# BEAUTY FAMILY Privacy Policy
Version 2026-10-13.4

## 1. Who processes the data

The BEAUTY FAMILY Operator is sole proprietor Kozachenko Valeriia Ihorivna, taxpayer identification number 3590800369; address: 37 Nauky Avenue, Kharkiv, Kharkiv Region, 61072, Ukraine; date of state registration: 30 June 2026; email for support, legal enquiries and personal data requests: familylawcompany@gmail.com. The Operator is the controller of data about account owners, contact persons and visitors for its own purposes of service management, security and support.

For a beauty practitioner's client data, the Operator primarily acts as a processor: it processes the data on the documented instructions of the relevant User, who is the controller. The practitioner or institution determines the purpose, legal basis, scope, employee access and professional retention periods. This Policy does not replace the notice that the practitioner must provide to Clients. An online booking request is passed to the selected workspace.

The parties' roles depend on their actual actions, not merely their names in a contract. If the Operator independently determines a separate processing purpose, it bears the corresponding controller obligations. Instructions for processing client data are set out in the addendum to the Terms.

This Policy also applies to people who write to a business's connected Instagram or Telegram, even if they have not registered in the CRM. The relevant business or professional is the controller of that correspondence, and the Operator processes it on their instructions to provide the service. The Operator's role for its own support and security purposes is determined separately. Meta and Telegram process data on their platforms under their own rules and are not automatically processors for all of the Operator's operations.

Whether the GDPR applies is determined under Article 3 of Regulation (EU) 2016/679 for the particular activity, including whether there is an establishment in the EEA, services are directed at individuals in the EEA or their behaviour there is monitored. Citizenship alone, website accessibility from the EU or choosing European storage does not decide the issue. Instructions from a User subject to the GDPR are also carried out with regard to that User's contractual requirements. The general data protection contact is familylawcompany@gmail.com; where an EU representative or DPO is mandatory, the Operator appoints one and publishes the relevant contact details before that processing begins.

## 2. What data is received

For an account: name, email, Google identifier, role, workspace membership, settings, activity, access period and access status. For a business profile: business name, tax and contact details, licence information if entered, logo and operating settings. Ordinary Google sign-in does not disclose the password or grant mailbox access.

Client data may include full name, phone number, email, date of birth, representative details, appointment and service history, questionnaire answers, allergies, contraindications, health information, products and anaesthesia used, before-and-after photographs, agreements, service orders, notes and messages. The fact of booking a particular procedure may itself reveal sensitive information. An uploaded original file may contain additional metadata; the User checks it before uploading and does not add unnecessary information.

Access information: plan, term, mode and status of access. Subscription payments are not activated in this version; the service does not collect full card details, PINs or CVVs. Financial records concerning services the User provides to Clients, if entered, form part of client data.

Technical data: IP address and request characteristics in infrastructure and bot protection, browser and device, operation time, and identifiers for sessions, permissions, errors and security checks. Support enquiries contain the text supplied by the requester; medical secrets and non-anonymised photographs should not be included.

To demonstrate acceptance of documents, the system retains the account identifier, email, text version and checksums, date and time, and three confirmations: acceptance of the Terms, acknowledgement of the Privacy Policy and confirmation of responsibilities for client data. The IP address and full browser header are not added to this record; infrastructure logs may process technical data separately.

A data request contains the requester's identifier and email, the selected action, any clarification supplied, the reference number, dates, status and the Operator's response. Requesters see their own requests; the platform administrator can access them for handling. Medical information, case materials, passwords and keys should not be included in a request. Minimum information about the request and its fulfilment is retained to handle it and demonstrate compliance with legal obligations under the criteria in section 8.

Social channels: channel type, the identifier of the connected account or bot, its available name, the connection identifier, who connected it and when, permission status and an encrypted key. Conversations retain platform identifiers of correspondents and messages, available names and usernames, incoming and outgoing message text, times, direction, technical sending status, the assigned employee, read markers in the CRM and links to client records. A technical label may be used as the name if the platform does not supply one.

