Privacy Policy

Controller

FOP Mandrievskiy Sergey Valentinovich (RDG Studio), Tax ID 2470720575. Data requests: info@rdg-studio.com.

Data

• Name, email, contact, language, enquiry, and source.
• Files, metadata, project materials, correspondence, and access credentials.
• Order ID, amount, currency, payment or refund status, customer type, country, and business registration details without full card data.
• Terms and scope version and hashes, consent records, technical holds and manual delivery releases, and the version-and-consent audit log.
• For withdrawal: full name, contract/order ID, the supplied contact email for confirmation, statement, timestamp, and IP hash.
• Form-abuse prevention data, security logs, and IP data to the extent necessary.

Purposes and legal bases

Replies and pre-contract steps rely on the person’s request; order performance, payment, and refund rely on the contract; accounting and other mandatory records rely on legal duties; security, backups, abuse prevention, and legal claims rely on legitimate interests in safe operation and evidence, balanced against the person’s rights. Optional marketing or other consent-based processing does not begin without separate consent; consent may be withdrawn without affecting earlier lawfulness. RDG Studio does not make solely automated decisions with legal or similarly significant effects.

Required and optional fields

A working email is required for a reply; marked Checkout data and an agreed scope are required for a paid order; B2B registration details are required for B2B; full name, contract/order ID, email, and unequivocal statement are required for online withdrawal. Details, uploads, and early-start/digital-supply choices are optional; their consequences are shown before payment. Without required data, the relevant action cannot be completed.

Recipients and international transfers

Where necessary, data is received by Besthosting, Google as email provider, LiqPay/PrivatBank for payment, the relevant bank, and project contractors. Materials are sent to an external AI service only for work agreed in writing. Before materials are uploaded, the order identifies the actual external service or recipient category and, where applicable law requires it, the destination country and transfer safeguard, including an adequacy decision or Standard Contractual Clauses.

Portfolio

After the project has been publicly launched, and only within the contractual portfolio permission, RDG Studio may display the already-public result, public project name, and Customer logo. Personal data, non-public versions or materials, access credentials, internal correspondence, and other confidential information are not published. A written Customer objection received before portfolio publication is respected. Customer contact data is not used for marketing without separate consent.

Retention and deletion

Project materials are kept only while preparing and performing the agreed work, delivering the result, providing a paid Care period, and resolving a reproducible technical defect or active claim. They are then deleted or irreversibly anonymised without undue delay unless longer retention is required by law or for a specific legal claim. Supplied passwords and other access credentials are deleted after delivery and verification, or earlier at the customer’s request where this does not prevent agreed work. Order, payment, refund, terms-version, and consent records are retained only for mandatory accounting, tax, and limitation periods. No marketing database is created without separate consent; backup data is removed in the ordinary secure overwrite cycle.

Rights, complaint, and security

Access, correction, deletion, restriction, portability, objection, withdrawal of consent, and other applicable rights can be requested at info@rdg-studio.com. In Ukraine, a complaint may be lodged with the Ukrainian Parliament Commissioner for Human Rights; where the GDPR applies, a complaint may also be lodged with the competent authority in the EEA country of habitual residence, work, or the alleged infringement. A request should come from the associated email or pass a proportionate identity check. HTTPS, access control, backups, and data minimisation are used; incidents are notified where required.