Privacy policy
The short version. I collect the minimum needed to answer you, run a call, sell you the playbook, or deliver an engagement. I do not run ads, I do not sell data, and I do not use advertising cookies. Payments are handled by Stripe - I never see your card number. You can ask me at any time what I hold about you, and I will tell you.
1. Who is responsible for your data
I am Iryna Manukovska, a fractional CMO and AI adoption advisor based in Limassol, Cyprus, and I am the data controller for everything described on this page. Contact: iryna@manukovska.com. [If you invoice through a registered entity, add its name, registration number and address here.]
2. What I collect, why, and on what legal basis
| When | What | Why | Legal basis (GDPR Art. 6) | Kept for |
|---|---|---|---|---|
| You book a call | Name, email, company, anything you write in the booking form | To hold the call and prepare for it | Steps prior to a contract (1(b)); legitimate interest (1(f)) | 24 months after last contact, unless we start working together |
| You buy the playbook | Name, email, billing country, VAT ID if you provide one; payment details go to Stripe, not to me | To deliver the product, issue an invoice and charge the correct VAT | Contract (1(b)); legal obligation for tax records (1(c)) | Invoicing and tax records: six years, as required by Cypriot tax law |
| You email me | Your email address and what you write | To reply | Legitimate interest (1(f)) | 24 months after last contact |
| We work together | Business contact details, contracts, and the materials you share for audits, workshops or advisory | To deliver the engagement | Contract (1(b)); legal obligation for financial records (1(c)) | Engagement plus three years, unless our contract says otherwise; financial records six years |
| You subscribe to the newsletter | Handled entirely by LinkedIn - I see your LinkedIn profile as a subscriber, nothing more | To send you the newsletter | Your consent, given to LinkedIn | Until you unsubscribe on LinkedIn |
I collect nothing else. No profiling, no data enrichment, no purchased lists.
3. Who helps me process it
I use a small set of service providers, each acting under its own data processing terms:
- Stripe - payments, invoicing and VAT calculation for playbook sales.
- Google Calendar appointment scheduling - call bookings.
- Google Workspace - email and document storage.
- Google Analytics 4 - page-level site statistics, only with your consent.
- A virtual private server rented from a hosting provider - serves this website and keeps standard server logs (IP address, pages requested) for security.
- LinkedIn - the newsletter and my public professional presence, under LinkedIn's own privacy policy.
- My accountant - sees invoicing data, because the law requires it.
I never sell personal data, and I never share it with anyone for advertising.
4. A note on AI tools - because I use them openly
I use AI tools daily in my work, including Anthropic's Claude, and I say so on this site. Two rules apply. First, client materials are only processed through paid business-tier accounts under the providers' commercial terms. Second, anything AI-assisted is reviewed by me before it reaches you. If your engagement needs specific tools excluded, we write that into the contract.
5. Where your data travels
Some of the providers above (Stripe, Google, LinkedIn, AI providers) process data in the United States. Those transfers rely on the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses, as published in each provider's data processing agreement.
6. Cookies and analytics
This site uses no advertising cookies and no cross-site tracking. Two things do set or read something on your device:
- Google Analytics 4 - only if you accept it. Analytics storage is denied by default through Google's Consent Mode, so nothing is measured until you choose. It tells me which pages get read; it is not used for advertising, and no data is sold. Google is the processor and may transfer data to the United States under the EU-US Data Privacy Framework and Standard Contractual Clauses.
- Your consent choice - stored locally in your browser so you are not asked again. This is a preference, not tracking.
- Strictly necessary items - for example, Stripe sets cookies during checkout to process a payment securely.
Declining changes nothing about how the site works. To change your mind later, clear this site's data in your browser and the choice will be offered again.
7. Your rights
Under the GDPR you can, at any time:
- ask for a copy of the data I hold about you (access);
- have it corrected (rectification) or deleted (erasure), where the law does not require me to keep it;
- restrict or object to processing based on legitimate interest;
- receive your data in a portable format;
- withdraw any consent you have given, without affecting what happened before.
Write to iryna@manukovska.com and I will answer within one month. There is no form, no hoop - an email is enough.
If you believe I have handled your data wrongly, you can complain to the Cyprus supervisory authority: the Office of the Commissioner for Personal Data Protection, dataprotection.gov.cy. You can also complain to the authority in your own EU country.
8. Security
Data lives in the systems named above, protected by two-factor authentication and access limited to me and, where the law requires, my accountant. I keep no local copies of payment data - Stripe holds those under PCI DSS.
9. Children
This site and my services are for professionals and are not directed at anyone under 18.
10. Changes
If this policy changes, the new version appears here with a new effective date. For material changes affecting existing clients or buyers, I will tell you by email.