A contact voluntarily shared in Telegram may contain a phone number; this does not automatically verify identity. When creating a record from a conversation, the employee checks the name and enters a phone number if necessary. Correspondence alone does not enable marketing consent or email reminders. Connecting Instagram does not give the service the correspondent's password, email address, phone number or access to their entire profile merely because correspondence takes place.

The current adapter does not download attachment files from social channels; it stores an attachment marker and, where available, a text caption or contact. Ordinary documents uploaded by the User through other CRM features are governed by the relevant provisions of this Policy.

## 3. Sources, purposes and legal bases

Before creating a client record, linking correspondence or entering client materials, the User obtains separate informed consent to processing in BEAUTY FAMILY, retains evidence of it and observes professional secrecy. The minimum response necessary to an initial voluntary enquiry about a service may rely on an appropriate basis of preparing a contract at the person's request, provided that advance information has been given. This does not constitute consent to all subsequent actions. The limits of an initial enquiry and the User's responsibilities are defined in section 6 of the Terms.

Data is received from the User, their authorised employees, the Client through online booking, a file imported by the User, and Google and connected providers within the granted permissions. Importing data does not automatically confirm that it was originally obtained lawfully.

Account, access and selected-feature data is processed to conclude and perform the agreement. Security, preventing misuse and protecting rights in a specific dispute rely on an appropriate legal basis, with an assessment of necessity, proportionality and the person's rights.

For client data, the relevant controller determines the legal basis and the Operator carries out lawful instructions. Special categories, including health data, require an applicable condition under the special protection regime; a contract with the practitioner or the practitioner's clicking ‘I agree’ does not itself constitute sufficient client consent.

Where consent is used, it must be freely given, specific, informed and properly evidenced. Withdrawal does not affect the lawfulness of prior processing; further processing is possible only on another appropriate basis. Advertising campaigns are not a mandatory condition of using core features.

Social channel data comes from the correspondent through authorised Meta or Telegram APIs and events, and from the employee who replies or links a conversation to a record. The purposes are receiving and handling enquiries, responding, arranging a requested consultation or appointment, and maintaining a history of business communications. Account access or OAuth permission from the channel owner does not constitute consent from all correspondents.

The Operator does not use social correspondence to sell data, create advertising profiles, transfer it to data brokers, assess creditworthiness or train AI models. Telegram Business information is not used for purposes unrelated to the requested business messaging features. External recipients and international transfers are described below; connecting a channel does not authorise arbitrary disclosure of content to other services.

Where the GDPR applies, the Operator relies on Article 6(1)(b) for an individual's own account and requested service only to the extent necessary for the contract; Article 6(1)(c) for mandatory record-keeping where a specific obligation exists; and Article 6(1)(f) for necessary security, abuse prevention and business contacts of organisational representatives after checking necessity and balancing interests. Optional actions based on consent are kept separate and consent may be withdrawn. The basis for processing client data on instructions is determined by the relevant controller, not automatically by the Operator's contract with the business.

Special categories require both an appropriate basis under Article 6 and a condition under Article 9 of the GDPR. Where consent is used, it must be explicit; a healthcare exception does not arise merely from a practice being described as a beauty practice. For material relating to legal claims, the applicability of Article 9(2)(f) is assessed within the limits of necessity. Data concerning criminal convictions and offences is separately subject to Article 10; ordinary consent or a contract is not sufficient to bypass its requirements.

The service's requirement for separate consent to a client record does not replace checking that the consent is freely given and the legal basis is appropriate. Optional advertising purposes must not be a condition of the main service. Withdrawal must be as accessible as giving consent; the previously stated basis must not be arbitrarily replaced after withdrawal. Where no appropriate basis exists, the relevant data must not be entered into the service.

## 4. Medical confidentiality and clinical decisions

Information about seeking care, health status, examinations, intimate and family life, and other information protected by law may constitute a medical secret. Restricted access applies; transfer for technical processing does not make the information public. The User must check the bases for processing and for each person's access. A minimal initial enquiry is handled under the special procedure in section 6 of the Terms; this does not remove professional secrecy requirements.

The service does not make diagnostic decisions, prescribe treatment or determine which method or product a particular patient needs. Catalogues and reference materials are for information only. Treatment is prescribed by an appropriately qualified physician within the medical practice of a sole proprietor or institution holding a valid Ukrainian Ministry of Health licence.

