Privacy Policy

Who we are

IM Observer is the trading name of Ihor Miliev, Individual Entrepreneur (FOP) registered in Ukraine, tax ID (RNOKPP) 3816909735, business address 1 Shevchenka St., apt. 183, Izmail, Odesa region, 68610, Ukraine, operating imobserver.com and acting as the data controller. Contact: imobservercompany@gmail.com, telephone +380 98 357 6192.

What we collect, why, and on what basis

• Waitlist — your email, optionally your Instagram handle and car model and year, a timestamp and a record of your consent. To send you news about the Commission. Basis: your consent (Art. 6(1)(a) GDPR). Entirely voluntary; without it we simply cannot write to you.
• Orders and briefs — your name, email, contact channel and handle, your city and country, the contents of your brief and any photographs you upload, and the delivery address and phone number your print is shipped to. To enter into and perform your commission. Basis: performance of a contract (Art. 6(1)(b)). This is a contractual requirement — without it we cannot create your crest.
• Sensitive details you choose to include — a brief about what a car means to you may reveal health, religious or philosophical beliefs, political opinions or ethnic origin. Where it does, we use it only to design your crest, on the basis of your explicit consent (Art. 9(2)(a)), which you give in your brief and may withdraw at any time. A photograph is not biometric data unless it is processed to identify someone uniquely — we never do that.
• Other people in your materials — if you upload images showing other people, we process their data on the basis of our legitimate interests in fulfilling your commission (Art. 6(1)(f)), strictly limited to drawing your crest. We do not contact them.
• Gifts — where you commission a crest for someone else, the recipient's name, the date you need it by, and any way of reaching them that you choose to give us. To draw and deliver the crest and to agree the handover with you. Basis: performance of the contract with you (Art. 6(1)(b)) and, as regards the recipient, our legitimate interests in delivering the commission (Art. 6(1)(f)). We do not use their details for anything else and we do not add them to any list.
• Payment, invoicing and accounting records — name, contact details, amount, date, payment reference. When you pay by card, Contra and its payment processor collect your card and billing details directly; we receive only confirmation of the payment. Basis: our legal obligation under Ukrainian tax law (Art. 6(1)(c)).
• Anti-abuse and hosting — Cloudflare Turnstile processes your IP address and browser signals on our order and brief forms to tell humans from bots, and our host records standard server logs. Basis: our legitimate interests in protecting the forms and delivering the site (Art. 6(1)(f)).
• Public Archive and social media — only if you tick the relevant optional switch in your brief. Basis: your consent (Art. 6(1)(a)).

Who receives it

Google (Workspace — Gmail, Sheets and Drive: form submissions, order records, uploaded photographs and email), Netlify (website hosting and server logs), PostHog (cookieless visit counting, EU cloud), Microsoft (Clarity session recordings, only with your consent), Cloudflare (Turnstile bot protection on our forms), Contra (card payments on its own hosted payment page, together with its payment processor), printing, framing and engraving partners where your commission includes physical items, postal and courier services for delivery, the commissioned artist as an independent contractor bound by confidentiality, and our accountant and the tax authorities where the law requires. We never sell your data and we never use it for advertising.

International transfers

We are established in Ukraine, which is not covered by a European Commission adequacy decision. Some of our providers are established in the United States. Where we transfer your data to them we rely on the Standard Contractual Clauses adopted by the European Commission under Art. 46(2)(c) GDPR — and, for UK data, the UK International Data Transfer Addendum — as incorporated into our data processing agreement with each provider; where a provider is certified under the EU-US Data Privacy Framework we additionally rely on that. Email us for a copy of the relevant safeguards.

How long we keep it

Waitlist data: until you unsubscribe, or 24 months after your last interaction with us, whichever comes first. Order and brief data: for the duration of your commission and 3 years after. Photographs and source materials you upload: deleted 12 months after your commission is delivered, or sooner if you ask. Payment, invoicing and accounting records: 3 years from the end of the reporting period, as Ukrainian tax law requires. Public Archive entries: until you withdraw your consent.

Cookies and local storage

Three things, and only one of them asks for your consent. First, a short-lived sessionStorage entry carries the details you typed on the order page across to the brief page, so you do not have to type them twice; it disappears when you close the tab, and because it exists solely to deliver something you asked for it needs no consent under Art. 5(3) of the ePrivacy Directive. Second, we count visits and see which pages are read with PostHog, run in cookieless mode on its EU cloud: nothing is stored on your device, no identifier follows you from one day to the next, and visitors are counted by a hash that PostHog computes on its servers from a salt it rotates daily, so it cannot be turned back into you. We rely on our legitimate interest in knowing whether the site works (Art. 6(1)(f) GDPR). Third, session recordings and heatmaps with Microsoft Clarity run only if you press Accept on the cookie banner; Clarity then sets its own cookies. You can withdraw that consent at any time by clearing this site’s data in your browser, after which the banner asks again. No advertising pixels, and your data is never sold.

Your rights

You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw any consent at any time — withdrawing does not affect the lawfulness of what we did before you withdrew. To exercise any of these, email imobservercompany@gmail.com; we answer within one month, free of charge, and we will not treat you differently for asking. We do not carry out automated decision-making or profiling. You may also complain to a supervisory authority: in the EU, the data protection authority of the country where you live or work (the list is at edpb.europa.eu); in the UK, the Information Commissioner's Office at ico.org.uk.

Children

Our commissions are not offered to anyone under 18, and we do not knowingly collect data from children. If you believe we hold data about a child, email us and we will delete it.

Observer Archive

Your crest appears in the public Archive, and your name, city or car are mentioned, only with the separate opt-ins you give in your brief. You can withdraw them at any time and we will remove the public entry.