Privacy Policy

1. Who is responsible for your data

This is the personal professional website of Sergii Nesterenko, based in Slovakia. Sergii Nesterenko is the controller for operating this website, optional analytics, and personal or employment-related correspondence.

Enquiries about services delivered through Mollis Group s.r.o. are handled by the company as controller for those business enquiries and subsequent client relationships. Sergii Nesterenko handles them on the company's behalf. Mollis Group s.r.o.: Haanova 46A, 851 04 Bratislava, Slovakia; Company ID: 51321858; VAT: SK2120674226.

For either type of privacy request, contactdata@mollis.group. This address delivers to the monitored company mailbox.

2. Information we handle

When you contact us, we receive your email address, message, and any information you choose to include. The form requires an email address and message so we can review your enquiry and reply. A validated enquiry is saved in Cloudflare D1 with a submission reference, privacy notice version, timestamps, and notification status before we attempt its email notification. Temporary email failures are retried; a saved enquiry remains available if the notification fails. Please do not include passwords, identity documents, or sensitive information that is not needed for your enquiry.

Hosting, security, and email systems also handle technical information, such as IP addresses, request times, browser information, delivery status, and error records. Cloudflare Turnstile checks browser and network signals to protect the contact form against automated submissions. Its token is checked on the server before a notification is sent. This necessary security check runs independently of optional analytics consent. IP-based request limits also help prevent abuse. Optional analytics and the preference stored in your browser are described below.

3. Purposes and legal bases

We handle enquiries to answer your questions and, where requested, discuss or provide services. Necessary steps towards a contract with you and performance of that contract rely on Article 6(1)(b) GDPR. Other correspondence, including enquiries made on behalf of a business, relies on our legitimate interests in responding to relevant messages and maintaining professional relationships under Article 6(1)(f).

Necessary security and troubleshooting rely on our legitimate interests in protecting the website and ensuring reliable delivery. Applicable legal and accounting duties rely on Article 6(1)(c). Optional analytics relies on your consent; remembering your privacy choice is necessary to respect that choice. These bases are not limited to visitors located in the EU.

Sending an enquiry does not subscribe you to marketing. Refusing analytics does not prevent you from using the website or contact form.

4. Optional analytics and browser storage

Cloudflare Web Analytics measures visits, pages viewed, broad browser and device information, referral information, and page performance. Its beacon does not use analytics cookies or persistent visitor identifiers. Cloudflare states that it discards the incoming IP address at its edge rather than storing it in the analytics database.

We load the analytics beacon only after you select Allow analytics. Before that, or after Reject analytics, optional browser analytics stays off. We do not use advertising pixels, session recordings, or cross-site advertising profiles.

A local storage entry named sn.analytics-consent remembers your choice, the notice version, and the decision and expiry times for 180 days. It is used only to manage your preference, not to identify you across websites. An expired or invalid choice requires a new decision. If the browser cannot save the choice, analytics remains off.

You can refuse or withdraw permission usingPrivacy settings on any page. Withdrawal stops further analytics collection and reloads the page to remove the running beacon. It does not undo earlier processing; previously collected aggregate statistics cannot be attributed to you. We also keep optional analytics off when your browser sends Global Privacy Control or Do Not Track.

To avoid duplicate enquiries after an interrupted request, essential session storage named sn.contact-submission temporarily keeps a random submission identifier and a SHA-256 fingerprint of the form content. It does not store the email address or message text. It is cleared after confirmed acceptance or when the browser ends the tab session; a changed email or message starts a new submission. If storage is blocked, deduplication works in memory until the page is reloaded.

Tab-session storage named sn.hero-pattern-v1 andsn.hero-palette-v1 remembers decorative background choices so consecutive page loads show a different animation and palette. These local presentation values contain no visitor identifier and are not sent to our server or analytics. If storage is blocked, the background still works with a fresh random choice.

Essential hosting, security, and form delivery continue without analytics consent. With JavaScript disabled, optional analytics is not loaded.

5. Providers and recipients

Cloudflare provides hosting, traffic delivery, security, the form's server-side function, D1 enquiry storage, scheduled notification retries, Turnstile security checks, and optional web analytics. Resend sends the form's email notification. Zoho Mail provides email for the sergiinesterenko.com domain; Google Workspace provides the Mollis Group mailbox, including data@mollis.group. Messages may be handled in the relevant mailbox and in Thunderbird, our email client.

We use these services for the purposes above, subject to their applicable contractual terms and data-processing arrangements. Providers may also process limited information for their own security or legal obligations. Business enquiries may be shared with Mollis Group s.r.o. as described in section 1. We do not sell personal information or share it for cross-context behavioural advertising.

6. International processing

Providers and their subprocessors may process data outside the European Economic Area, including in the United States. Resend states that its primary data storage, including email content and delivery records, is in the US; choosing a European sending region does not change that storage location.

Where GDPR transfer restrictions apply, the relevant provider arrangements must provide an applicable safeguard, such as an adequacy decision or European Commission standard contractual clauses, with additional measures where required. You can contact data@mollis.group for information about the safeguards applicable to your data. Analytics permission is not a blanket consent to unrelated international transfers.

7. Retention

General enquiry correspondence is kept only as long as needed to reply and follow up, normally no longer than 24 months after the last meaningful contact. A longer period may be necessary for an ongoing project, a legal obligation, or the establishment or defence of legal claims. Project and accounting records follow the applicable Slovak legal requirements. The D1 enquiry copy is assigned a 24-month retention review date when submitted. It is included in deletion and retention reviews along with notification metadata. Ongoing project or legal records require a documented hold or transfer before that date. Notification retries do not delete enquiries; retention review and deletion are handled separately.

Cloudflare's Web Analytics dashboard makes statistics available for up to six months. Your local privacy choice expires after 180 days. Turnstile tokens are short-lived and single-use; our form does not persist them. Temporary form rate-limit entries expire after 15 minutes and are removed when subsequent requests clean up the function's in-memory records or the instance ends; they are not a permanent visitor database.

Hosting, security, email delivery records, and backup copies follow the relevant provider settings and retention periods. Mailbox and local email copies need to be considered when handling a deletion request; limited copies may remain until the applicable backup retention period ends.

8. Your choices, rights, and complaints

Depending on the applicable law and processing basis, you may request access, correction, deletion, restriction, or portability, and object to processing based on legitimate interests. You can withdraw analytics consent at any time without affecting the lawfulness of earlier processing. Visitors from any country can contactdata@mollis.group with a request or privacy complaint.

We may ask for proportionate information to verify a request; we do not routinely require an identity document. GDPR requests are answered without undue delay and normally within one month. If a permitted extension is needed, we explain it within that first month.

You may also complain to theSlovak Office for Personal Data Protection, or another competent supervisory authority. Where applicable, UK visitors may contact the ICOand Australian visitors theOAIC. Local rights apply where the relevant law covers the processing.

9. Changes and contact

Updates are published on this page with a revised date. A material change to optional analytics requires a new consent decision before that analytics is enabled. For general website questions, write tohello@sergiinesterenko.com.