The Operator does not use clinical content for advertising, sales, patient assessment or AI model training. Aggregated statistics are permissible only where properly anonymised; replacing a full name with an identifier does not in itself guarantee anonymity.

## 5. Who has access and what encryption means

The workspace owner and employees authorised by them receive data according to their roles. They must not have access to other workspaces' data. Through the standard panel, a system administrator sees accounts, plans, activity and technical indicators; the panel does not expose client records, questionnaires, photographs or documents from other workspaces. Messages deliberately sent to support are accessible to the relevant support employees.

Connections are protected by HTTPS, and the server checks access to private files. Integration secrets are protected separately. Private storage access, provider-managed encryption and SHA-256 integrity checks do not mean end-to-end encryption with a key held only by the User. Backups may contain operational data and require the same restricted access. Long-lived Gmail and Drive access keys in the live database are encrypted with a separate server key; this protection does not mean that an authorised technical administrator with access to that key cannot decrypt them.

When performing its functions, the live server processes questionnaires, documents and other operational data in readable form. Direct privileged access to the database, storage or server keys may technically allow data to be read. The service therefore does not currently claim end-to-end encryption, ‘zero knowledge’ or an absolute technical inability of the infrastructure operator to access data.

Permitted technical access must be limited to a specific purpose, the necessary scope and authorised persons, with confidentiality and documentation. A system administrator role does not authorise arbitrary inspection of client data. A lawful request from a competent authority is checked for authority, procedure and scope; it does not mean unrestricted access to all workspaces.

The workspace manager grants social channel access to specific authorised employees. Linking a conversation to a record does not create a CRM account for the correspondent or grant access to other clients. Social channel keys are encrypted separately on the server. Correspondence text is processed by the live server and stored in the database; this is not end-to-end encryption between correspondents with keys held only by them.

## 6. Providers and international transfers

The service runs on Cloudflare infrastructure: Workers performs server operations, D1 stores the database, and R2 stores private files and backups. The former Sites hosting is not used for new User activity; residual copies following migration may be retained with restricted access to bring the transition to a controlled end. Setting R2's jurisdiction to Europe does not mean that all computing, logs or providers are located exclusively in the EU.

Google provides sign-in. Gmail and Google Drive are connected separately: with the User's permission, they process email recipients and text, or document files and their metadata. Disconnecting an integration stops new transfers through that feature but does not automatically delete emails or files already delivered. The User also manages them within Google.

Google sign-in requests openid, email and profile: the service uses the Google identifier, verified email address and name for sign-in and account recognition. Google may include a profile picture in the profile information provided; it is not needed to work with client data. The service does not receive the Google password. Gmail separately requests https://www.googleapis.com/auth/gmail.send to send email; access to read incoming mail, search the mailbox or retrieve the address book is not requested. Connection details, an encrypted long-lived access key and necessary operation statuses are retained. BEAUTY FAMILY also requests https://www.googleapis.com/auth/drive.file. This permission is limited to files created by the app or explicitly made available to it by the User and does not expose the entire drive. The current feature creates a Beauty Family folder, exports generated PDFs and Word files, and checks their identifiers, names, types, folder membership and status. Folder and file identifiers, names, links and save results may remain in document history.

Use and transfer of information received from Google APIs are limited by the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy, including Limited Use; the Operator undertakes to comply with them. Data is used for features explicitly selected by the User. Selling data, transferring it to data brokers, advertising profiling, credit assessment and training or improving non-personalised AI or machine learning models are prohibited. Policies: https://developers.google.com/terms/api-services-user-data-policy and https://developers.google.com/workspace/workspace-api-user-data-developer-policy.

To protect online booking requests, Cloudflare Turnstile processes information including the IP address, browser and connection characteristics, widget key and website address. Cloudflare processes these signals on instructions to protect the website, and also in an independent role under its own rules to improve its bot protection. Details: https://www.cloudflare.com/turnstile-privacy-policy/. The service does not send SMS messages. Payment integrations are not activated; before they are launched, the Operator will provide separate information about the recipient, data and purposes.

