Privacy policy

Mukharevych Studio ("we", "the studio", "Mukharevych") processes personal data of customers and website visitors to the extent necessary to deliver website development, ads setup and project support services. This page describes exactly which data we receive, why we use it and what rights you have as a data subject.

The studio operates from Spain (Costa del Sol) and serves projects within the EU. We comply with Regulation (EU) 2016/679 (GDPR) and the Spanish organic law LOPDGDD, so this page covers both regimes.

The controller of your personal data is Mukharevych Studio — a sole proprietorship / author-led project with place of business in Spain. For any question related to data processing, write to the controller's email.

Controller contact: hello@mukharevych.com. If a request requires identification (for example, data deletion), we'll ask you to confirm that you are the data subject using standard methods: a reply to the email from the same address the original request came from.

Contact form on the site and WhatsApp / Telegram — name, email, optionally a phone number or Telegram handle, and a brief description of the task. You provide these data yourself, voluntarily, so that we can respond to your request and prepare a proposal.

Visit analytics — anonymised, aggregated visit data: country, device type, traffic source, pages visited. Used only to improve site content and never shared with third parties in an individually identifiable form.

Server logs — IP address, user agent and request time. Held on the hosting provider's side in the standard way for security and incident diagnostics. We do not use these data for profiling.

Responding to your request and preparing a proposal — legal basis: Art. 6(1)(b) GDPR (pre-contractual steps). Without these data we cannot reply to you.

Improving the site and its content — legal basis: Art. 6(1)(a) GDPR (consent). Analytics cookies are not activated without explicit consent — the banner will appear on your first visit with two options ("Accept all" / "Essential only").

Site security and incident investigation — legal basis: Art. 6(1)(f) GDPR (legitimate interest). Server logs are processed only when there is an incident.

Marketing communications (if you have subscribed) — legal basis: Art. 6(1)(a) GDPR (consent). You can unsubscribe with one click from any email.

Cookies are small text files that the site stores in your browser. We currently use only essential technical cookies (session, anti-spam on the contact form). Analytics cookies are not activated without your explicit consent.

The cookies banner appears on your first visit and offers two options: "Accept all" (enables analytics) or "Essential only" (no analytics). Your choice is saved in the browser for 12 months — after that the banner will ask again. Until you decide, analytics on the site are disabled.

You can manage cookies at any time: open the "Privacy policy" page again, or clear the site's data in your browser settings. Clearing cookies does not affect your ability to use the site — only the personalisation of repeat visits.

Google Analytics 4 — if you accept analytics cookies, anonymised visit data is transferred to Google Ireland Ltd. under Standard Contractual Clauses. More at policies.google.com.

Site hosting provider — data is stored in the EU on our hosting infrastructure. Access to server logs is limited to us and the provider's technical support under a confidentiality agreement.

Messengers (WhatsApp, Telegram) — if you write to us on WhatsApp or Telegram, the conversation is processed by the corresponding platform. The content of messages is not saved outside the chat and is not passed on.

We never sell or rent personal data under any circumstances.

Contact-form requests — 24 months from the last contact, then deleted. If more time passed between the request and signing a contract, we keep it within the contractual relationship.

Messenger conversations — the period depends on the platform; for us — until project close + 5 years per Spanish commercial-accounting requirements.

Analytics data — 14 months under our Google Analytics setup, then automatically deleted or aggregated.

Server logs — up to 30 days for incident diagnostics, then rotated.

Under GDPR you have the right: to obtain confirmation of processing and a copy of the data (Art. 15), to correct inaccuracies (Art. 16), to delete data (Art. 17), to restrict processing (Art. 18), to receive data in a machine-readable format (Art. 20) and to object to processing (Art. 21).

To exercise any of these rights, write to the controller's email. We will respond within 30 days; if the request is complex, the period may be extended to 90 days with notice.

If you believe we have processed your data in violation of the law, you have the right to file a complaint with the supervisory authority. In Spain this is the Agencia Española de Protección de Datos (AEPD, aepd.es).

If we change the categories of data we process, add new processors or materially extend retention periods, we will update the date at the top of this page and briefly describe the change below in "Change history".

Material changes affecting previously collected data will be communicated directly by email to active customers and subscribers at least 30 days before the changes take effect.