Privacy Notice

Last updated: 31 July 2026

1. Who is responsible

Oleh Levytskyi, an individual entrepreneur (ФОП) registered in Ukraine, practising as Levytskyi Legal. I decide why and how the data described below is processed, which makes me the controller under the GDPR and the "owner of personal data" under Ukraine's Law on Personal Data Protection.

For anything in this notice — questions, requests, complaints — write to oleh@levytskyilegal.com. I answer these myself.

2. What I collect, and why

If you download the AI Act checklist

Nothing. The checklist is a file you download directly — no form, no email, no data collected. You do not have to tell me anything to read it.

If you ask to be notified about changes

Below the checklist there is an optional form. If you use it, you give me your email address and, if you want, your company name. Neither field is required for anything else on this site, and the checklist is available whether you fill it in or not.

I use the address for exactly one thing: to write to you if the AI Act transparency rules change in a way that affects the checklist. Not a newsletter, not offers of my services, not anything else. My server also records the country Cloudflare derives from your IP address — the address itself is not stored — plus the time and which page the request came from.

Lawful basis: your consent, given for that specific purpose. You can withdraw it at any time by replying to any message or writing to the address below, and I will delete your entry.

If you do not provide it: nothing happens — you keep the checklist and simply do not hear from me.

If you book a call

Scheduling runs on Calendly. When you book, you provide your name, your email address, and answers to two questions about your product and what you need. I use this to prepare for the call and to follow up on it.

I do not record calls and I do not run them through transcription or AI analysis.

Lawful basis: steps taken at your request before entering into a contract; where you do not become a client, my legitimate interest in keeping a record of who I spoke to and about what.

If you email me or message me

Email is the main channel. If you prefer a messenger — LinkedIn, Telegram, WhatsApp — I can use it for quick questions, but documents and anything substantive go by email. When you choose a messenger, that provider processes the conversation under its own terms, which I do not control.

Lawful basis: pre-contractual steps or performance of a contract; otherwise my legitimate interest in responding to people who contact me.

If you become a client

I process what the work requires: your contact and billing details, the documents and facts of your matter, and correspondence. Your files may also contain personal data about other people — your staff, counterparties, users. Where that happens, you decide why those data exist and what is done with them; I handle them on your instructions as part of the service, which makes you the controller and me the processor for that material. Informing those people remains yours to do; keeping the material confidential is mine.

Lawful basis: performance of our contract; my legitimate interest in complying with the tax and accounting rules that apply to me in Ukraine, and in being able to defend a claim for as long as one can be brought.

When you simply visit the site

The hosting provider keeps technical logs, including IP addresses, for security and to keep the site running. I also use Cloudflare Web Analytics, which counts visits and referring pages in aggregate. It sets no cookies, builds no profile of you, and does not track you across other sites — it exists so I know whether the site works, not who you are.

Lawful basis: my legitimate interest in a secure site and in knowing whether it works.

3. How long I keep it

• Notification sign-ups — until you withdraw consent, and in any case no longer than 24 months from sign-up. The period matches the purpose: regulatory change is measured in years, not weeks.
• Enquiries and calls that do not become work — 6 months from our last contact.
• Client files — 3 years after the matter ends. The period is set by the general limitation period under Ukrainian law: after it runs out, keeping the file no longer serves the purpose it was kept for.
• Invoices and accounting records — as long as tax law requires, which is longer than the above and outside my discretion.
• Server logs — for the period set by Cloudflare in its own retention policy, measured in days rather than months. I do not extend it.

4. Who else is involved

I keep the number of providers deliberately small:

• Cloudflare — hosting, email routing, site analytics, and the optional sign-up form, which runs on my own code on Cloudflare's infrastructure rather than through a third-party form service. Their privacy policy.
• Google — the mailbox where my email arrives and from which I reply. Their privacy policy.
• Calendly — scheduling only. Their privacy policy.

These providers are based in, or transfer data to, the United States. Transfers rely on the mechanisms in each provider's data processing terms — the EU-U.S. Data Privacy Framework where the provider is certified, otherwise the European Commission's Standard Contractual Clauses. I chose providers on this basis, and I am happy to tell you where any specific one stands. Because I am established in Ukraine, Article 29 of the Ukrainian Law on Personal Data Protection applies to the same transfers in parallel; they rest on your consent or on the necessity of performing a contract in your interest, depending on which case above applies to you.

I do not sell data, do not run advertising, and do not share anything with third parties for their own purposes. I disclose data only where the law requires it.

5. Cookies and local storage

This site sets no cookies at all, so you will not see a cookie banner — there is nothing to consent to. Fonts are served from this domain rather than a font network. The only external component is the Cloudflare Web Analytics script described above, which is cookie-free and collects no identifiers.

One exception worth naming: the interactive GDPR self-check stores your own answers in your browser's local storage, so you can close the tab and come back to them. That data stays on your device and is never transmitted to me. Clearing your browser data removes it.

6. Your rights

Under the GDPR you can ask me for a copy of your data, ask me to correct or delete it, ask me to restrict how I use it, ask for it in a portable format, and object to processing based on legitimate interests. Where processing rests on consent, you can withdraw it at any time — that does not affect what was done before.

Write to oleh@levytskyilegal.com and I will respond within one month. There is no charge, and I will not ask you for more identification than I need to be sure it is you.

One limit worth being straight about: where data is part of a client file, professional confidentiality and my legal retention duties may prevent deletion until the retention period ends. I will tell you if that applies.

If you think I have handled your data badly, tell me first — it is usually faster. You also have the right to complain to a supervisory authority: in the EU or EEA, the authority of the country where you live or work; in Ukraine, the Ukrainian Parliament Commissioner for Human Rights (Ombudsman), whose Secretariat has a dedicated personal data protection department, or the courts.

7. Two things worth stating plainly

No automated decision-making. Nothing here profiles you or decides anything about you automatically. When a decision affects you — whether I take on your matter, what I quote — a person makes it, and that person is me.

No Article 27 representative. I am established outside the EU and offer services to people in it, so Article 27 is in scope as a question. I rely on the exemption in Article 27(2): the processing described here is occasional, involves no large-scale processing of special categories, and is unlikely to result in a risk to your rights. If that assessment changes, so will this notice.

8. Which law applies

I work from Ukraine, so my practice falls under the Ukrainian Law on Personal Data Protection. At the same time, because I offer services to people in the EU, the GDPR applies to this processing as well. Where the two differ, I follow the stricter one: in practice that means the GDPR standard on substance, and Ukrainian procedure where it governs how your requests and complaints are handled.

9. How your data is kept safe

Proportionate to a solo practice, not to a corporation: full-disk encryption on the devices I work from, two-factor authentication on email and every service that holds client data, a password manager, regular backups, and separate storage per client matter. Above all, everything you tell me is covered by professional confidentiality.

10. Changes

If this notice changes materially, the date at the top changes with it. There is no version history to dig through: what you see here is what applies now.