Transfers are made only to necessary recipients, for defined purposes and on an appropriate basis. For international transfers, the Operator and the relevant controller provide safeguards under Article 29 of Ukraine's Law ‘On Personal Data Protection’ and, where the GDPR applies, its transfer rules as well. Merely publishing a list of providers or generally accepting the Policy does not replace the necessary legal safeguards.

New use of data for an incompatible purpose, or transfer to a new recipient that materially changes the risk, requires prior notice and an appropriate legal basis. A change of business ownership does not make the data a commodity for arbitrary use: the successor must respect the stated purposes, individuals' rights and appropriate safeguards.

Google's restrictions also apply to derived and aggregated data and to the Operator's employees, contractors and successors. Human access is permitted only with specific documented consent for particular data, or in other narrow cases allowed by Google's rules, including security or legal compliance. Ordinary support and general acceptance of the Terms do not themselves grant that permission.

An additional restriction applies to information received from Google APIs: transfer in a merger, acquisition or sale of assets requires the relevant Google user's prior explicit consent. A general change-of-ownership clause, notice of a new Policy or silence does not replace that consent.

Under rules enabled by the User, the server may perform authorised operations while the browser is closed: send reminders and other agreed emails and export new documents to Drive. It uses a protected long-lived Google access key for this purpose. Email recipients and Google receive the sender's address, recipients, content and service information necessary for sending; Cloudflare technically processes these to perform the server function. Export also sends Google the content of the selected document, which may contain client data; the owner of the connected drive controls subsequent file access. The User chooses the settings and ensures that a basis exists for transferring client data.

Connecting Gmail and Drive is voluntary. Refusing or revoking a permission limits the dependent feature and does not entitle the Operator to demand unnecessary permissions. Other available features remain accessible according to the role and plan. Google sign-in and access to individual APIs involve separate permissions.

Agreements with processing providers must establish protection no lower than that required by this Policy and applicable law. The Operator checks the relevant obligations and is not relieved of its own liability by engaging a provider. Google and Cloudflare may also act as independent controllers for their own functions described in their policies: https://policies.google.com/privacy and https://www.cloudflare.com/privacypolicy/.

Meta / Instagram provides professional account authorisation and messaging. The service requests instagram_business_basic and instagram_business_manage_messages to identify the connection and work with authorised correspondence. When replying, it sends the recipient identifier and text to Instagram; Meta processes them under its platform rules. Other permissions are not deemed granted merely by accepting this Policy. Meta terms: https://developers.facebook.com/terms/ ; Meta privacy policy: https://www.facebook.com/privacy/policy/ .

Telegram provides messages and sender information that the bot is authorised to receive; for Telegram Business, the business account owner's chat selection and permissions apply. The service sends Telegram the recipient, reply text and required connection identifiers. Data necessary to perform these functions is sent to Cloudflare as the service's infrastructure. Terms: https://telegram.org/tos/bot-developers ; privacy policy: https://telegram.org/privacy .

Messages may be received and processed by the server in the background. An active Instagram key may be refreshed to maintain an authorised connection. Disconnecting a channel stops its further use in the CRM; external permissions and retained data are managed separately. The service's Policy does not replace Meta, Telegram or Google rules or extend their permissions.

For transfers covered by Chapter V of the GDPR, before a transfer begins, the Operator and the relevant exporter check the country, recipient and lawful mechanism: a current applicable adequacy decision or appropriate safeguards, including properly concluded standard contractual clauses with a transfer assessment and supplementary measures where necessary. Article 49 derogations are not a general basis for ongoing cloud processing. Remote access from another country is also considered. On request, information about the safeguards used, or a copy of them, is provided with permitted protection of other people's rights and confidential information. This Policy is not itself SCCs and does not confirm that they have been concluded.

Cloudflare infrastructure is engaged as the Operator's subprocessor for technical storage and execution of client processing instructions. Google's role depends on the particular feature and the agreement for the relevant account; Meta and Telegram retain their own roles in relation to their platforms. On request, the Operator provides a current list of the legal entities engaged, their functions, processing locations and transfer safeguards; a brand name alone does not replace checking the contract with the particular entity.

