PrivacyPolicy

NAKO Agency ("we", "our", "Company") acts as the data controller for personal data collected through this website.

Website: nakoagency.com.

This Privacy Policy applies to all users worldwide, regardless of location.

We operate across the following jurisdictions: Moldova, Romania, Ukraine, Poland, Germany, Italy, Russia, and Kazakhstan.

Applicable data protection regulations include: the General Data Protection Regulation (GDPR) for the European Union; Law No. 195/2024 on Personal Data Protection (Moldova); Law No. 2297-VI on Personal Data Protection (Ukraine).

Personal data provided through forms: name, email address, phone number, Telegram username, company name, and project description.

Automatically collected data: IP address (truncated by Google for users in the EU — truncation reduces precision, but the data remain personal data), browser type, device information, pages visited, and referrer URL.

Cookies: we use necessary cookies and, only with your consent, analytics cookies. We do not use marketing cookies. For details, please see our Cookie Policy.

Third-party services that may collect data: Google Analytics 4 and Microsoft Clarity (only with your consent to analytics) and Cloudflare Turnstile (anti-bot check at sign-in).

Processing of form submissions, so that we can reply to your request — legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR). Consent to marketing communications is separate (below) and is not a condition for our reply.

Communication about projects and services — legal basis: contractual necessity (Art. 6(1)(b) GDPR).

Analytics of how the site is used, so we can improve it — legal basis: your consent (Art. 6(1)(a) GDPR). Without your agreement the analytics do not start, and you can withdraw your consent at any time, as easily as you gave it.

Legal compliance — legal basis: legal obligation (Art. 6(1)(c) GDPR).

Marketing communications (only with your explicit consent) — legal basis: consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time by writing to us at hello@nakoagency.com; after you withdraw it, we no longer send you such communications. Withdrawal does not affect communications sent before, on the basis of the consent given. Your consent to marketing communications becomes valid only after you confirm it through the link in the email we send you. Until you confirm, we do not send you marketing communications; an unconfirmed request expires after 7 days and is deleted automatically.

Security log (technical and activity data: the account that acted, including its email address, the IP address, the browser, the action performed and its object) — legal basis: our legitimate interest in securing the service and preventing abuse and fraud (Art. 6(1)(f) GDPR). You can object to this processing at any time, on grounds relating to your particular situation (Art. 21 GDPR). The same legal basis, and the same right to object, apply to the automated anti-bot check at sign-in (Cloudflare Turnstile), described in the section “Data Sharing”.

IP address for abuse protection. When you submit the audit form, sign in or request a password reset, we use your device’s IP address to limit the number of attempts and protect our service against abuse, such as automated submissions or repeated password-guessing attempts. The legal basis is our legitimate interest in keeping the service secure (Art. 6(1)(f) GDPR). We do not store your IP address in plain form: we keep only a pseudonym derived from it with a secret key that is stored separately. The pseudonym is deleted automatically within 26 hours at most. You can object to this processing as described in the section on your rights.

We use two categories of cookies: necessary (always active) and analytics (only with your consent).

Google Consent Mode v2 is implemented on our website; the advertising signals remain permanently disabled.

Before you provide consent, no non-essential cookies are set.

You can manage your cookie preferences via the cookie banner displayed on your first visit, or through the "Cookie Settings" link in the website footer at any time.

For full details on the cookies we use, their purposes, and retention periods, please see our Cookie Policy page.

If you accept analytics cookies, we use Google Analytics 4 and Microsoft Clarity to understand how the site is used: the pages visited, where the visit came from, the device and browser type, the approximate country inferred from the IP address and, through Clarity, session recordings (clicks, scrolling, movements). The legal basis is your consent (Art. 6(1)(a)) — until you give it, the analytics scripts write no cookie and send no identifier; you can withdraw it at any time from the cookie banner, with immediate effect.

We do not use this data to identify you personally, we do not combine it with your account data, and we do not use it for personalised advertising.

The providers are Google and Microsoft, acting as our data processors. The data may be transferred outside the European Union, including to the United States. The transfer relies on the GDPR safeguards each provider declares in its own data processing terms — a recognised protection framework, or, in its absence, the Standard Contractual Clauses approved by the European Commission. You may request a copy of these safeguards at any time, by writing to us at hello@nakoagency.com.

