Effective date: 08.08.2026 Last revision: 08.08.2026
1. Who processes your data?
The personal data controller (person responsible for the treatment) is:
Mykhailo Brych, autónomo (self-employed entrepreneur, Spain)
Email: mail@ucranianos.es
Website: https://ucranianos.es
Ucranianos.es is an information service for Ukrainians in Spain: articles and guides, a catalog of Ukrainian businesses and services, paid bonus materials.
For any questions regarding your data, please write to mail@ucranianos.es — we respond to all requests.
2. What data do we collect?
2.1. Data you provide yourself
When registering an account: email, name (or nickname), password (stored in encrypted form - we cannot see it and cannot recover it).
When logging in via Google: Your email, name, and Google Account ID. We do not access your email, contacts, or other Google data.
When paying for paid services: email, service name, amount, date, Stripe payment session ID. We do not receive or store your bank card details. — they are processed directly by Stripe.
When adding an ad to the catalog: name of the business or service, description, region and city, contacts that you specify yourself (phone, email, messengers, social networks, address, working hours). This data is published on the website and is publicly available. — only indicate what you are ready to show everyone.
When commenting: comment text, name from your profile, IP address, and browser data (standard WordPress spam protection mechanism).
When filling out contact forms: email, phone number (if specified), text of the appeal.
When corresponding with us: the content of the letters and your sender address.
2.2. Data collected automatically
Server technical data: IP address, browser and device type, request time, referring page. Stored by the hosting in service logs and required for the operation and security of the site.
Analytics and advertising: data on page views, referral source, visit duration, and interaction with advertising. Collected only with your consent (see chapter 7).
3. Why do we process data and on what basis?
| Goal | Legal basis (GDPR) |
|---|---|
| Account creation, login, office work | Contract performance (Article 6.1.b) |
| Providing paid access, confirming payments, reminding about the end of access | Contract performance (Article 6.1.b) |
| Invoicing, accounting and tax accounting | Legal obligation (art. 6.1.c) |
| Publishing your ad in the directory | Performance of the contract / your consent (art. 6.1.b, 6.1.a) |
| Posting comments | Your consent (art. 6.1.a) |
| Responses to requests and support | Legitimate interest (art. 6.1.f) |
| Protection against spam, fraud, abuse; site security | Legitimate interest (art. 6.1.f) |
| Traffic analytics (Google Analytics) | Your consent (art. 6.1.a + art. 22.2 LSSI) |
| Display of advertising, including personalized advertising (Google AdSense) | Your consent (art. 6.1.a + art. 22.2 LSSI) |
| Email newsletters and marketing letters | Your consent (art. 6.1.a) |
We do not make automated decisions that would have legal consequences for you. Profiling only occurs within Google's advertising services and only if you have consented to it.
Providing data is voluntary. However, without an email and password, it is impossible to create an account, and without an account, it is impossible to purchase paid access or place an ad.
4. To whom is the data transferred?
We do not sell your data. Data is transferred only to services without which the site does not work (they act as processors on our behalf or as independent managers in their part):
| Service | For what? | Where is it located? |
|---|---|---|
| Hostinger | Website and database hosting | EU |
| Stripe Payments Europe, Ltd. | Payment processing, invoices | Ireland (EU), group — USA |
| Google Ireland Ltd. | AdSense (advertising), Analytics, Tag Manager, Google login | Ireland (EU), group — USA |
| SendPulse | Email mailings, delivery of business letters, CRM for form requests | USA / EU |
| Cloudflare, Inc. | Turnstile — form protection against bots | USA |
In addition, data may be disclosed to government authorities when expressly required by law, or to our professional advisors (accountant, lawyer) within the scope of their confidentiality obligations.
Transfers outside the EU
Some of the services listed above belong to groups of companies from the United States. Such transfers are made on the basis of mechanisms provided for in Chapter V of the GDPR: the European Commission's adequacy decision (EU–US Data Privacy Framework) and/or standard contractual clauses (SCC) with additional safeguards.
5. How long we keep data
- Account details — as long as your account exists. After deleting your account — deleted, except for what we are required to keep by law.
- Payment data, invoices, fiscal documents — at least 4 years (Spanish tax law), accounting records — up to 6 years. 🔸 clarify in the history
- Advertisement in the catalog — while published; after the ad is deleted — they are removed from the site.
- Comments — until published or until you request their removal.
- Log of sent business letters — up to 12 months (needed to resolve delivery issues).
- Analytics data — according to the terms set in Google Analytics (by default up to 14 months).
- Server service logs — depending on the hosting policy, usually several months.
- Data from contact forms — while the correspondence continues and for a reasonable time after it.
6. Your rights
You have the right:
- access to your data and a copy of what we store;
- to correct inaccurate data (some can be changed independently in the office);
- remove data («right to be forgotten»);
- restrict processing or to deny against her;
- get your data in a machine-readable format (tolerance);
- withdraw consent at any time - this does not affect the lawfulness of the processing before the withdrawal.
To exercise your rights, write to mail@ucranianos.es.
The exercise of rights is free of charge. We respond within one month. To ensure that the data owner is the one contacting us, we may ask you to confirm ownership of the email address associated with the account. We do not require copies of your passport or other documents.
7. Cookies and consent
Cookies are small files that a website stores in your browser. We use:
Required (always work, no consent required): saving login session, form security, protection against bots, remembering your cookie choices.
Analytical (only with consent): Google Analytics — anonymized traffic statistics to understand which materials are useful.
Advertising (only with consent): Google AdSense and its partners - displaying advertising, including personalized advertising, frequency capping, performance measurement.
How do you manage consent?
On first visit, visitors from the EEA, UK and Switzerland will see a consent window - this is Google's certified consent management platform (TCF v2.2). Until you consent, analytical and advertising cookies are not installed (Google Consent Mode v2 technology).
If you opt out of advertising cookies, advertising on the site will still be displayed, but it will be impersonal — will be selected based on the topic of the page, not your interests.
You can also delete or block cookies in your browser settings - the "Privacy" section in Chrome, Firefox, Safari or Edge. Please note: blocking all cookies will make it impossible to log in to your account.
8. Security
The site operates over a secure HTTPS connection. Passwords are stored only in encrypted form. Access to the administrative part is protected and limited. Payment data is processed by Stripe according to the PCI DSS standard - it never reaches our server.
However, no data transmission over the Internet is completely secure. Please keep your password safe: we never ask for it in emails or messages.
9. Children
The Service is not intended for persons under the age of 14. We do not knowingly collect data from children. If you believe that a child has provided us with their data, please write to mail@ucranianos.es — we will remove them.
10. Links to other sites
The site contains links to third-party resources, including websites and social media of businesses from the directory. We do not control their privacy policies and are not responsible for the data processing on these resources.
11. Changes to this policy
We may update this policy. The current version is always available on this page with the date indicated. Registered users will be notified by email of any significant changes.