## 7. Cookies and data on your device

The service uses necessary authentication and security mechanisms. The __Host-fb-session cookie maintains a session with a rolling inactivity period of up to 30 days; explicit activity may extend it. The __Host-fb-google-flow cookie lasts up to 10 minutes to complete sign-in. The service may change technical names without changing the purpose or previously stated duration. Email and drive connections also use short-lived __Host-fb-gmail-flow and __Host-fb-drive-flow cookies, each lasting up to 10 minutes.

localStorage holds certain interface settings, such as hiding the initial tip. sessionStorage is used for navigation state, reminders and recovery of unsaved changes after session problems. Such a draft may contain personal data and is stored on the device; signing out, clearing browser data and using a protected personal browser profile matter. Older local demo versions may contain a previous dataset for import.

Advertising trackers and optional analytics must not be enabled solely on the basis of this Policy. If they are added, the Operator separately explains their components, purposes and controls and obtains consent where required. Disabling all cookies may prevent sign-in. A third-party site's rules apply after you follow a link to it.

## 8. Retention, deletion and backups

Account and workspace data is retained while the relevant features are provided and, after termination, only for a specific lawful purpose: completing an export, fulfilling a mandatory record-keeping period, appropriately limited backup retention or protecting rights in an identified dispute. Indefinite retention ‘just in case’ is not a purpose in its own right.

The controller of client data determines mandatory professional retention periods according to the type of document and applicable law. This Policy does not impose a single arbitrary period for all medical documents. Where immediate destruction is not legally possible, the Operator explains the justified reason and the scope of deferred deletion.

Deleting a record in the interface does not mean immediate physical erasure of all files and backups. Automatic deletion of every backup archive after a single fixed period has not been implemented. The Operator handles full deletion requests separately, checking live records, files, archives and residual copies from the previous hosting. Archives are not used for ordinary operations or new purposes. This does not permit indefinite retention without a lawful need; the requester is informed of the specific reasons and period for deferred deletion.

After receiving a proper deletion request, the Operator and the controller coordinate the live data, documents, private files, backups and transferred copies; unnecessary residual data is isolated from ordinary use. Restoring a backup must reapply lawful deletion requirements. Emails held by recipients, downloaded files and copies in the User's Google Drive are not under the Operator's exclusive control.

Acceptance records for the Terms are retained during use and afterwards only to the extent necessary to demonstrate the legal relationship, comply with law or protect rights in a specific dispute. The period is determined by the relevant purpose and applicable limitation period; once the grounds cease to exist, the data must be deleted or anonymised. Contact the Operator to ask about retention periods for particular data.

After separate confirmation, ‘Disconnect and revoke access’ removes the working key from the workspace and sends Google a revocation request. Google revokes that Google account's permissions at the level of the entire Google project; this may affect other integrations, workspaces and OAuth clients in the project. Gmail and Drive connections for the same Google account in the current workspace are disconnected together. An operation already submitted to the provider may complete; delivered emails and created files do not disappear automatically. Google's result is displayed separately from local disconnection.

After Gmail or Drive is disconnected, the live connection record is cleared of the key, email, Google identifier and OAuth connection data. For Drive, automatic export is disabled and unfinished jobs are cancelled. Email history, folder and file identifiers, links and results of earlier exports may remain until a separate lawful deletion.

Revoking Google's permission, deleting its data from the service, ending a session and closing an account are separate actions. Instructions for managing them are available without signing in at https://beauty.familylawcompany.online/data-controls. Data is cleared from backups under the rules in this section; restoration must not reinstate revoked access or reverse fulfilled deletion requests.

If Google is temporarily unavailable, the key and Google identifier are retained in a separate encrypted job solely to retry revocation. Up to four attempts are provided, within a retry period of up to 24 hours. A new active connection to the relevant Google account stops the deferred automatic retry. After confirmation, a final error or expiry, the encrypted content is removed from the active job; expired jobs are cleaned up in the next functioning maintenance cycle, scheduled every 15 minutes. Where manual completion is necessary, the service states this explicitly and provides https://myaccount.google.com/connections. Retention periods for copies in backup archives are governed separately by this section.

