1. Purpose, scope and users
1.1. BEREG-INFORMATION TECHNOLOGY LLC (ТОВ «БЕРЕГ-ІТ», trading as Bereg-IT; EDRPOU code 40428558; registered address: 17-21 Bahhovutivska St, Kyiv 04107, Ukraine; “we”, “us”) has adopted this Privacy Policy and makes sure it is maintained and followed. It sets out the basic principles and rules by which we collect, use and store personal data, and our duties while doing so.
1.2. The Policy applies to visitors of www.beregit.com (the “Site”), people who contact us through the Site forms or by email, job candidates, and contact persons of our clients and partners. It does not cover personal data we process on behalf of clients while providing our services — that processing is governed by the Data Processing Agreement (DPA) and the contract with the client.
1.3. We process personal data under the Law of Ukraine “On Personal Data Protection” (the “Law”). Where Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”) applies — in particular when we offer services to people in the European Union — we also comply with the GDPR.
1.4. We do not knowingly collect personal data from children: the Site and our services are intended for businesses. If you believe a child has sent us personal data, let us know and we will delete it.
1.5. Privacy is an ongoing responsibility. We review this Policy and update it when our processing, our services or the law change (section 15).
2. Legal bases for processing
2.1. We process personal data only where there is a legal basis. The main ones are consent, contract and legitimate interest; where the law requires us to keep data (for example, primary accounting documents), the basis is a legal obligation. On request we will explain which basis applies to your data.
2.2. Consent — your freely given, specific, informed and unambiguous indication of agreement to the processing of your data for a specific purpose (Article 6(1)(a) GDPR). We ask for consent when you submit a form on the Site.
2.3. Contract — processing necessary to conclude or perform a contract with you, or to take steps you ask for before concluding it, such as preparing a proposal (Article 6(1)(b) GDPR).
2.4. Legitimate interest — processing necessary for our legitimate interests or those of a third party, unless your rights and interests override them (Article 6(1)(f) GDPR), for example protecting the Site from spam and attacks. You may object to such processing (Article 21 GDPR).
2.5. Legal obligation — processing required by law, for example keeping accounting and tax documents (Article 6(1)(c) GDPR).
2.6. Under Ukrainian law these correspond to the grounds in Article 11 of the Law: the data subject’s consent, the conclusion and performance of a transaction, an obligation of the controller provided for by law, and the legitimate interests of the controller or a third party.
3. Consent and its withdrawal
3.1. If you have given consent, you may withdraw it at any time by writing to contact@beregit.com. Withdrawal does not affect the lawfulness of processing before it.
3.2. If you withdraw consent and we have no other legal basis, we stop the processing and delete the data.
3.3. If another legal basis exists, we may continue the processing with due regard to your rights and legitimate interests. In some cases you may object to it (Article 21 GDPR).
4. Our role
4.1. For the data of Site visitors, people who contact us, candidates, and contact persons of clients and partners, we are the controller of personal data and are responsible for its processing.
4.2. When we process personal data on behalf of a client while providing services (for example, administering its infrastructure or monitoring its security), the client is the controller and we are the processor. That relationship is governed by the Data Processing Agreement (DPA) — see section 14.
4.3. We are not responsible for processing by third-party services that you use on your own — for example LinkedIn, when you send a link to your profile. Their own policies apply.
5. Your responsibilities
5.1. Read this Policy carefully and make sure you understand your rights.
5.2. Provide accurate data and only what your request needs. Do not send special categories of data (health, religious or political beliefs and the like) through the forms.
5.3. If you send us personal data of other people (for example, colleagues), make sure you have a legal basis to do so and that they are informed. We use such data only for the purpose for which it was provided.
5.4. Keep your own data secure.
6. Data we collect
6.1. We receive data when you fill in a form on the Site, write to us, use the Site or enter into a contract with us, and when we measure Site traffic.
