RazomGroup +380 63 443 02 17 Book a call

Privacy Policy

Version dated 28 October 2026

Who we are

This policy explains how RazomGroup (“we”) processes personal data. We are the controller and are responsible for the processing described below, except where this policy states that another company processes data on its own responsibility.

It covers data we receive through this site (Ukrainian and English versions) or when you contact us using the contact details shown on it. It does not cover processing of data to perform a service contract concluded separately: information about that processing is provided with the contract.

To ask about your personal data or to exercise your rights, write to razomcrm@gmail.com. You can also reach us on Telegram (@RazomGr) or by phone at +380 63 443 02 17, Monday to Friday, 9:00 to 19:00.

What data we process

We process only the data needed for the purposes described in this policy.

  • Request form. Required fields: name and phone number. Optional: e-mail, company, number of calls per month (as a range) and a comment of up to 2,000 characters. The form also has a required data processing consent box and an optional newsletter box.
  • Data added to the request automatically. If you came to the form from a plan card or from the calculator: the plan you chose or the one the calculator recommended, and a text summary of the calculator inputs and result. The headline variant you saw and the page language. The request ID and the time we received it (UTC). That you ticked the consent box, the policy version and your newsletter choice. We do not store your IP address or browser details (user agent) in the request itself.
  • Correspondence and calls. If you write to us by e-mail or on Telegram or call us, we process your contact details and the content of your message.
  • Server logs. Each time your browser loads a page or file from the site or sends the form, the server records the IP address, the time, the URL requested (including any parameters in it, such as advertising click identifiers), the response status and its size.
  • Spam protection. To limit the number of requests from one IP address (no more than five in 10 minutes), we keep not the address itself but a protected hash of it (an irreversible transformation with a secret key) and delete it once the 10 minutes have passed. The form also contains a hidden field that people do not see; requests in which it is filled in are discarded without being stored.
  • Browser storage. Without your consent, the site sets no cookies. Two entries are kept in your browser’s localStorage: rg_consent (your choice in the cookie banner) and rg_hero (the headline variant number, so that the headline does not change during your visit).
  • Analytics and marketing tools. Only with your consent: the data these tools collect, including session recordings (see “Analytics, ads and cookies”).

The benefit calculator works in your browser: what you enter in it reaches us only if you send the estimate with a request yourself. The analytics tools, if you allow them, may record that you used the calculator, but not the values you enter or set in it.

Please do not include in the comment anything the request does not need, in particular health or other sensitive data. Include other people’s data only if you are entitled to pass it on.

Neither the law nor a contract requires you to give us any data. Without your name, phone number and the consent box, the form cannot be sent; you can then write to us by e-mail or on Telegram, or call us. All other fields are optional: without them we will clarify the details when we talk, and without an e-mail address we will reply by phone and cannot send you the newsletter.

Purposes and legal bases

For each purpose, the list below shows which data we use and on what basis. We cite the GDPR for cases where it applies. Where other data protection law applies, for example Ukrainian or Swiss law, we rely on its equivalent provisions.

  • Answering your request or message, preparing an offer or contract. Data: form fields, correspondence, plan and estimate, language. Basis: if you contact us for yourself, for example as a sole trader, steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR). If you contact us on behalf of a company, or your message is not aimed at a contract with you, our legitimate interest in answering enquiries addressed to us and in preparing a contract with the company you represent (Art. 6(1)(f) GDPR).
  • Record of your choices in the form. Data: that you ticked the consent box, the policy version, your newsletter choice and the time of the request. Basis: our legitimate interest in being able to show what you were told and what you agreed to, including that you consented to the newsletter (Art. 6(1)(f) GDPR).
  • Newsletter with useful materials. Data: your e-mail address. We send the newsletter by e-mail no more than once a month. Basis: your consent (Art. 6(1)(a) GDPR).
  • Operating and securing the site, protecting it against spam and abuse. Data: server logs, the hash of the IP address, the hidden form field. Basis: our legitimate interest in a site that works and is protected against attacks, and in keeping the form free of spam (Art. 6(1)(f) GDPR).
  • Improving the site’s texts. Data: the headline variant number in the request. Basis: our legitimate interest in knowing which wording helps visitors understand what we offer (Art. 6(1)(f) GDPR).
  • Analytics and advertising. Data: what the tools described under “Analytics, ads and cookies” collect. Basis: your consent given in the cookie banner (Art. 6(1)(a) GDPR), which is also the consent to storing and reading data on your device required by the ePrivacy rules.
  • Meeting legal obligations and protecting our rights. Data: only what the specific obligation or claim requires. Bases: a legal obligation under EU or Member State law, such as keeping contract documents (Art. 6(1)(c) GDPR); for obligations under other law and for establishing, exercising or defending legal claims, our legitimate interest (Art. 6(1)(f) GDPR).

Right to object

You may object at any time, on grounds relating to your particular situation, to the processing of your data based on legitimate interests (Art. 6(1)(f) GDPR). We will then stop that processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the data is needed to establish, exercise or defend legal claims.