When you sign in to the client area, an additional usage measurement applies there, only with your consent, described separately in the client area analytics policy.

We do NOT sell your personal data under any circumstances.

We share data with the following service providers (data processors): Vercel Inc. (hosting, United States — protected by EU Standard Contractual Clauses); Resend Inc. (email delivery, United States — protected by EU Standard Contractual Clauses); Fastmail Pty Ltd (hosting of the agency's mailbox, which receives the notification of a new request and may contain your contact details; United States); Google (analytics) — data may be processed outside the European Union, including in the United States, under the provider's own transfer mechanisms; Supabase Inc. (database and authentication — accounts and sign-in — in the European Union, Frankfurt); Microsoft Corporation (Microsoft Clarity — on-site behaviour maps and session recordings, USA). We additionally use Sentry (error monitoring, with data hosted in the European Union): for clients with a cabinet account, application errors; on the public website, only errors of our own server, without your IP address and without the content of forms. Sentry does not run in your browser. To protect sign-in to the client area and to your Nako ID account against bots, we additionally use Cloudflare, Inc. (Cloudflare Turnstile, United States).

Anti-bot check at sign-in. When you sign in with a password, request a verification code or a sign-in link, create an account or recover your password, Cloudflare Turnstile automatically checks that the request does not come from a bot. To do this, Cloudflare processes your IP address and technical signals from your browser and from the request (for example, the browser’s User-Agent header and the characteristics of the connection); it does not access what you type into the form. Legal basis: our legitimate interest in protecting accounts against automated attacks and abuse (Art. 6(1)(f) GDPR). On our side, the check is transient: its result is a single-use token that expires after 5 minutes, and we do not store it. Cloudflare processes these signals as our processor; to improve its bot detection, it acts as an independent controller, under its own Turnstile Privacy Addendum. The check applies to every sign-in through Nako ID — the NAKO account you use for the client area and for the NAKO apps connected to Nako ID.

We may disclose data to legal authorities upon lawful request.

Processing at these providers takes place under the data processing terms each of them publishes. We do not claim to have an individually signed data processing agreement (DPA) with every provider.

Our website is hosted on Vercel Inc. (USA/EU). When you submit a form, your data is sent to our email AND recorded in our CRM system, hosted on Supabase with the database in the European Union (Frankfurt, eu-central-1). Requests are kept for 24 months from the last contact, after which they are deleted automatically.

Third-party services and their locations: Vercel Inc. (USA/EU) — hosting and transit form processing; Google — analytics (Google Analytics 4), with processing possible outside the EU; Resend Inc. (USA) — email delivery; Fastmail Pty Ltd (USA) — the agency's mailbox, which receives request notifications; Supabase Inc. (EU — Frankfurt) — database and authentication (accounts and sign-in); Microsoft Corporation (USA) — Microsoft Clarity, behaviour maps and session recordings; Cloudflare, Inc. (USA) — anti-bot check at sign-in (Cloudflare Turnstile).

Safeguards for EU residents: where we have concluded EU Standard Contractual Clauses with the provider (Vercel, Resend), transfers are based on them; for other providers, each provider's own transfer mechanisms apply. Cloudflare, Inc. declares that it relies on its certification under the EU-U.S. Data Privacy Framework (Art. 45 GDPR), and its data processing addendum also incorporates the EU Standard Contractual Clauses (Art. 46 GDPR). All data is encrypted in transit (TLS 1.2+).

For residents of Moldova, Ukraine, Poland, Germany, Italy, and Romania: safeguards provided by the GDPR (EU Regulation 2016/679) and the respective national legislation apply.

If we work together on a project, we keep the data that arises from that relationship: your name, the contact details used in the project, your company (where applicable), what we delivered and when, invoices and amounts, and correspondence about the project. We receive it from you during the contract. We do not add data taken from other sources.

Legal bases: performance of the contract (Art. 6(1)(b) GDPR); legal obligation to keep accounting records (Art. 6(1)(c) GDPR); our legitimate interest in keeping a record of the relationship and defending ourselves in case of a dispute (Art. 6(1)(f) GDPR). You can object at any time to processing based on legitimate interest (Art. 21 GDPR). We do not use this data for marketing.

