PRIVACY POLICY
Privacy Policy
VERSION OF 10 NOVEMBER 2026
1. General provisions
1.1. This Privacy Policy (the “Policy”) sets out how personal data of users of the website vetrinskaya.com (the “Website”) is processed. It has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the “GDPR”) and the laws of the Netherlands (Uitvoeringswet AVG).
1.2. For the purposes of this Policy:
- “Controller” means the entity specified in Section 2, which determines the purposes and means of the processing of personal data (Art. 4(7) GDPR);
- “User” means any natural person who visits the Website, submits the brief form or otherwise contacts the Controller;
- “Personal Data” means any information relating to an identified or identifiable natural person (Art. 4(1) GDPR);
- “Processor” means a person that processes Personal Data on behalf of the Controller (Art. 4(8) GDPR).
1.3. This Policy forms part of the information provided to data subjects pursuant to Art. 13 GDPR.
2. Controller
2.1. Controller: DO Advisory (eenmanszaak), Amsterdam, the Netherlands; Netherlands Chamber of Commerce (KvK) number 42014974; VAT (BTW) number NL005433826B32. Postal address available on request.
2.2. Contact for data protection matters: [email protected].
2.3. The Controller has not appointed a Data Protection Officer, as it does not meet the criteria of Art. 37 GDPR.
3. Categories of Personal Data
3.1. The Controller processes the following categories of Personal Data:
- data provided by the User in the brief form: name, company name, role, contact details (email address, Telegram username or phone number) and project information;
- data provided by the User in correspondence by email or via Telegram;
- technical data: IP address, browser information, date and time of request, processed by the hosting provider to deliver the Website and ensure its security;
- anonymised statistics on visits to the Website and actions on it (page views, link clicks, starting and submitting the brief), collected by Cloudflare Web Analytics and Umami without cookies, without building a profile of the User and without tracking the User across other websites.
3.2. The Website does not use cookies, advertising pixels or similar tracking technologies. The Controller does not request or process special categories of Personal Data (Art. 9 GDPR).
4. Purposes and legal bases
4.1. The Controller processes Personal Data for the following purposes and on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Reviewing the User's brief or enquiry, preparing for discussions and discussing a possible engagement | Steps taken at the request of the data subject prior to entering into a contract (Art. 6(1)(b) GDPR) |
| Concluding and performing a contract | Performance of a contract (Art. 6(1)(b) GDPR) |
| Operating and securing the Website, preventing spam and abuse | Legitimate interest of the Controller (Art. 6(1)(f) GDPR) |
| Collecting anonymised visit statistics | Legitimate interest of the Controller (Art. 6(1)(f) GDPR) |
| Retaining records for accounting and tax purposes | Compliance with a legal obligation (Art. 6(1)(c) GDPR) |
4.2. Provision of Personal Data is voluntary. Without contact details, the Controller is unable to respond to the User's enquiry.
4.3. The Controller does not carry out automated decision-making, including profiling (Art. 22 GDPR).
5. Recipients
5.1. Personal Data is accessible to the Controller and, where a contract is concluded, to persons engaged by the Controller to perform it who are bound by confidentiality obligations.
5.2. The Controller uses the following processors and service providers:
| Recipient | Function | Location of processing |
|---|---|---|
| Cloudflare, Inc. | Website hosting, form handling, security, visit statistics, email forwarding | EU, USA |
| Plus Five Five, Inc. (Resend) | Delivering a copy of the brief to the Controller's email address | USA |
| Google LLC (Gmail) | Storage of email correspondence | EU, USA |
| Umami Software, Inc. (Umami Cloud) | Anonymised statistics on visits and actions on the Website | EU |
| Telegram | Notifying the Controller of a new brief; messenger correspondence | Outside the EEA |
5.3. The Controller does not sell Personal Data or disclose it to third parties for advertising or marketing purposes.
5.4. Call scheduling is provided by Calendly, which acts as an independent controller and processes data in accordance with its own privacy policy.
6. International transfers
6.1. Certain recipients process Personal Data outside the European Economic Area (EEA).
6.2. Transfers to the United States are based on the European Commission's adequacy decision under the EU-U.S. Data Privacy Framework (Art. 45 GDPR) for certified recipients, or on Standard Contractual Clauses adopted by the European Commission (Art. 46(2)(c) GDPR).
6.3. The brief notification sent via Telegram is transferred because it is necessary for the implementation of pre-contractual measures taken at the data subject's request (Art. 49(1)(b) GDPR).
7. Retention
7.1. Personal Data is retained no longer than necessary for the purposes of processing:
- brief and correspondence data where no contract is concluded: no longer than twelve (12) months from the last contact, after which it is deleted;
- contract-related data: for the term of the contract and thereafter for the period required by Dutch accounting and tax law (Art. 52 Algemene wet inzake rijksbelastingen; generally seven (7) years);
- technical logs and statistics: for the periods set by Cloudflare, Inc.
8. Rights of the data subject
8.1. Under the GDPR, the User has the right to:
- obtain confirmation of processing, access to their Personal Data and a copy thereof (Art. 15);
- rectification of inaccurate data (Art. 16);
- erasure of Personal Data (Art. 17);
- restriction of processing (Art. 18);
- receive their data in a structured, machine-readable format and transmit it to another controller (Art. 20);
- object to processing based on the Controller's legitimate interest (Art. 21).
8.2. Requests should be sent to [email protected]. The Controller will respond without undue delay and in any event within one month of receipt (Art. 12(3) GDPR). The Controller may request additional information to verify the requester's identity.
8.3. The User has the right to lodge a complaint with the supervisory authority, the Autoriteit Persoonsgegevens (the Netherlands), autoriteitpersoonsgegevens.nl, or with the supervisory authority of the EU Member State of their habitual residence or place of work.
9. Security
9.1. The Controller implements appropriate technical and organisational measures to protect Personal Data (Art. 32 GDPR), including: transmission exclusively over HTTPS; limiting the data accepted by the form; two-factor authentication of accounts; and restricting access to authorised persons only.
10. Final provisions
10.1. The Website is not intended for persons under the age of 16. The Controller does not knowingly process their Personal Data.
10.2. The Controller may amend this Policy. The amended version takes effect upon publication on the Website; the version date is stated at the top of the document.