You may object to the use of your data for direct marketing, including the newsletter, at any time and without giving reasons. We will then no longer use the data for that purpose.

Simply write to razomcrm@gmail.com.

  • The data processing consent box (required). By ticking it, you confirm that you have read this policy. Where the GDPR applies, we process the request itself on the basis of Art. 6(1)(b) or 6(1)(f) GDPR, not on the basis of this box. Where a law that applies to us requires consent to process request data, ticking the box is that consent, limited to handling your request. It does not cover the newsletter or the analytics and marketing tools, which need separate consent. If you withdraw consent or ask us to stop handling your request, we will do so and delete the request, except for data we must keep by law or to defend legal claims.
  • The newsletter box (optional). You give consent by ticking it. You can withdraw it at any time using the unsubscribe link in every e-mail or by writing to razomcrm@gmail.com. We then stop sending the newsletter.
  • Analytics and marketing (optional). You give consent in the cookie banner, separately for each category. You can change or withdraw it at any time just as easily via “Cookie settings” at the bottom of the page. After withdrawal, the tools in that category no longer load, and we delete the cookies they set on our site’s domain. Cookies the providers have set on their own domains can be deleted only in your browser settings. Withdrawal does not delete data the providers have already received: you can contact the provider about it.

The optional consents are voluntary: refusing them has no effect on how we handle your request or on your use of the site.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

If your browser sends the Global Privacy Control signal, we treat it as a refusal of the marketing tools, and they do not load.

Analytics, ads and cookies

The site loads the third-party tools listed below only after you consent in the cookie banner. Without your consent, none of them loads or receives any data.

  • Google Analytics 4 (Google Ireland Limited), category “Analytics”: visit statistics, that is, which pages are viewed, where visitors come from and which devices they use, and how many of them send a request. Google processes this data on our behalf and on our instructions, as our processor; we keep data sharing for Google’s own purposes and Google signals switched off. How Google uses data: www.google.com/policies/privacy/partners.
  • Microsoft Clarity (Microsoft Ireland Operations Limited), category “Analytics”: heatmaps and session recordings, that is, a replay of how visitors view and use our pages (scrolling, clicks, cursor movement), with device and browser data, so that we can see what is inconvenient on the site. What you type or set in the request form and in the calculator is masked, and Clarity does not record it. We do not allow Clarity to share data with Microsoft’s advertising services. Microsoft states that it processes Clarity data as an independent controller.
  • Google Ads (Google Ireland Limited), category “Marketing”: measuring which ads lead to requests, and remarketing, that is, showing our ads to people who have already visited the site, on Google services and partner sites. Google receives this data as an independent controller.
  • Meta Pixel (Meta Platforms Ireland Limited), category “Marketing”: measuring the effectiveness of ads on Facebook and Instagram and building audiences for them. We and Meta are joint controllers (Art. 26 GDPR) for collecting the data on our site and transmitting it to Meta, and Meta carries out any further processing on its own. The essence of the arrangement: we are responsible for your consent and for informing you on our site, and Meta answers your requests about the data it stores after receiving it.
  • TikTok Pixel (TikTok Technology Limited, Ireland, together with TikTok Information Technologies UK Limited), category “Marketing”: measuring the effectiveness of ads on TikTok and building audiences for them. TikTok states that it processes the data received through the pixel as a joint controller with us.

These tools set their own cookies and use similar browser storage, and they collect identifiers, IP address, device and browser data, pages viewed, the source of your visit and your actions on the site. According to Google, Google Analytics does not store the IP addresses of visitors from the EU, Switzerland and the UK and uses them only to determine an approximate location. Google (Google Ads), Meta and TikTok may link this data to your account with their service, if you have one, and use it to build advertising audiences.

When you send a request successfully, the tools you allowed receive a notice of it (a conversion event) and, if a plan was added to the request, the name of that plan. We do not pass on to them any of the data you enter in the form. The provider links this event to the same data as any other action on the site.

We use Google Consent Mode v2: Google’s tools receive a signal with your choice and work only within the categories you allowed.

For each tool, we are responsible for using it on our site, for asking for your consent and informing you, and for collecting the data on our site and transmitting it to the provider. Providers that act as controllers decide on any further processing themselves and are responsible for it under their own privacy policies. You can also contact us about any of the tools: we will forward a request about data a provider holds to that provider.

The full list of the cookies and other browser storage these tools use, with their lifetimes, is in the cookie policy.

Who receives your data

Apart from our staff who handle requests, data may be received by:

  • Cloudflare, Inc., whose servers run the site and whose database stores the requests; Cloudflare processes this data as our processor;
  • Google as our e-mail provider: the mailbox razomcrm@gmail.com runs on Gmail, a consumer service in which Google acts not on our instructions but as an independent controller; Google processes the e-mails you send us and those we send you under its own terms;
  • Telegram: each new request reaches us as a message from our Telegram bot, and if you write to us on Telegram, that correspondence is also processed under Telegram’s privacy policy;
  • the providers of the analytics and marketing tools (Google, Microsoft, Meta, TikTok), only with your consent and to the extent described under “Analytics, ads and cookies”;
  • public authorities and courts, only where the law requires it or where it is necessary to protect our rights.