6.2. We process the following categories of data:
• Consultation request: first and last name, company, work email, phone (optional), area of interest, message.
• Job application: first name, last name, phone, email, link to a LinkedIn profile, desired position or area.
• Consent record: date and time of consent and the version of this Policy.
• Correspondence: emails you send us and our replies.
• Contact persons of clients and partners: name, position, work contact details, and the data needed to conclude and perform a contract, issue invoices and settle payments.
• Technical data: IP address and request headers (browser, operating system). Cloudflare processes them to deliver the Site, protect it and run the Turnstile check. To limit the number of submissions we keep a salted hash of the IP address, not the address itself, for 24 hours.
• Usage statistics: Cloudflare Web Analytics counts page views, referring pages, browser, operating system and device type, country and page load times — in aggregated form, without cookies and without identifying visitors.
• Google Analytics — only if you pressed “Accept” in the banner: a random browser identifier in _ga cookies, pages viewed, referring source, device and browser type, language, approximate location (country, city) and actions on the site. Google Analytics 4 does not store IP addresses.
6.3. We do not write names, email addresses, phone numbers or message text to technical logs.
7. Purposes of processing
7.1. Responding to your request and preparing a proposal — we contact you, clarify the task and prepare a proposal. Basis: steps at your request before a contract; legitimate interest.
7.2. Considering your application — we assess it and contact the candidate. Basis: consent.
7.3. Providing services and performing contracts — communication with contact persons, support, notices about changes to the services, fixing faults. Basis: contract; legitimate interest.
7.4. Running and securing the Site — hosting, delivering pages, protection from attacks, spam and abuse of the forms (Turnstile, submission limits). Basis: legitimate interest.
7.5. Improving the Site — analysing aggregated, cookie-free usage statistics (Cloudflare Web Analytics). Basis: legitimate interest. More detailed Google Analytics statistics — only with your consent. Basis: consent (Article 6(1)(a) GDPR).
7.6. Accounting, tax and other legal obligations. Basis: legal obligation.
7.7. Preventing fraud, illegal activity and breaches of this Policy — we may restrict access to the Site where the law requires it or in case of abuse. Basis: legitimate interest.
7.8. We do not take decisions about you based solely on automated processing, do not profile you and do not send marketing emails without your separate consent.
8. Who has access to data
8.1. Within the company — the management and employees of ТОВ «БЕРЕГ-ІТ» who need the data to do their job. They are bound not to disclose personal data that becomes known to them through their work.
8.2. Processors acting on our behalf under data processing agreements:
• Cloudflare, Inc. — Site hosting, protection from attacks, Turnstile, Web Analytics and storage of form submissions (Cloudflare D1);
• Microsoft — Microsoft 365 corporate email, through which the team receives submission notices and corresponds with you;
• Google (Google Ireland Limited, Google LLC) — Google Analytics, only with your consent; advertising features and Google Signals are switched off.
8.3. Public authorities receive data only in the cases and in the manner expressly provided for by law.
8.4. We do not sell personal data and do not share it for advertising.
9. Where data is processed and transfers abroad
9.1. We process data at our office in Kyiv, Ukraine, and through the processors listed in section 8, whose data centres may be located in the European Union, the United States and other countries.
9.2. Transfers to processors abroad rely on contracts that include the European Commission’s Standard Contractual Clauses, or on other mechanisms under Articles 44–49 GDPR, in compliance with Article 29 of the Law.
9.3. If you are in the EU and send us data, it is received by a company in Ukraine. There is no European Commission adequacy decision for Ukraine (Article 45 GDPR), so we apply the safeguards described in this Policy to such data and use it only within our relationship with you.
10. Retention
10.1. We keep personal data no longer than the purpose of processing requires. The period depends on the purpose, periods set by law, contract requirements, and pending or potential disputes.
