Privacy policy and personal data
Legal support for websites, e-commerce, marketplaces and digital products, connecting legal documents with the actual user journey, data flows and integrations.
For privacy policy and personal data, we review the available documents and relevant facts, explain the applicable procedure and agree the scope of work before the engagement begins.
Meetings are available in Kyiv or online across Ukraine.
What should a website Privacy Policy explain?
A Privacy Policy should explain who processes personal data, which data is collected, for which purposes and legal bases, who receives it, how long it is kept and how people can exercise their rights.
The text is based on an inventory of forms, CRM, analytics, advertising, chats, payments and suppliers. EU-facing products may also require an assessment of controller and processor roles, transfers and other GDPR documents.
Data that is often overlooked
- analytics identifiers and event logs
- chat, callback, CRM and email marketing data
- payment, hosting and cloud suppliers
- retention, deletion and data-subject requests
Practical outcome
The deliverable can include the Privacy Policy, data-collection map, form wording, supplier requirements and a process for requests or incidents.
What happens at the beginning
We first establish the timeline, status of the parties and the lawful objective. We then review documents, deadlines and jurisdiction, explain the available scenarios and only then propose a scope of work.
- review of documents and relevant facts
- assessment of procedural deadlines and material risk
- oral or written legal position
- documents, negotiations or representation as agreed
How we work
- 01
Enquiry
Describe the events and share the documents currently available.
- 02
Assessment
We identify status, deadlines, risk and the necessary actions.
- 03
Terms
We agree the format, fee and communication and sign an engagement agreement.
- 04
Work
We perform the agreed actions and keep you informed.
What to bring to the consultation
Prepare anything that helps reconstruct the sequence of events. Missing documents do not prevent an initial discussion.
- identity and documents confirming your status
- decisions, protocols, agreements, letters or messages
- a short dated timeline
- questions and details of the next procedural event
Deadlines, fees and scope
Can we copy a competitor’s Privacy Policy?
No. It describes different services and data flows and may mislead users about your actual processing.
Does GDPR always apply to a Ukrainian website?
No. Applicability depends on the facts, audience, offering to people in the EU and monitoring of their behaviour.
When may privacy policy and personal data be needed?
Privacy policy and personal data may be relevant where the facts match the circumstances described on this page. The appropriate form of legal assistance is confirmed only after an initial assessment.
What should I prepare for an assessment of privacy policy and personal data?
Send a short timeline, documents showing your status, decisions, agreements, correspondence and the dates of upcoming events. We can begin with the information available if some documents are missing.
Can the initial work be handled online?
Yes. The initial consultation and exchange of document copies can be arranged online. Any travel, personal attendance or representation is agreed separately.
What determines the legal fee?
The fee depends on the volume of materials, urgency, procedural steps and agreed format. The scope and fee are recorded in the engagement agreement.
Privacy policy and personal data: Kyiv and online across Ukraine
Legal basis
Content reviewed by attorney Oleksandr Zavizion: 5 August 2026.
Describe the matter — we will identify the next step
Tell us the short timeline and which documents are available. We agree the format, scope and fee before work begins.