Legal

Privacy Policy

Last updated: 13 August 2026

1. Who is responsible

This website is operated by Vlad Bubenko. I am the data controller for personal data processed through vladbubenko.com. Contact: bubenko97@gmail.com.

2. The short version

This is a portfolio website. It does not have accounts, logins, forms, or payments. The site collects very little data:

  • Pseudonymous visit statistics via Google Analytics. Analytics requires opt-in consent in the EEA, UK, and Switzerland; it loads automatically elsewhere unless your browser sends a Global Privacy Control or Do Not Track signal.
  • A one-time country lookup through IPWHOIS so the site can apply the correct regional consent rules. The country code is cached in your browser.
  • Standard server logs from the hosting provider (IP address, browser type, pages requested).
  • Your IP address is briefly transmitted to the Google Fonts and Fontshare CDNs when their fonts load — this is required for the site to display its typography.
  • Anything you choose to send me by email.

3. Analytics (cookies)

I use Google Analytics 4 to understand how many people visit the site and which pages are popular. It collects aggregated, pseudonymous data (approximate location, device type, pages visited) using cookies such as _ga and _ga_*.

For visitors in the European Economic Area, the UK, and Switzerland, analytics is off by default. It only starts after you click Accept on the consent banner, and it stays off if you decline. Your choice is remembered in localStorage until you clear this site's browser data.

For visitors elsewhere, including the United States, analytics loads without displaying a consent banner. This policy provides notice of that collection. You can prevent analytics by enabling Global Privacy Control or Do Not Track, blocking analytics in your browser, or disabling cookies for this site.

The analytics data I see is aggregate — I cannot identify individual visitors from it. I do not run advertising, remarketing, or cross-site tracking, and I do not sell or share personal information with anyone.

Regional consent detection

Before analytics loads, the site makes a one-time request to IPWHOIS to identify your country from your IP address. I receive only the resulting country code, which is stored in localStorage as vb.consent.region; I do not store your IP address. If the lookup fails, the site uses the privacy-protective default and displays the consent banner.

4. Web fonts

To display the site's typography, the browser requests font files from Google Fonts and Fontshare. As part of those requests, your IP address and browser information are transmitted to the respective providers, who act as processors of that brief connection data. No cookies are set by these requests, and I do not receive this data myself.

5. Server logs

The hosting provider records standard web-server logs (IP address, user agent, pages requested, timestamps) to keep the site secure, diagnose errors, and prevent abuse. These logs are typically retained for a short period (up to a few weeks) and are not merged with any other data.

6. Email

If you email me, I keep the messages (and anything you attach, such as a résumé or a brief) only as long as needed to respond and, where relevant, to maintain records of our work together. I do not add you to any mailing list and do not share your contact details.

7. Legal basis

Under the GDPR / UK GDPR, the processing described above is based on:

  • Consent (Article 6(1)(a)) — for analytics cookies and related tracking for visitors in the EEA, UK, and Switzerland. Consent is freely given via the banner and can be withdrawn by clearing this site's browser data.
  • Legitimate interest (Article 6(1)(f)) — for the limited country lookup needed to apply the correct regional consent requirements.
  • Legitimate interest (Article 6(1)(f)) — for server logs (security and reliability) and for displaying the site's fonts (the interest of providing the site you requested).
  • Legitimate interest (Article 6(1)(f)) — for responding to email enquiries (the interest of communicating with you).

8. Where data is processed

Google LLC (analytics, fonts), IPWHOIS (country detection), and the hosting provider may process connection data on servers outside your country. For transfers from the European Economic Area, the UK, or Switzerland, applicable providers rely on the EU-US Data Privacy Framework (and UK/Swiss extensions), which the European Commission has recognized as providing adequate protection.

9. Your rights

Depending on where you live, you may have the following rights over your personal data:

  • Access — ask for a copy of the data I hold about you.
  • Rectification — ask me to correct inaccurate data.
  • Erasure — ask me to delete your data.
  • Restriction — ask me to limit how I process your data.
  • Portability — ask for your data in a machine-readable format.
  • Objection — object to processing based on legitimate interest.
  • Withdraw consent — at any time, with effect for future processing.

To exercise any of these rights, email bubenko97@gmail.com. I will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority (for EU/UK residents, the authority where you live).

California residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you the right to know, correct, delete, and limit the use of your personal information, and the right to opt out of the sale or sharing of personal information. I do not sell or share personal information, and I have not done so in the preceding 12 months. I also do not collect or process sensitive personal information.

California residents may exercise their rights by emailing bubenko97@gmail.com. I will not discriminate against you for exercising your rights.

Do Not Track

This site honors the Global Privacy Control (GPC) signal and the browser Do Not Track setting: if either is present, analytics never loads and no consent banner is shown.

10. Retention

Analytics data is automatically aged out by Google Analytics' retention settings (aggregate reports are kept for the standard 14 months and then deleted). The country code and any consent choice remain in your browser's localStorage until you clear this site's data. Server logs are deleted automatically by the hosting provider. Email correspondence is kept only as long as it is needed for the purpose it was shared.

11. Children

This site is a professional portfolio and is not directed at children under 16. I do not knowingly collect data from children.

12. Changes to this policy

I may update this policy when the site or the law changes. The Last updated date at the top of this page always reflects the current version. Material changes will be highlighted here.

13. Contact

Privacy questions, requests, or complaints: bubenko97@gmail.com.