PRIVACYPolicy

NAKO Agency ("we", "our", "Company") acts as the data controller for personal data collected through this website.

Website: nakoagency.com.

This Privacy Policy applies to all users worldwide, regardless of location.

We operate across the following jurisdictions: Moldova, Romania, Ukraine, Poland, Germany, Italy, Russia, and Kazakhstan.

Applicable data protection regulations include: the General Data Protection Regulation (GDPR) for the European Union; Law No. 195/2024 on Personal Data Protection (Moldova); Law No. 2297-VI on Personal Data Protection (Ukraine); Federal Law No. 152-FZ on Personal Data (Russia); Law No. 94-V on Personal Data and Their Protection (Kazakhstan).

Personal data provided through forms: name, email address, phone number, Telegram username, company name, and project description.

Automatically collected data: IP address (anonymized for EU users), browser type, device information, pages visited, and referrer URL.

Cookies: we use necessary, analytics, marketing, and preference cookies. For details, please see our Cookie Policy.

Third-party services that may collect data: Google Analytics 4 and Vercel Analytics.

Processing form submissions — legal basis: your consent (Art. 6(1)(a) GDPR).

Communication about projects and services — legal basis: contractual necessity (Art. 6(1)(b) GDPR).

Website improvement and analytics — legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Legal compliance — legal basis: legal obligation (Art. 6(1)(c) GDPR).

Marketing communications (only with your explicit consent) — legal basis: consent (Art. 6(1)(a) GDPR).

We use the following categories of cookies: necessary (always active), analytics (opt-in), marketing (opt-in), and preferences (opt-in).

Google Consent Mode v2 is implemented on our website.

Before you provide consent, no non-essential cookies are set.

You can manage your cookie preferences via the cookie banner displayed on your first visit, or through the "Cookie Settings" link in the website footer at any time.

For full details on the cookies we use, their purposes, and retention periods, please see our Cookie Policy page.

We do NOT sell your personal data under any circumstances.

We share data with the following service providers (data processors): Vercel Inc. (hosting, United States — protected by EU Standard Contractual Clauses); Resend Inc. (email delivery, United States — protected by EU Standard Contractual Clauses); Google LLC (analytics, United States — protected by EU Standard Contractual Clauses); Telegram FZ-LLC (lead notifications via Telegram Bot API, UAE/UK — data transmitted in transit only, not stored). Supabase Inc. (CRM system and storage of requests; database in the European Union — Frankfurt); Microsoft Corporation (Microsoft Clarity — on-site behaviour maps, USA). For clients with a cabinet account we additionally use Sentry (application error monitoring); Sentry is NOT active on the public website.

We may disclose data to legal authorities upon lawful request.

Processing at these providers takes place under the data processing terms each of them publishes. We do not claim to have an individually signed data processing agreement (DPA) with every provider.

Our website is hosted on Vercel Inc. (USA/EU). When you submit a form, your data is sent to our email and Telegram AND recorded in our CRM system, hosted on Supabase with the database in the European Union (Frankfurt, eu-central-1). Requests are kept for 24 months from the last contact, after which they are deleted automatically.

By submitting a form, you consent to the cross-border transfer of your data to the specified jurisdictions.

Third-party services and their locations: Vercel Inc. (USA/EU) — hosting and transit form processing; Google LLC (USA) — analytics (Google Analytics 4); Resend Inc. (USA) — email delivery; Telegram FZ-LLC (UAE/UK) — lead notifications. Supabase Inc. (database in the EU — Frankfurt) — CRM system and storage of requests; Microsoft Corporation (USA) — Microsoft Clarity, behaviour maps.

Safeguards for EU residents: data transfers to the USA are based on EU Standard Contractual Clauses (SCCs) concluded between us and our service providers. All data is encrypted in transit (TLS 1.2+).

For residents of Russia (152-FZ): personal data submitted through the site’s forms is stored in our CRM system, with the database in the European Union, that is outside the Russian Federation. By submitting the form you confirm your consent to the cross-border transfer of data under Art. 12 of Federal Law No. 152-FZ.

For residents of Kazakhstan (Law No. 94-V): personal data is stored in our CRM system, with the database in the European Union. By submitting the form you confirm your consent to the cross-border transfer of data under the personal data legislation of the Republic of Kazakhstan.

For residents of Moldova, Ukraine, Poland, Germany, Italy, and Romania: safeguards provided by the GDPR (EU Regulation 2016/679) and the respective national legislation apply.

Form submissions: retained for 2 years from the date of submission, then permanently deleted.

Analytics data: retained for 14 months (Google Analytics 4 standard retention period).

Cookies: retention varies by type; see our Cookie Policy for specific durations.

Cookie consent records: retained for 3 years as proof of GDPR compliance.

Upon your request: personal data will be deleted within 90 days.

Account deletion requests: a 90-day recovery window applies before personal data is anonymised, so an account can be restored if the request was made by mistake.

Audit log: retained for 24 months (legal basis: GDPR Art. 17(3)(e) — establishment, exercise or defence of legal claims), then automatically deleted.

All users have the right to: access their personal data, request rectification of inaccurate data, request deletion of their data, and withdraw consent to data processing.

EU residents (under GDPR) additionally have the right to: data portability, restriction of processing, objection to processing, and the right not to be subject to automated decision-making. Relevant supervisory authorities: ANSPDCP (Romania), UODO (Poland), BfDI (Germany), Garante per la protezione dei dati personali (Italy).

Russian residents (under 152-FZ) have the right to: access, correction, blocking, and destruction of personal data, as well as withdrawal of consent. Supervisory authority: Roskomnadzor.

Kazakh residents (under Law No. 94-V) have the right to: access, correction, and deletion of personal data. Contact: Committee on Information Security of the Ministry of Digital Development.

Moldovan residents (under Law No. 195/2024) will have GDPR-equivalent rights from August 2026. Supervisory authority: National Centre for Personal Data Protection (NCPDP).

Ukrainian residents (under Law No. 2297-VI) have the right to: access, correction, deletion of personal data, and withdrawal of consent. Supervisory authority: Ukrainian Parliament Commissioner for Human Rights (Ombudsman of Ukraine).

To exercise any of your rights, please contact us at: hello@nakoagency.com. We will respond within 30 days of receiving your request.

All data is encrypted in transit using HTTPS/TLS protocols.

Access to personal data is restricted to authorized personnel only.

We conduct regular security reviews of our systems and processes.

While no method of electronic transmission or storage is 100% secure, in the event of a data breach we will notify affected users within 72 hours as required by the GDPR.

We do not address minors and do not knowingly collect their data. Where the law of your jurisdiction requires the consent of a parent or guardian, we do not process such data without it. If you learn that a minor has provided us with data, write to hello@nakoagency.com and we will delete it.

We may update this Privacy Policy from time to time. Changes become effective upon publication on the website.

In the event of material changes, users will be notified via a banner on the website.

The date of the last update is indicated at the top of this document.

Data Controller: NAKO Agency.

Email: hello@nakoagency.com.

Website: nakoagency.com.

For GDPR-specific inquiries, please write to: hello@nakoagency.com.