Privacy Policy

The controller of your personal data is the public organisation ГО «УкрЕкспорт» (UkrExport NGO), EDRPOU 45872808, Ukraine. We operate www.ukrexport.org and the UkrExport apps for iOS and Android. For anything about your personal data, email [email protected]. We reply within 30 days.

Data you give us: • Request for quotation (RFQ): name, email, company, country, phone (optional), product, volume, delivery and payment terms, message. • Producer registration: company details (name, EDRPOU, region, products, certificates), contact person, email, phone. • Buyer, exporter and partner enquiries, consulting bookings, tool forms: name, email, company, country, message. • The Weekly Brief newsletter: email and role (buyer / producer). • Beta feedback: your feedback, role, email (optional). • Sign in with Google (if you use it): name, email and profile picture from Google. Data collected automatically: • Server logs: IP address, browser, time and address of the request — for security and rate limiting. • Error reports (Sentry): technical details of a crash, without form contents. • Analytics (Google Analytics) and session replays (Sentry Replay) — only if you accept them in the cookie banner. • Mobile apps: crash reports, performance data and anonymous screen-view events. They are not linked to your name or email and are not used for advertising. The apps do not require an account.

• To pass your RFQ to the producer you chose, answer your enquiry or hold a consultation — to take the steps you asked for (GDPR Art. 6(1)(b); Art. 11 of the Law of Ukraine "On Personal Data Protection"). • To publish a producer profile in the catalogue — with your consent and to provide the service. • To send the newsletter — with your consent (double opt-in); every email has an unsubscribe link. • Analytics and session replays — only with your consent, which you can withdraw any time via "Cookie settings" at the bottom of every page. • Security, spam and bot protection, error reports, keeping a record of enquiries in our CRM — our legitimate interest in running a safe and reliable service (GDPR Art. 6(1)(f)). • Legal obligations — where Ukrainian law requires it. We do not sell personal data, we run no advertising and we do not profile you.

The producer you send an RFQ to receives your contact details and request by email — that is the point of the request. Service providers (processors) acting on our instructions: • OK Factory Hub (hub.okfactory.it, OK Factory LLC) — our CRM, where enquiries, RFQs, registrations, feedback and subscribers are stored. • Railway (Railway Corp., USA) — website hosting and server logs. • Neon (Neon Inc., USA) — managed PostgreSQL database. • Cloudflare (Cloudflare Inc., USA) — DNS, TLS encryption, attack and bot protection. • Amazon Web Services — Amazon SES (USA) — sending email: confirmations, notifications and the newsletter. • Sentry (Functional Software Inc., USA) — error reports for the website and apps; session replays only with consent. • Google (Google Ireland Ltd / Google LLC) — Google Analytics only with consent; Sign in with Google if you choose it. • TurboSMS (Ukraine) — SMS confirmation of your RFQ if you give a phone number. Some providers are outside the EU/EEA and Ukraine (mostly in the USA). These transfers rely on the EU Standard Contractual Clauses or, where the provider is certified, the EU-US Data Privacy Framework.

• RFQs, enquiries, consulting bookings, producer registrations — 3 years after our last interaction with you, then deleted or anonymised. • Producer profile in the catalogue — until you ask us to remove it. • Newsletter — until you unsubscribe. • Beta feedback — 2 years. • Server logs — up to 30 days. • Error reports and session replays (Sentry) — up to 90 days. • Google Analytics data — up to 14 months. • Your cookie choice — 12 months, after which we ask again. Where the law requires us to keep something longer, we keep only what is required, for as long as required.

Essential (work without consent): • ukrexport_locale — your language, 12 months. • cookieConsent (browser local storage) — your cookie choice, 12 months. • authjs.* — your sign-in session, only if you sign in; up to 30 days. • Cloudflare (__cf_bm, cf_clearance) — bot protection, up to 30 minutes / as set by Cloudflare. Analytics (only with your consent): • _ga, _ga_<ID> — Google Analytics, up to 14 months. Google's script is not loaded until you click "Accept analytics". • Sentry Replay (browser session storage) — a session recording with all text masked, for the session. You can change or withdraw your consent at any time via "Cookie settings" at the bottom of every page. When you withdraw it we switch Google Analytics off and delete its cookies.

Under the GDPR (if you are in the EU/EEA) and the Law of Ukraine "On Personal Data Protection" you have the right to: • access your data and get a copy; • correct inaccurate data; • have your data deleted ("right to be forgotten"); • restrict processing; • receive your data in a structured format (portability); • object to processing based on legitimate interest; • withdraw consent at any time — without affecting processing before the withdrawal. Email [email protected] from the address you gave us. We reply within 30 days. You can also complain to the data protection authority in your EU country, or to the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua).

Connections are protected by HTTPS (HSTS), only authorised people can access the data, access keys are stored as secrets, and forms are protected against bots and by rate limiting. If a breach puts you at risk, we will tell you and the relevant authority within the legal deadlines.

UkrExport is a business service. It is not meant for people under 16, and we do not knowingly collect their data.

We update this policy when our services or providers change. The date at the top shows the latest version; we announce material changes on the site and email our subscribers.

Questions about this policy or your data — write to us:

ГО УкрЕкспорт Contacts