).

9.3.How to exercise your rights. Write to hello@spacebar-tech.com with the subject “Personal data”, or on Telegram to [@handle]. We may ask you to confirm your identity — for example, by writing from the same account or email address you used to contact us. We reply free of charge within 30 calendar days. Where the GDPR applies and the request is complex, this period may be extended by a further 2 months, with the reasons explained (Art. 12(3) GDPR).

10.1.Ukraine: the Ukrainian Parliament Commissioner for Human Rights. Address: [21/8 Instytutska St., Kyiv, 01008], hotline [0 800 50 17 20], email [hotline@ombudsman.gov.ua], website ombudsman.gov.ua. (Verify the contacts before publication.)

10.2.EU / EEA: the data protection supervisory authority in the state where you live or work, or where the alleged infringement took place (Art. 77 GDPR). List of authorities: edpb.europa.eu.

10.3.We would appreciate it if you wrote to us first. Most issues can be resolved quickly.

• the website works only over HTTPS (TLS);
• all work accounts are protected with two-factor authentication;
• passwords and keys are stored in a password manager and in environment variables, not in code or correspondence;
• only the founder has access to the data and, to the minimum extent necessary, subcontractors on a specific project;
• work devices use disk encryption and screen lock;
• when the work is finished, we hand client access credentials back over a secure channel and delete them on our side;
• the brief form is protected against spam and does not accept files [to confirm].

If an incident occurs that poses a risk to your rights, we will notify you without undue delay and, in the cases provided for in Art. 33–34 GDPR, the competent supervisory authority as well.

Our services are intended for businesses and adults. We do not knowingly collect data from persons under the age of 16. If you believe that a child has sent us their data, write to us and we will delete it.

We update this Policy when our tools or the law change. The new version is published on this page with its date. We announce significant changes (new purposes, new categories of data, new recipients) with a banner on the website and, where necessary, ask for your consent again.

FOP [FOP full name] (spacebar) · [registered address] · hello@spacebar-tech.com · Telegram [@handle] · [phone]

Version No. 1 of [date]. Previous versions: [link to archive].