01 / 11
Who is responsible for processing
The controller of personal data is sole proprietor (FOP) Mykhailo Blyshchyk, operating as Express Agency. The recipient of inquiries and the contact for data questions: mykhailo@express.agency. This policy applies to the Express Agency website, its request form and correspondence related to inquiries.
02 / 11
What data we receive
In the form, you provide your name, email, the service you chose and a description of your task. Company and website address are optional fields. If you contact us by phone, email, Telegram or WhatsApp, we receive the contact details and the content of the correspondence that you send by that method. Do not send passwords, access keys, payment card details or your customers' personal data through the general form.
03 / 11
Purpose and legal basis
We use the data to respond to your request, clarify the task, prepare a proposal and, if you place an order, fulfil our agreements. The basis is steps taken at your request before a contract is concluded, and performance of the contract. We keep certain information to comply with legal requirements and to protect legitimate interests when handling claims. Where consent is required, we request it separately. Sending an inquiry does not sign you up for marketing emails.
04 / 11
How a request is handled
The site is hosted on Vercel. The form passes the completed fields to a server-side handler; Google Workspace delivers the email to the recipient's working mailbox, mykhailo@express.agency. Access to an inquiry is given to people who need it to respond and carry out the task. The handler does not write the request content to regular application logs and does not send it to Google Analytics.
05 / 11
Technical data and spam protection
Vercel and other infrastructure services process technical information about requests, including network address, time, requested URL and browser details. To limit submission frequency, the server creates a protected derivative of the IP address (HMAC): the server instance's memory keeps a counter for up to 15 minutes, and a submission identifier, a content HMAC and a status for up to 24 hours or until restart. The request text is not stored in this storage. Duplicate protection works only within a single instance.
06 / 11
Google Analytics and cookies
We use Google Analytics to understand which pages are visited, where visitors come from and how they interact with the site. The service processes information about pages and events, referral source, device and browser, as well as cookie identifiers. Your name, email and request content are not intended to be sent to analytics. You can restrict or delete cookies with your browser tools and use Google's opt-out extension to disable Analytics. Analytics loads only after you give consent. You can change your choice or withdraw consent via “Cookie settings” at the bottom of the page. Your choice is stored in the browser; submitting a request does not replace consent to analytics.
07 / 11
Third-party services and transfers abroad
The site's operation involves Vercel (hosting), Google Workspace (email delivery), Google Analytics and the recipient's email service. These providers may process data outside Ukraine, including in the USA. Processing terms, infrastructure location, logs and backups are also governed by the providers' agreements and policies. If you move to Telegram or WhatsApp, processing in those services is governed by their own terms. We do not sell inquiry data.
08 / 11
How long we keep data
We keep inquiries and correspondence for as long as needed to discuss and carry out an order, confirm agreements, handle claims and meet legal requirements. Inquiries without an order are kept while they are needed for an ongoing discussion or to prepare a proposal; once that need is gone, they are to be deleted unless there is another basis for keeping them. For order and dispute materials, the period is determined by the relevant obligations. There is no single rule that all correspondence is deleted after six months.
09 / 11
Copies held by providers
Deleting an email from the working mailbox does not automatically delete copies held by the email provider and delivery services. Retention periods for email, logs and backups depend on Google Workspace settings and terms. The retention period for analytics data depends on the Google Analytics property settings. We consider deletion requests in light of the providers' available mechanisms and mandatory retention periods.
10 / 11
Your rights and requests
You can request information about how your data is processed, access to it, correction of inaccuracies, restriction or cessation of processing, and deletion where there are grounds. If processing is based on consent, you can withdraw it. To make a request, write to mykhailo@express.agency and tell us how to find your inquiry. If necessary, we'll ask for details to confirm your identity. If some data must be kept, we'll explain why. You may also contact the Ukrainian Parliament Commissioner for Human Rights or go to court.
11 / 11
Policy changes
The current version is published on this page. If the purposes of processing or the services we use change, we update the description. Revision date: October 11, 2026.