10.2. Specific periods:
• form submissions in the Site database — 180 days from receipt, then deleted automatically;
• submission notices and correspondence in corporate email — 3 years if no contract is concluded between us; once a contract is concluded — for its term and the periods set by law;
• the IP address hash used to limit submissions — 24 hours;
• contracts, accounting and tax documents — for the periods set by Ukrainian law;
• Cloudflare Web Analytics statistics — aggregated only, with no visitor profiles;
• Google Analytics data — no longer than 14 months; _ga cookies — up to 2 years or until you withdraw consent.
10.3. You can ask us to delete data earlier — see section 12.
11. Cookies
11.1. Cookies are small files that a website stores in your browser.
11.2. The Site does not set its own cookies. Cloudflare Web Analytics works without cookies.
11.3. Google Analytics cookies (_ga, _ga_<ID>) are set only after you press “Accept” in the banner. Until you agree, the Site loads no Google scripts. Your choice is kept in your browser’s storage (localStorage), not in a cookie.
11.4. The Cloudflare Turnstile check runs in an embedded frame from challenges.cloudflare.com and collects technical browser signals only to tell people from bots. If Cloudflare sets a strictly technical security cookie to protect the Site from attacks, it is not used for analytics or advertising.
11.5. You can change your decision at any time with the “Cookie settings” button at the bottom of the page; when you decline, we delete the Google Analytics cookies.
11.6. You can block or delete cookies in your browser settings. The Site will keep working, but the check in the forms may fail.
12. Your rights
12.1. You may choose not to give us personal data. You can browse the Site without it, but without contact details we cannot answer a request.
12.2. Under Article 8 of the Law and Articles 15–22 GDPR you have the right to:
• know the sources from which your data was collected, where it is located, the purpose of processing and the recipients;
• access your data: the categories of data, the purposes of processing, the recipients, the retention period or the criteria for setting it, and your other rights;
• have inaccurate or incomplete data corrected;
• have your data erased (the “right to be forgotten”) if it is no longer needed, is processed unlawfully or you have withdrawn consent;
• have processing restricted;
• object to processing based on legitimate interest, and to direct marketing at any time;
• receive your data in a structured, machine-readable format and pass it to another controller, or, where technically feasible, ask us to transfer it directly;
• withdraw consent at any time;
• not be subject to a decision based solely on automated processing (we do not take such decisions);
• lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights or, if you are in the EU, with the data protection supervisory authority in your country (Article 77 GDPR; the list of authorities is on the European Data Protection Board website, edpb.europa.eu), and go to court.
12.3. To exercise your rights, write to contact@beregit.com or send a letter to our registered address. We may ask you to confirm your identity. We reply within 30 calendar days of receiving the request; if the law allows us to extend this period, we will tell you so and why.
13. Security
13.1. We apply technical and organisational measures in line with Article 32 GDPR and Article 24 of the Law. Data is exchanged with the Site over HTTPS (TLS) only. Only authorised employees have access to submissions. The Site and corporate email run on Cloudflare and Microsoft infrastructure, whose information security management systems are ISO/IEC 27001 certified.
13.2. No method of transmission over the internet is completely secure, so some risk remains.
13.3. If you believe your data has been compromised, write to us immediately. In the event of a personal data breach we notify the supervisory authority and the people concerned in the cases and within the time limits provided for by law.
14. Client data
14.1. When we process personal data on your behalf as part of our services, we act as the processor under the Data Processing Agreement (DPA) published on the Site and the contract with you.
14.2. If you as a client are the controller of personal data, you are responsible for the legal basis for its processing and for informing data subjects. We help you meet these obligations within the DPA.
15. Changes
15.1. We update this Policy when our processing, our services or the law change. The current version is always available on this page; the version number and effective date are shown at the top.
16. Contact
16.1. For questions about this Policy and the processing of personal data, contact BEREG-IT LLC (ТОВ «БЕРЕГ-ІТ»), 17-21 Bahhovutivska St, Kyiv 04107, Ukraine; email contact@beregit.com. You can also use the form on the Contact page.