Privacy Policy

1. Who we are

The controller, the legal entity behind datapink.net, and how to reach the person responsible for data protection questions.

Datapink LLC, Ukraine, Vinnytsia, operates datapink.net and decides why and how personal data collected through this website is processed.

Questions about this policy, and requests about your own data, go to our Legal Team at [email protected]. The same address reaches us for anything else described below.

This policy covers the website only. It describes what happens when you browse datapink.net, send us a request for quote, or send us a data rights and removal request.

2. What data we process

Categories of personal data processed through the website, the RFQ form and business correspondence — kept separate from data processed inside customer projects.

This site collects personal data through two forms and through ordinary correspondence. Nothing else on the site asks you for personal data.

The request for quote form asks for your name, work email and company, and optionally your role. The rest of that form describes the dataset you need — types, intended use, languages, domain, volume, source situation, format, timeline, the further technical details the form asks for, and a free-text message — and may contain personal data only if you put it there. The form also records whether you asked for an NDA and that you confirmed this privacy policy.

The data rights and removal form asks for the URL or source identifier, a description of what you are asking us to remove or restrict, your contact details, the basis on which you are asking, and your confirmation that the information is accurate.

When either form is submitted, we store the submitted values on our own server together with a submission identifier, a timestamp, and a one-way hash of the IP address the submission came from, computed with a key that changes each month. We do not store the IP address itself. The same values are emailed to a company address so that a person can act on them.

If you write to us by email, we process what you send and our reply.

Personal data inside datasets we build for customers is a different matter. That work is governed by the contract with the customer, and it is outside the scope of this website policy.

3. Purposes and legal bases

Each purpose we process personal data for, stated with the basis we rely on for that purpose.

We use request for quote submissions to answer your enquiry, scope the work and, if it goes further, prepare an engagement. The basis is our legitimate interest in responding to business enquiries, and the steps you ask us to take before entering into a contract.

We use data rights and removal requests to verify, assess and answer the request, and to trace affected records through lineage. The basis is our obligation to deal with such requests, and the interest of the person making them in having them handled.

We keep records of correspondence and of concluded engagements for our own business records and to defend or bring claims. The basis is our legitimate interest in keeping an accurate record of what was agreed, and, where it applies, an obligation to retain business records.

We use a session cookie, a stored consent choice, the one-way IP hashes described in this policy, a form timing check and a hidden honeypot field to keep the forms usable and to limit automated abuse. The basis is our legitimate interest in the security and availability of the site.

The analytics choice offered in the cookie preferences panel would run on your consent. No analytics is loaded on this site at present, so no such consent is currently acted on.

4. Sources of data

Data given to us directly, data observed on the site, and data received from a customer under a processing agreement.

Almost everything we hold about you, you gave us: through one of the two forms, or by writing to us.

The only data observed on the site is what your browser has to send in order to receive a page. Your IP address is one of those things, and we do not keep it as such: the stored submission record holds the one-way hash described above, and a second, separately keyed hash of it, re-keyed each day, is used only to count recent submissions from the same address. The site loads no third-party scripts, no third-party fonts and no trackers; its content security policy allows scripts, styles and fonts from this site only.

Where a customer gives us personal data as part of a project, we process it under that customer's instructions and under the contract with them, not under this policy.

5. Sharing and processors

Categories of recipients, the role each plays, and the agreement that governs it.

We do not sell personal data, and we do not share it with advertising networks or data brokers.

Two categories of provider act for us. Our hosting provider runs the server on which this site and its stored submissions sit. Our email delivery provider carries the notification message that a form submission generates. Each acts on our instructions under an agreement with us.

We may also pass data to professional advisers, or to a public authority or court, where we are required to or where we need to establish or defend a legal claim.

A removal request that concerns a dataset we built for a customer is routed to that customer, and we tell you when that happens.

You can ask us for a description of the providers we use by writing to [email protected].

6. International transfers

Where data leaves its origin jurisdiction, the mechanism relied on and where to request the documentation.

We operate from Ukraine, Vinnytsia, so data you send us is processed there. Our hosting and email providers may process it in other countries, which means data may leave the country you are writing from.

Where that happens, the transfer is governed by our agreement with the provider, which sets the terms on which they may handle the data and requires them to protect it. We do not transfer personal data to a recipient outside these arrangements.

Write to [email protected] if you want a description of where data goes and of the terms that apply to it.

7. Retention

How long each category is kept and what triggers deletion.

Form submissions are kept while we are dealing with the enquiry or request, and afterwards as part of our business record of what was asked and answered. We review stored submissions periodically and remove what we no longer need.

Where an enquiry becomes an engagement, the record is kept for as long as the engagement and our obligations arising from it require.

The consent cookie lasts 12 months from the moment you set it, or until you clear it or change your choice. The session cookie is discarded when you close the browser.

The keyed hashes used for rate limiting are counters, not records about you. They are re-keyed each day and are not linked to your submission.

You can ask us to delete data we hold about you at any time; see the section on your rights.

8. Your rights

Access, rectification, erasure, restriction, portability and objection — and the route to exercise each, including the Data Rights & Removal form.

You can ask us for a copy of the personal data we hold about you, ask us to correct it if it is wrong, ask us to delete it, ask us to restrict what we do with it, ask for it in a portable form, and object to our processing it on the basis of our legitimate interests. Where we act on your consent, you can withdraw it, which does not affect what we did before you withdrew it.

The quickest route for any of these is to write to our Legal Team at [email protected]. We will ask you for enough information to be sure who you are before we act on the request.

If your request concerns material in or connected to one of our datasets, use the Data Rights & Removal form, which routes it straight into the verification and assessment steps described there.

If you think we have handled your data badly, tell us first so we can put it right. You can also complain to the data protection authority in your country.