Privacy Policy
This Policy explains how Grafit (“we”, the “Operator”) collects, uses and protects the personal data of visitors to the “20 years of Grafit” campaign page, and what rights you have as a data subject. We process data in accordance with the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA) and applicable national law.
1. Who is responsible for your data
Operator (data controller): Grafit.
Address: Armenia, Erevan.
Data protection contact: [email protected].
2. What data we collect
- Email address — the one you enter in the form.
- Consent status for marketing emails (yes/no) and the time it was given.
- Traffic source — UTM parameters, referrer, or “Direct”.
- Technical data — your IP address and browser User-Agent, plus the date and time the form was submitted.
We do not collect special categories of data and we do not request payment information.
3. Why we process it and on what basis
- Sending the gift (mini-pack). Processing your email to deliver the requested file. Legal basis: steps taken at your request (Art. 6(1)(b) GDPR).
- Grafit marketing emails. Only if you ticked the consent box. Legal basis: your consent (Art. 6(1)(a) GDPR). Consent can be withdrawn at any time.
- Anti-spam and security. IP address and User-Agent are used to rate-limit and protect the form. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
- Source analytics. UTM parameters and referrer help us understand channel performance. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
4. Who we share data with
We do not sell your data. We use service providers (processors) that process data on our behalf:
- Google LLC — storing submissions in Google Sheets;
- Resend (resend.com) — sending the gift email and reporting delivery status (bounces/complaints);
- Railway — application hosting.
5. International data transfers
These providers may process data outside the EEA, including in the United States. In such cases, transfers rely on the EU Standard Contractual Clauses (SCCs) or other appropriate safeguards permitted by the GDPR.
6. How long we keep data
We keep data no longer than necessary for the purposes it was collected for: for marketing — until you withdraw consent or up to 3 years from your last interaction; security logs — up to 12 months. After that, data is deleted or anonymized.
7. Your rights (GDPR)
If you are in the EEA/UK, you have the right to:
- access your data and receive a copy;
- rectify inaccurate data;
- erase your data (“right to be forgotten”);
- restrict or object to processing;
- receive your data in a portable format;
- withdraw consent at any time (this does not affect the lawfulness of processing before withdrawal);
- lodge a complaint with a data protection supervisory authority.
To exercise your rights, email [email protected]. You can unsubscribe using the link in any email.
8. California residents’ rights (CCPA/CPRA)
Over the past 12 months we collected the following categories of personal information: identifiers (email, IP address) and internet activity data (UTM parameters, referrer, User-Agent). If you are a California resident, you have the right to:
- know what information we collect and how we use it;
- request deletion of your information;
- request correction of inaccurate information;
- opt out of the “sale” or “sharing” of personal information;
- exercise your rights through an authorized agent;
- not be discriminated against for exercising your rights.
We do not sell or “share” personal information as defined by CCPA/CPRA. Requests: [email protected].
9. Cookies and tracking
The page does not use advertising or analytics cookies and does not set third-party trackers. We only process what is technically necessary for the form to work.
10. Children
The campaign is not directed at anyone under 21. We do not knowingly collect data from anyone below that age.
11. Changes to this Policy
We may update this Policy. The current version is always available on this page; the revision date is shown at the top.
12. Contact
For any questions about personal data, email [email protected].