Rostoria

Privacy Policy

Version: 1.0
Effective date: 8 September 2026

1. Who is responsible for personal data

Rostoria (Individual Entrepreneur Polina Bacho), email: connect@rostoria.co ("Rostoria", "we" or "us"), determines the purposes and means of the personal-data processing described in this Policy.

2. Scope

This Policy applies to rostoria.co, its Russian and English versions, the Insights section, the embedded Google Calendar booking interface, and communications sent through the contact details displayed on the website.

It does not govern independent processing carried out by third-party websites and services after a user visits or interacts with them.

3. Data that may be processed

Depending on how a user interacts with the website, the following data may be processed:

  • technical data: IP address, request date and time, requested page, referring source, browser, device, language and operating-system information, diagnostic logs and security data;
  • analytics data: pages viewed, traffic source, approximate country- or city-level location, interactions with website elements and a pseudonymous device identifier;
  • communication data: email address, name, message content and other information voluntarily sent by email;
  • appointment data: name, contact details, selected time, time zone and answers entered in Google Calendar;
  • business information: details about a company, industry, project, objectives and constraints voluntarily shared in correspondence or during a meeting.

Rostoria does not ask users to submit passwords, payment credentials, health information, biometric information or other special categories of personal data through the website.

4. Sources of data

We receive data:

  • directly from users when they contact us or book a meeting;
  • automatically from the browser and website infrastructure;
  • from Google Calendar when a meeting is booked;
  • from Google Analytics 4 in the form of analytics reports after the user has consented.

Rostoria does not purchase contact databases or collect social-media data through this website.

5. Purposes and legal bases

Data is processed for the following purposes:

  • operating and protecting the website, preventing abuse and diagnosing errors — Rostoria's legitimate interest in maintaining a secure and stable website;
  • measuring traffic sources and content effectiveness through Google Analytics 4 — the user's consent;
  • responding to an enquiry, arranging a meeting and discussing a potential project — steps taken at the user's request before entering into a contract and/or the legitimate interest in conducting business communications;
  • managing a client relationship and performing a contract — necessity for contract performance;
  • complying with applicable accounting, tax and other legal duties — legal obligation;
  • establishing, exercising or defending legal claims — Rostoria's legitimate interest.

Where processing is based on consent, consent may be withdrawn for the future. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

6. Google Analytics 4 and Google Tag Manager

After the user has consented, the website uses Google Analytics 4 to produce statistics about visits and interactions. This may involve cookies and similar technologies, including a pseudonymous browser identifier.

Google Tag Manager is used to manage the website's analytics tags. Rostoria does not use it by itself to build an advertising profile of the user.

In Google Analytics 4, an IP address is used at collection time to determine approximate location and, according to Google, is discarded before the data is logged on Analytics servers. Rostoria does not intentionally send names, email addresses, phone numbers, communication content or other directly identifying details to GA4.

Analytics must not load before consent. Further details are provided in the Cookie Policy.

7. Google Calendar

The home page embeds Google Calendar Appointment Schedule through a third-party <iframe> from calendar.google.com. When the page loads, the user's browser connects directly to Google. Google may receive the IP address, browser and device information and request data, and may use cookies or similar technologies in accordance with its own settings and policies.

If a user books a meeting, Google processes the information entered to provide Calendar, and Rostoria receives the information required to organise and conduct the meeting.

Use of Google Calendar is also governed by Google's terms and Privacy Policy. A user who does not wish to use the embedded calendar may contact Rostoria by email.

8. Recipients

The following recipients may access data only to the extent necessary:

  • Oracle Cloud Infrastructure (Oracle Corporation) — website hosting, server and technical infrastructure; Oracle may engage cloud and network subprocessors;
  • Google Analytics 4 and Google Tag Manager — analytics and tag management after consent;
  • Google Calendar — availability display and meeting booking;
  • Google Workspace — business email and calendar;
  • technical contractors and professional advisers — where necessary and subject to confidentiality obligations;
  • public authorities — only where disclosure is required by applicable law.

Rostoria does not sell personal data.

9. International transfers

Rostoria and its service providers may process data in Georgia, the United States and other countries outside the European Economic Area.

Where applicable law requires specific safeguards, transfers are made using an available lawful mechanism, such as an adequacy decision, standard contractual clauses or another legally recognised basis. Information about Google's transfer mechanisms is available in Google's documentation and Privacy Policy.

10. Retention

  • The cookie choice is retained until the user changes it, removes website data in the browser or Rostoria resets the setting.
  • GA4 event data is retained for 2 months. GA4 user data is retained for 14 months, and the retention period starts again when the user becomes active. These settings do not affect most standard aggregated reports, which may remain available for longer.
  • Initial enquiry and appointment data is retained for up to 12 months after the last substantive contact unless the relationship proceeds to a contract.
  • Client and project records are retained during the relationship and afterwards for periods required by law, accounting duties and the defence of legal claims.
  • Technical logs are retained for the limited period required for security and diagnostics under the settings of the actual infrastructure provider.

Data may be deleted or anonymised earlier when it is no longer required.

11. User rights

Depending on the applicable law, a user may:

  • request information about processing and access to their data;
  • request rectification, completion, erasure or restriction;
  • receive data in a portable format where that right applies;
  • object to processing based on legitimate interests;
  • withdraw analytics consent;
  • lodge a complaint with a competent data-protection authority.

Requests may be sent to connect@rostoria.co. Rostoria may request reasonable information to verify identity. Data will not be erased where continued retention is required by law or necessary for legal claims.

12. Automated decisions

Rostoria does not make decisions based solely on automated processing that produce legal or similarly significant effects for users. Google Analytics statistics are not used for such decisions.

13. Security and confidentiality

Rostoria uses reasonable organisational and technical safeguards, including HTTPS, access restrictions and protected accounts. No method of transmission or storage can guarantee absolute security.

Users should not send passwords, payment credentials, special-category data or third-party confidential information unless necessary and lawfully authorised. The parties may enter into a separate non-disclosure agreement before exchanging sensitive commercial information.

14. Changes and contact

This Policy may be updated to reflect changes to the website, services or law. The current version will be published on this page with a revised date.

Privacy enquiries: connect@rostoria.co.