To protect action confirmation, the service stores derived values of the one-time code, session, context and expiry. The code is valid for 10 minutes and can be used once; expired records are removed by background maintenance. Technical logs of integration confirmations and completed revocations are retained in the active database for up to 180 days and deleted in the next functioning cycle. They contain the account, action type, explanation version, time and result, without plaintext keys or email/document content. This rule does not change the separate retention periods for acceptance records, requests or client documents.

For social data, retention is limited to the needs of a particular enquiry, agreed service or documented lawful retention. Once an initial enquiry is concluded, the need ends, a proper request is received from the person or platform, or the relevant feature is discontinued, unnecessary data is deleted without undue delay. The Operator and controller must determine and document a specific period for each justified exception; this section does not establish indefinite retention.

The current module does not include an automatic timer to erase all social conversations. Disconnection removes the active key but leaves correspondence, channel data, linked records and logs; these are deleted separately through the request procedure. The Operator tracks fulfilment and reviews the need for residual data. Merely marking a conversation ‘Closed’ or unlinking a record does not constitute deletion.

Deleting a message in an external application does not guarantee simultaneous deletion of all CRM copies. Available Telegram Business deletion events may clear the text of the relevant message; this is not equivalent to deleting the entire conversation, contacts or backups. Submit a separate request to obtain verified deletion of data from the service. Restoring a backup must not reverse completed deletion.

## 9. Individuals' rights and requests

Individuals may obtain information about and access to their data, request correction, deletion or restriction of processing, withdraw consent and object in cases provided by applicable law. Exercising a right is not limited to the presence of a button in the CRM; if the required feature is unavailable, contact the Operator.

Contact the Operator about your own account and the practitioner or institution acting as controller about a medical record. If a request reaches the wrong party, it is directed to the appropriate recipient within the law. Before disclosure or deletion, the requester's identity and authority are verified proportionately; a passport scan should not be sent unnecessarily.

Requests are handled within statutory time limits. Requests under Ukrainian law follow the time limits it provides; GDPR requests follow the separate rules below. Justified restrictions are explained to the requester. Individuals may contact the Ukrainian Parliament Commissioner for Human Rights or a court and, where foreign law applies, the relevant authority. Withdrawing advertising consent does not stop mandatory security communications.

To obtain a copy, correct or delete data, or close an account, you may submit and track a request at https://beauty.familylawcompany.online/data-controls/requests or email familylawcompany@gmail.com. Specify the service, account email and precise scope of the request; Google data may be identified separately. The form requires a valid sign-in but not acceptance of new Terms; email requests are available without signing in. Do not provide secrets or unnecessary client data. Receipt of a request does not mean automatic erasure: the Operator verifies identity, authority, dependent data and retention grounds and communicates the result.

An Instagram or Telegram correspondent may email familylawcompany@gmail.com without registering in the CRM, signing in with Google or accepting the Terms. It is sufficient to identify the service, channel, business account or bot involved, your available identifier and the scope of the request. Do not send a password or the full conversation. If needed, the Operator will propose a minimum proportionate way to confirm control of the account and communicate fulfilment or justified restrictions. A requester's lack of an internal CRM ID is not, by itself, a reason for refusal.

Under the GDPR, a request is answered without undue delay and within one month of receipt. Because of complexity or the number of requests, this period may be extended by a further two months, with reasons notified within the first month. Requests are generally free of charge; the responsible controller bears the burden of justifying a lawful refusal or fee for a manifestly unfounded or excessive request. Additional identification information is requested only where there are reasonable doubts and proportionately.

Portability under Article 20 of the GDPR applies to data provided by the individual and processed by automated means on the basis of consent or a contract: it is supplied in a structured, commonly used, machine-readable format and, where technically feasible, transmitted to another controller. It is not a right to other people's data or an entire business database. Direct marketing stops following an objection; other objections are assessed under Article 21. Restrictions or refusals are communicated with reasons and available means of challenge.

Where the GDPR applies, a complaint may be lodged with a competent supervisory authority, including in the place of habitual residence, work or the alleged infringement, and proceedings may be brought before a court. A prior complaint to the Operator is not a mandatory condition of doing so.

Where Article 19 of the GDPR requires it, recipients to whom data was disclosed are notified of rectification, erasure or restriction, except where this is impossible or involves disproportionate effort. On request, the individual is informed of those recipients. Restricted data is marked and must not return to ordinary use contrary to the restriction.

