Privacy Policy

1Who is responsible

This site is operated by Serhii Skrypnyk, a sole trader registered in Ukraine as an individual entrepreneur, working remotely and worldwide. For anything on this page, write to serhii@solutions4sf.com.

Where this site processes your data for its own purposes, the controller is Serhii Skrypnyk. Where personal data is processed on behalf of a client during an engagement, the client is the controller and the role is set out in the Data Processing Addendum.

2What is collected, and when

2.1 What you send deliberately

The contact form on this site creates a record in Salesforce. It carries what you typed:

• Your name
• Your email address
• Your company, if you fill that field in
• Your message
• Which page you sent it from, and any estimate or symptoms you had produced on that page

Three other actions also create or update a record in Salesforce:

• Acting on an estimate. Copying, printing, saving or mailing an estimate, opening its deposit tab, or generating its invoice records that estimate under the reference printed on it: the tool, the figure, the lines and phases it was built from, your answers to the estimator, the page it was made on, and the campaign in the page address if there was one. This is what lets a message quoting the reference be answered.
• An address typed into Email it. It is kept with the estimate, a copy of the estimate is emailed to it, and a lead record is created for it. If you type a colleague's address, tell them.
• Asking for the readiness breakdown. The verdict, how many measures failed and the exposure figure are sent with the address you give. The export files you load never leave the browser tab; only those results do.

Using an estimator or the readiness check without doing any of these sends nothing.

2.2 A random identifier, set whatever you answer

The first time you open a page, your browser stores one entry in local storage named s4-visitor. It holds a random string, the date of your first visit, how many visits you have made, the seconds a tab of this site was actually in view, and how many estimator configurations you tried. It is not derived from your device, your IP address or anything else about you, and nothing reads it until you act on an estimate or ask for a readiness breakdown. Then it travels with that record, together with your browser's time zone and its local day and time, so that several estimates from one person read as one person coming back rather than as several strangers.

It is set whether or not you allow analytics. That is a deliberate choice, and this paragraph is its price. To remove it, clear this site's data in your browser; you then arrive as a new visitor.

2.3 What is collected only if you allow it

Analytics is off until you choose to turn it on, and refusing costs you nothing: every page, every estimator, the readiness check and the contact form work either way. If you do allow it, three things start:

• Google Analytics 4 records pages viewed, approximate location from a truncated IP address, device and browser, and which tools you used. IP anonymisation is on.
• Salesforce Account Engagement sets a visitor cookie so repeat visits can be recognised.
• A visit history in your own browser, held in local storage: when you first arrived, which page you landed on, the referring site and any campaign parameters, how many visits, which pages you have seen, which tools you used and what those produced.

This is profiling, and it is described plainly because it is. If you then send the contact form, that visit history is attached to your message so a first reply can start from what you actually did rather than from a blank page. If you have not allowed analytics, there is no history to attach and none is sent.

You can change your mind at any time on this page. Switching to essential only stops new collection and clears the visit history held in your browser. If your browser sends Global Privacy Control or Do Not Track, that is treated as a refusal and you are never asked.

2.4 Cookies

With analytics refused, this site sets no cookies at all. It stores two entries in local storage: your choice, which is what stops it asking again, and the identifier described in 2.2.

With analytics allowed, Google Analytics and Account Engagement each set their own cookies, and the visit history above is written to local storage.

3The legal basis for each of these

• Consent, Article 6(1)(a). Analytics, the Account Engagement tracker and the visit history. Withdrawable here at any time, with no effect on what happened before you withdrew.
• Steps before a contract, Article 6(1)(b). Replying to your enquiry and preparing a proposal.
• Legitimate interest, Article 6(1)(f). Keeping correspondence readable, preventing abuse of the form, recording an estimate you act on so a message quoting its reference can be answered, and the identifier in 2.2 that links your own estimates. You can object at any time, as section 7 describes.

4What your data is used for

• Replying to what you wrote, and preparing a scope or estimate if you asked for one
• Sending service information you actively requested
• Understanding which pages are useful, if you allowed analytics
• Detecting abuse of the contact form

It is never used for any of the following:

• Sold or rented to anyone
• Sent to advertising networks or used for cross-context behavioural advertising
• Used to train an artificial intelligence model
• Used for automated decisions that produce a legal or similarly significant effect on you
• Used to send marketing you did not ask for

5Who else touches it

These are the only third parties involved, each under a written agreement that limits them to the purpose listed:

Some of these are based in the United States. Transfers rely on the EU-US Data Privacy Framework where the provider is certified, and on Standard Contractual Clauses adopted by the European Commission otherwise, with encryption in transit and at rest as a supplementary measure.

If this list changes, this page changes with it, and clients with an active engagement are told at least thirty days beforehand and may object on data protection grounds. The same commitment is written into the Data Processing Addendum.

6How long any of it is kept

• Contact form, estimate and readiness records in Salesforce: three years from the last contact or action, then deleted, unless you become a client.
• The identifier in your browser: until you clear this site's data.
• Email correspondence: three years from the last message.
• Analytics: fourteen months, then aggregated beyond recovery.
• Visit history in your browser: until you clear it, refuse analytics, or clear your browser storage. It never leaves your device unless you send the contact form.
• Client engagement records: the length of the contract plus seven years, which is a tax and professional liability requirement rather than a choice.

7Your rights, and how to use them

If you are in the EU, the UK, or a jurisdiction with equivalent law, you can ask for any of the following:

• Access. A copy of everything held about you.
• Rectification. Correction of anything inaccurate.
• Erasure. Deletion, where there is no overriding legal reason to keep it.
• Restriction. A pause on processing while something is disputed.
• Portability. Your data in a machine readable file.
• Objection. To anything relying on legitimate interest.
• Withdrawal of consent. Immediately, on this page, without writing to anyone.

For all except the last, email serhii@solutions4sf.com with "GDPR request" in the subject. The answer comes within thirty days. If it does not satisfy you, you may complain to the data protection authority where you live.

California residents have a separate set of rights, set out in the California Privacy Notice.

8How it is protected

• HTTPS on every page, with modern transport security
• Two factor authentication on every account that can reach personal data
• Encrypted disks, a password manager, and no client work over public wireless networks
• Access limited to one person, because there is only one person

If a breach affects your personal data, you will be told within seventy two hours, as GDPR requires.

9Children

This is a business to business service. Data is not knowingly collected from anyone under eighteen. If any is found, it is deleted.

10Changes to this policy

The date at the top of this page changes whenever the policy does. Where a change is material and you have an active engagement, you will be told directly rather than left to notice.

11Contact

Serhii Skrypnyk, Senior Salesforce Administrator and developer. Email serhii@solutions4sf.com. Also on LinkedIn and Trailblazer.