Privacy policy

This policy explains in plain language how we handle personal data when you use comon.agency, take our quiz, submit a request or write to us. It is written to meet the EU General Data Protection Regulation (GDPR), its UK counterpart (UK GDPR) and Ukrainian personal data protection law.

Last updated: 19.10.2026

1. Who is responsible for your data

The data controller is ФОП Пушанко Олександр Олегович, a Ukrainian sole proprietor (FOP) trading as "Cómon Agency" and operating the website comon.agency ("we", "us").

Registration / tax number: РНОКПП 3493805532
Address: the registered address of the sole proprietor is entered in the Unified State Register of Legal Entities, Individual Entrepreneurs and Public Associations of Ukraine; we also provide it on written request to team@comon.agency
Email: team@comon.agency
Phone: +380 73 060 59 89

We have not appointed a data protection officer, as we are not required to; for any data protection matter write to the email above. We are established outside the EU and the UK. Where the GDPR or the UK GDPR requires us to have a representative in the EU or the UK (Art. 27), we will name it in this section; in the meantime you can always contact us directly using the details above.

2. What data we collect

We collect only what we need to deal with your request:

Contact details: name, phone number or Telegram, email (optional).
Business details: company name, website or Instagram (optional).
Quiz answers: the services you need, your budget range and other answers you choose.
Messages: the content of emails or messages if you write to us.
Technical data: page URL, UTM parameters and ad-click IDs (gclid, fbclid), IP address, device and browser data.
Cookie identifiers — see our cookie policy for details.

You provide most of the data yourself, in a form, the quiz or an email. Technical data reaches us automatically from your browser when you visit the website. You are not obliged to give us your contact details, but without them we cannot answer your request or prepare a proposal. Please do not send us special categories of data (health, beliefs and so on): we do not need them.

3. Why we use your data and on what basis

Purpose	Legal basis (GDPR)
Answering your request, contacting you, preparing a proposal and taking pre-contract steps	Art. 6(1)(b) — steps taken at your request before a contract; if you write on behalf of a company, Art. 6(1)(f) — our legitimate interest in handling business enquiries
Non-essential cookies, analytics and advertising measurement, including sending Google and Meta hashed contact details and technical data to measure ads	Art. 6(1)(a) — your consent (in the EU, UK and Switzerland it is collected through the cookie banner)
Website security, spam prevention (including a hidden honeypot field), assessing and prioritising requests, improving our services	Art. 6(1)(f) — our legitimate interests in protecting the site, handling requests efficiently and improving our services; you can object (section 7)
Accounting and meeting legal requirements	Art. 6(1)(c) — legal obligation where EU or Member State law applies; otherwise Art. 6(1)(f) — our legitimate interest in complying with Ukrainian accounting and tax law

For visitors outside the EU, the UK and Switzerland, analytics and advertising tools are on by default, without a banner. They can be switched off at any time through "Cookie settings" in the footer.

You can withdraw your consent to non-essential cookies at any time through the "Cookie settings" link in the footer; withdrawing is as easy as giving consent. Withdrawal does not affect the lawfulness of processing carried out before it.

We use your contact details only to deal with your request and the related proposal. We do not send newsletters or other unsolicited commercial communications by email, SMS or messenger. If we ever introduced such communications, we would ask for your separate prior consent first.

The quiz uses a simple automatic score (based on your budget range and on whether you give a company, website or email) only to decide how quickly we get back to you. It has no legal or similarly significant effect on you, and decisions about proposals are always made by a person. If you disagree with how your request was handled, write to us and we will review it manually.

4. Who receives your data

We do not sell personal data for money and we do not give your contact details to anyone so that they can send you their own marketing. Data goes only to the following services that help us run the business:

Google (Google Ireland Limited / Google LLC) — Tag Manager, Analytics, Ads (conversion measurement, remarketing) and Workspace (email).
Meta Platforms (Meta Platforms Ireland Limited / Meta Platforms, Inc.) — Pixel and Conversions API, only after you consent.
Telegram — internal notifications to our team about new requests; they contain the details you submitted.
Pipedrive — the CRM where we manage leads and clients.
Vercel — website hosting and server-side handling of requests (including technical logs with the IP address).