## 10. Children, automation and public information

Independent professional accounts are intended for adult Users. The current version's main documents are intended for adult Clients; the User must not enter a false date of birth or apply unsuitable forms to a minor. Any future processing of children's data requires an appropriate lawful scenario and the representative's rights.

The service automates technical operations: searching, completeness checks, schedule conflicts, payment records and access. It does not make automated medical prescriptions, assess health for insurance or decide on treatment without a physician. An erroneous technical restriction may be challenged with the Operator.

Client data and photographs are not published merely because a workspace is created. Through online booking, the User deliberately publishes selected information about their practice and services. The public page must not expose other clients' information or questionnaire content.

The service does not provide for solely automated decisions about an individual with legal or similarly significant effects within the meaning of Article 22 of the GDPR. A technical access error can be referred for human review. If a different scenario is introduced, information about its logic, significance and consequences must be provided beforehand, together with appropriate rights and legal bases.

## 11. Security and incidents

The Operator maintains proportionate technical and organisational measures: authentication and permission checks for each action, workspace isolation, private file access, protection of secrets, change control and backups in line with the actual configuration. Questionnaire and document contents must not enter ordinary diagnostic logs. The complete absence of incidents is not guaranteed.

Once the Operator becomes aware of a personal data breach affecting workspace data, it notifies the relevant controller without undue delay, describes the known nature, possible consequences and measures taken, and supplements the information as facts emerge. The parties notify public authorities and individuals in the cases and within the periods required by applicable law. The general GDPR time limit is not presented as a universal time limit under Ukrainian law.

The User protects devices, their Google account and exported files, limits employee access and does not transmit medical data through insecure channels. These duties do not remove the Operator's own security obligations.

Where the GDPR applies, the processor notifies the controller of a breach without undue delay. The controller assesses the risk and, where notification is required, informs the competent authority without undue delay and, where feasible, within 72 hours of becoming aware, explaining any delay. Where a high risk is likely, individuals are notified without undue delay, subject to lawful exceptions. Not having all details is not a reason to wait until the investigation is complete: information may be supplemented. The breach, risk assessment and measures taken are documented.

## 12. Changes and contact details

The Policy states its date and version. Material changes to purposes, categories, recipients, processing locations or safeguards are communicated in advance, except for urgent changes required by law or to protect security. A new version does not legitimise a previous breach or replace any necessary new consent.

Requests concerning data, privacy, security, export and account closure: familylawcompany@gmail.com. Provide contact details for a response, the service name and the substance of the enquiry; do not include medical documents, case materials or passwords unnecessarily. The Operator verifies the requester's identity and authority proportionately.

Before using Google data for new purposes beyond those previously communicated, the Operator provides a separate explanation and obtains any necessary explicit consent. Previous acknowledgement of the Policy does not automatically extend to new permissions, purposes or recipients requiring fresh consent.

This version adds information about Instagram, Telegram and linking conversations to client records. The public text is accessible to correspondents without signing in. A material new purpose or new scope of processing is not applied retrospectively and requires prior information and an appropriate basis; merely continuing a conversation is not universal consent.

## 13. Additional transparency under the GDPR

Where data is obtained from the individual, the required information is provided at collection; where it is obtained from another source, it is provided within a reasonable period and no later than one month under Article 14 of the GDPR, including no later than the first communication or first disclosure if either occurs sooner. Exceptions require separate justification. The User informs their Clients about sources, categories and the User's own purposes; this page does not replace the business's individual notice.

Account data needed for sign-in and verification of authority is necessary to provide access; without it, the relevant feature is unavailable. Social channels, Gmail and Drive are connected separately: refusing their permissions does not constitute consent to other purposes. A phone number is optional in the form for creating a client from a conversation. The necessity of other fields depends on the selected service and lawful instructions, not a desire to accumulate more data.

The Operator assesses risks, limits access and collection by default, and periodically reviews protection. If processing is likely to create a high risk, an impact assessment is conducted before it begins; where a high residual risk remains, prior consultation with the competent authority applies. Publishing this Policy alone does not replace these measures.