We keep the data for the duration of the contract. After it ends, accounting documents are kept for as long as the accounting and tax legislation of the Republic of Moldova requires, and the rest of the record of the relationship until the limitation period for contractual claims expires.

Only members of the NAKO Agency team who work with clients have access to this data, together with Supabase Inc., the processor that hosts our database and authentication (accounts and sign-in), in the European Union, Frankfurt.

Form submissions: retained for 2 years from the date of submission, then permanently deleted.

Analytics data: retained for up to 14 months (the maximum on standard Google Analytics 4).

Cookies: retention varies by type; see our Cookie Policy for specific durations.

Cookie consent records: retained for 3 years as proof of GDPR compliance.

Account deletion requests: a 90-day recovery window applies before personal data is anonymised, so an account can be restored if the request was made by mistake.

Security log: kept for 24 months, then deleted automatically. The legal basis is set out in the section “Purposes and Legal Basis”. If you ask us to erase your data within this period, we may keep the entries needed to establish, exercise or defend legal claims (Art. 17(3)(e) GDPR).

Requests to exercise your rights (for example, access or erasure): an unconfirmed or unused request is deleted automatically 30 days after its confirmation link expires. For a fulfilled request we keep only its record — the type of request, an internal identifier and the dates on which it was received, confirmed and fulfilled, without your email address — for 3 years, as proof that we responded, and then delete it automatically. The legal basis is our legitimate interest in being able to show that we acted on your request (Art. 6(1)(f) GDPR).

When you visit the site or open an email that loads resources from our servers, our hosting infrastructure (Vercel and Supabase) automatically records technical data: your IP address, the date and time of the request, the resource requested, your browser or client type, and the response code. These logs are created on every request, as on any web server.

Purpose: the operation, security and stability of the service — troubleshooting, and the prevention and detection of abuse and attacks. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR) in operating the service securely. We do not use these logs for profiling, advertising, or to measure your behaviour.

Processors and retention periods:

Vercel Inc. (hosting of the site and the application): request logs are available for up to 30 days.

Supabase Inc. (database and authentication — accounts and sign-in — in the European Union, Frankfurt): logs of requests to the service are available for 90 days.

Sentry (error reporting): for clients with a cabinet account, technical data about an error together with an internal account identifier; on the public website, only technical data about an error of our own server, without any identifier of the visitor. In both cases without your IP address; kept for at most 90 days.

These are the periods during which the logs are available to us. Providers may keep certain data longer for their own security, under their data processing agreements.

All users have the right to: access their personal data, request rectification of inaccurate data, request deletion of their data, and withdraw consent to data processing.

EU residents (under GDPR) additionally have the right to: data portability, restriction of processing, objection to processing, and the right not to be subject to automated decision-making. Relevant supervisory authorities: ANSPDCP (Romania), UODO (Poland), BfDI (Germany), Garante per la protezione dei dati personali (Italy).

Moldovan residents (under Law No. 195/2024) have GDPR-equivalent rights. Supervisory authority: National Centre for Personal Data Protection (NCPDP).

Ukrainian residents (under Law No. 2297-VI) have the right to: access, correction, deletion of personal data, and withdrawal of consent. Supervisory authority: Ukrainian Parliament Commissioner for Human Rights (Ombudsman of Ukraine).

To exercise any of your rights, please contact us at: hello@nakoagency.com. We will respond within 30 days of receiving your request.

All data is encrypted in transit using HTTPS/TLS protocols.

Access to personal data is restricted to authorized personnel only.

We conduct regular security reviews of our systems and processes.

While no method of electronic transmission or storage is 100% secure, in the event of a data breach we will notify affected users within 72 hours as required by the GDPR.

We do not address minors and do not knowingly collect their data. Where the law of your jurisdiction requires the consent of a parent or guardian, we do not process such data without it. If you learn that a minor has provided us with data, write to hello@nakoagency.com and we will delete it.

We may update this Privacy Policy from time to time. Changes become effective upon publication on the website.

In the event of material changes, users will be notified via a banner on the website.

The date of the last update is indicated at the top of this document.

Data Controller: NAKO Agency.

Email: hello@nakoagency.com.

Website: nakoagency.com.

For GDPR-specific inquiries, please write to: hello@nakoagency.com.