Roles: Pipedrive, Vercel, Google Workspace and Google Analytics process data on our behalf under their data processing terms (processors). For ad measurement and remarketing, Google and Meta also use data for their own purposes as independent controllers, and for the Meta Pixel and Conversions API we are joint controllers with Meta for the collection and transmission of data to Meta (see Meta’s Controller Addendum). Telegram handles messages under its own terms and privacy policy.

If you have given marketing consent and submit a form, to measure ads we may send Google (enhanced conversions) and Meta your contact details in hashed form (name, phone, email), and Meta also your IP address and browser data. Hashed data is still personal data.

Each of these services has its own privacy policy, which you can read on its website. We pass them only the data needed for the relevant function, and no more.

Cómon Agency team members and contractors can also access the data and are bound by confidentiality. We may also disclose data where the law or a competent authority requires it.

5. International transfers

We operate from Ukraine. The European Commission has not adopted an adequacy decision for Ukraine, so the data you send us is processed in a country without such a decision. Whatever your location, we apply the security measures and rights described in this policy.

Our providers are established or process data in the EU, the United States and other countries. When data goes to a provider outside the EEA or the UK, the transfer relies on the safeguards that provider offers: an adequacy decision (for example the EU–US Data Privacy Framework, for US companies certified under it) or the Standard Contractual Clauses in its data processing terms. These safeguards are set by each provider in its own documents; we do not negotiate them individually. You can ask us which safeguard applies to a particular provider and how to obtain a copy of it, where available.

6. How long we keep data

Leads that do not become clients: up to 24 months from our last contact.
Clients: for the duration of the contract and the statutory accounting retention period.
Cookies: see the cookie policy for lifetimes.
Consent records: for as long as the consent remains valid (the cookie storing your choice lasts 6 months).

After that we delete the data or anonymise it.

7. Your rights

You have the right to:

access your data and get a copy;
have inaccurate data corrected;
have your data erased ("right to be forgotten");
restrict processing;
receive your data in a portable format and transfer it to another controller;
object to processing based on legitimate interests;
withdraw consent at any time;
not be subject to a decision based solely on automated processing (we do not do this).

To exercise your rights, email team@comon.agency. This is free of charge. We will reply within one month. We may ask you to confirm your identity so that your data does not reach the wrong person.

8. Complaints to a supervisory authority

If you believe we have infringed your rights, you can complain to a data protection authority: in Spain the AEPD (www.aepd.es), in the UK the ICO, in Ukraine the Ukrainian Parliament Commissioner for Human Rights (Ombudsman), or the authority of the EU country where you live or work or where the alleged infringement took place. We would appreciate the chance to resolve the matter first, so please write to us.

9. Children

This website is aimed at businesses and is not intended for anyone under 16. We do not knowingly collect children’s data. If you believe a child’s data has reached us, tell us and we will delete it.

10. Security

The website uses HTTPS, and access to data is limited to people who need it for their work and protected by account credentials. No system is 100% secure, but we work to keep the risks low.

If an incident occurs that poses a high risk to your rights, we will tell you and, where required, the supervisory authority.

11. US and California residents

We do not sell personal data for money. The laws of some US states treat the use of advertising cookies and the sharing of data with advertising platforms (Google, Meta) for targeted advertising as "sharing" or a "sale". You can switch these off at any time through "Cookie settings" in the footer, and you can ask us for access to or deletion of your data at the address in section 7. More about cookies is in the cookie policy.

12. Changes to this policy

We may update this policy. The current version is always on this page, and the date below shows when it was last changed. We will flag significant changes on the website.