International transfers

Some recipients process data outside the European Economic Area (EEA) and Switzerland, in countries where the level of data protection may be lower:

  • Cloudflare (USA) relies on the EU–US Data Privacy Framework and the standard contractual clauses (SCC) of its data processing agreement.
  • Google (Google Analytics, Google Ads, Gmail), Microsoft (Clarity) and Meta: in particular in the USA, where Clarity data is also stored. Transfers to the USA rely on the adequacy decision for the EU-U.S. Data Privacy Framework, under which Google LLC, Microsoft Corporation and Meta Platforms, Inc. are certified (for data from Switzerland, on the Swiss-U.S. Data Privacy Framework where the recipient is also certified under it), and on the European Commission’s standard contractual clauses (SCC), which Switzerland also recognises;
  • TikTok: data is stored in particular in the USA, Malaysia and Singapore, and TikTok group companies in other countries, including China, may access it remotely. TikTok is not certified under the Data Privacy Framework and relies on SCC;
  • Telegram processes our bot’s messages with requests and the messages you send us there under its own privacy policy, which also states where the data is stored.

Where a provider transfers data within its group as an independent or joint controller, it puts these safeguards in place itself and describes them in its privacy policy. Where we ourselves transfer request data to a country without an adequacy decision, including to our staff or service providers, we use SCC or other appropriate safeguards provided for by law. To obtain a copy of the safeguards we use, write to razomcrm@gmail.com.

How long we keep data

  • Requests and correspondence: 12 months from our last contact with you. If we have signed a contract, data that has become part of the contract documents is kept for as long as the law requires such documents to be kept.
  • Record of your choices in the form: together with the request, for the same period; for the newsletter, see the next item.
  • Newsletter: your e-mail address and the record of your consent are kept for as long as you remain subscribed, even beyond the period for requests. After you unsubscribe, we remove the address from the mailing list and keep the record of your consent and its withdrawal for a further 12 months, so that we can show that the newsletter was lawful.
  • Server logs: 30 days.
  • Hash of the IP address for spam protection: up to 10 minutes.
  • Your cookie choice (rg_consent): valid for 12 months, after which we ask again. Headline variant (rg_hero): valid for 10 minutes, after which a new one is chosen. Both entries stay in your browser until they are replaced or you clear the site data.
  • Analytics and marketing tools: their cookies and other browser storage are kept as stated in the cookie policy. Google Analytics keeps user- and event-level data for the period set in our account (at most 14 months), which the cookie policy also states. Microsoft keeps Clarity session recordings for 30 days, and recordings we mark as favourites, a random sample of recordings and heatmaps for up to 9 months; individual recordings cannot be deleted earlier. Google (Google Ads), Meta and TikTok keep the data they have received under their own privacy policies.

When the period ends, we delete the data or anonymise it so that you can no longer be identified. If specific data is needed to investigate a security incident or to establish, exercise or defend legal claims, we keep only that data and only until the matter is closed.

Your rights

Within the limits of applicable law, you have the right to:

  • find out whether we process your data and receive a copy of it and information about the processing;
  • have inaccurate data corrected and incomplete data completed;
  • have your data erased;
  • have the processing restricted;
  • receive the data you provided to us in a structured, commonly used and machine-readable format or have it sent to another controller, where the processing is based on consent or a contract;
  • object to processing, as described under “Right to object”;
  • withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal;
  • lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work or where you believe the infringement took place.

To exercise your rights, write to razomcrm@gmail.com. This is free of charge. We will reply without undue delay and in any event within one month of receiving your request; in complex cases this period may be extended by two further months, and we will tell you if so. So that we do not disclose data to someone else, we may ask you to confirm your identity, for example by writing from the e-mail address or calling from the phone number given in your request.

Before lodging a complaint, you can contact us, and we will try to resolve the matter quickly.

We make no decisions based solely on automated processing that have legal effects on you or similarly significantly affect you: requests are read and handled by people. Profiling (statistics and advertising audiences) is carried out only by the analytics and marketing tools, and only with your consent.

Data security

We take technical and organisational measures appropriate to the risks, in particular:

  • the site is served over an encrypted connection;
  • a strict Content Security Policy lets the browser load scripts only from our server and from the providers of the tools named in this policy, and those tools are loaded only after your consent;
  • the size of data sent to the server and the number of requests from one IP address are limited;
  • only the staff who handle requests have access to them.

No method of transmitting or storing data is completely secure. If a breach affects your data, we will notify the supervisory authority and you where the law requires it.

Changes to this policy

We update this policy when our processes, tools or the law change. We publish the new version on this page, with its date at the top. With your request, we record which version of this policy was in force when you sent it. If a change affects processing based on your consent, we will ask for your consent again where the law requires it, and for the analytics and marketing tools through the cookie banner.