Privacy Policy
This policy explains how personal data is processed when you visit lekontsev.uk, read its publications, contact Aleksey Lekontsev, or exercise a data-protection right.
Effective date: 14 September 2026 · Version: 1.0
1. Controller and Data Protection Officer
The controller is Aleksey Lekontsev, an independent technology advisor based in Poznań, Poland. Aleksey Lekontsev also acts as the Data Protection Officer for the processing described in this policy.
- Website
- lekontsev.uk
- DPO and privacy requests
- DPO@lekontsev.uk
Please use “Data protection request” in the subject line. Do not send passwords, payment-card details, health information or other unnecessary sensitive data.
2. Scope and guiding principles
This policy applies to website visitors, readers, people who contact the controller, prospective or current advisory clients, and people exercising privacy rights. Processing follows the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality and accountability.
The website does not provide user accounts, accept uploads, run comments, sell personal data, use behavioural advertising, or intentionally collect special-category data. External websites reached through links have their own privacy practices.
3. Processing activities
| Activity and personal data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Website delivery and security. IP address, request time, requested URL, HTTP headers, browser/device information, referral data, response status and security events. | Deliver content, maintain availability, prevent abuse, diagnose faults and protect the website and visitors. | Legitimate interests under Article 6(1)(f) GDPR: secure and reliable publication and network operation. Processing may also be required under Article 6(1)(c). | Operational logs are kept only for provider-defined security and service periods; controller-held incident records are kept for the investigation and any applicable claims or legal period. |
| Optional Google Analytics 4. Consent choice, online identifiers, cookie/client identifier, session data, pages viewed, interaction events, approximate location, device/browser details and referrer. The site does not intentionally send names, email addresses or message content to Analytics. | Understand aggregate readership, article performance and navigation so publications can be improved. | Consent under Article 6(1)(a) GDPR and applicable electronic-communications rules. Analytics is disabled until consent is granted. | Consent remains until changed. GA4 cookies normally expire after up to two years, subject to browser limits. User/event data is retained according to the property setting for no longer than 14 months; aggregated reports may remain longer. |
| Email and advisory enquiries. Name, email address, organisation/role if supplied, message, attachments, correspondence history and related professional information. | Respond to enquiries, consider or perform advisory work, manage relationships and maintain necessary records. | Steps at your request before a contract and contract performance under Article 6(1)(b); legitimate interests under Article 6(1)(f) for ordinary professional correspondence and relationship management; Article 6(1)(c) where records are legally required. | Unsuccessful/general enquiries are periodically reviewed and normally deleted when no longer useful, generally within three years. Contract, accounting and claims records are kept for the applicable statutory or limitation period. |
| Privacy and legal requests. Identity/contact details, request content, evidence reasonably required to verify identity, correspondence and outcome. | Verify, manage and demonstrate compliance with data-subject requests, complaints and legal obligations. | Legal obligation under Article 6(1)(c) and legitimate interests under Article 6(1)(f) in establishing and defending legal claims. | For the request lifecycle and afterwards for the period needed to demonstrate compliance or address a complaint or claim. |
Personal data normally comes directly from you or your browser/device. It may also come from service providers that operate the website, public professional sources when relevant to an enquiry, or another person who includes you in legitimate correspondence.
5. Recipients, processors and their privacy information
Access is limited to service providers that need data to deliver, secure, measure or support the website and communications, and to professional advisers or authorities when legally necessary. Current core providers are:
| Provider and role | Service and data | Provider information |
|---|---|---|
| OpenAI Ireland Ltd (processor for EEA-based ChatGPT Sites customers, with affiliates and subprocessors) | ChatGPT Sites hosting, maintenance and support; hosted log, usage, device and cookie-related data necessary to operate the published site. | Sites DPA · EU Privacy Policy · Subprocessor list |
| Cloudflare, Inc. and group companies (processor/service provider, including infrastructure used directly or through the hosting chain) | DNS, content delivery, network security, traffic filtering and email routing for addresses at lekontsev.uk; network identifiers, routing metadata and email envelope data as needed for those services. | Privacy Policy · Subprocessor list |
| Google Ireland Limited / Google LLC (processor or separate controller as defined by the applicable service terms and enabled settings) | Google Analytics 4, only after consent; online identifiers, usage events, device/browser information, approximate location and referral data. | Privacy Policy · Partner-sites information · Data Processing Terms |
Email messages may also be delivered to the mailbox service configured behind Cloudflare Email Routing. That downstream mailbox provider is not exposed by public domain records; information about it can be requested from the DPO.
Data may be disclosed where required by law, to protect legal rights or security, in connection with professional advice, or during a legitimate reorganisation. Personal data is not sold.
6. International transfers
Some providers and their subprocessors operate outside the European Economic Area. Transfers are made only where an adequacy decision applies or appropriate safeguards are used, such as the European Commission’s Standard Contractual Clauses, relevant UK addenda where applicable, and supplementary technical or organisational measures. Providers may also rely on an applicable EU–US Data Privacy Framework certification for eligible transfers. You may contact the DPO for information about the applicable safeguards and, where available, a copy.
7. Whether providing data is required
You are not required to consent to analytics. Basic technical data is necessary to transmit and secure the website; without it, the requested page cannot be delivered. You may browse without contacting the controller. If you request a response or advisory service, sufficient contact and enquiry information is needed to act on that request. Statutory or contractual information will be identified if it becomes necessary.
8. Automated decision-making and profiling
No decision producing legal or similarly significant effects is made solely by automated means through this website. Google Analytics produces audience and usage statistics, but the site does not use those statistics for behavioural advertising or decisions about individual visitors.
9. Your data-subject rights
Subject to the conditions and exceptions in applicable law, you may:
- Access your personal data and receive information about its processing.
- Rectify inaccurate data and complete incomplete data.
- Erase data when a legal ground for erasure applies.
- Restrict processing in the circumstances defined by Article 18 GDPR.
- Receive or transmit portable data you provided where processing is automated and based on consent or contract.
- Object at any time to direct marketing and, on grounds relating to your situation, to processing based on legitimate interests.
- Withdraw consent at any time without affecting earlier lawful processing.
- Not be subject to qualifying solely automated decisions and request applicable safeguards.
- Lodge a complaint with a supervisory authority, particularly where you live, work or believe an infringement occurred.
Send requests to DPO@lekontsev.uk. Enough information may be requested to locate the data and verify identity, but only what is proportionate. Responses are normally provided within one month; this may be extended by two further months for complex or numerous requests, with notice. Requests are normally free, although a reasonable fee or refusal may apply to manifestly unfounded or excessive requests.
In Poland, complaints may be submitted to the President of the Personal Data Protection Office (UODO). You may also contact another competent EEA supervisory authority.
10. Security and data minimisation
Reasonable technical and organisational safeguards are used, including encrypted HTTPS transport, managed hosting and edge security, restricted administrative access, data minimisation and provider controls. No internet service is completely secure; please avoid sending unnecessary confidential or sensitive information by ordinary email.
11. Children
The website is intended for a professional audience and is not directed to children. Personal data from children is not knowingly requested. If you believe a child has provided personal data, contact the DPO so it can be reviewed and, where appropriate, deleted.
12. Changes and questions
This policy will be reviewed when services, purposes, providers or legal requirements change. Material changes will be identified by a new effective date and, where required, an additional notice. Questions, complaints and requests should be sent to DPO@lekontsev.uk.