Legal
How I found you
Information under Article 14 of the EU and UK General Data Protection Regulation (GDPR). Version 1, last updated 9 October 2026.
You are reading this because you received an email from Dmitry Lebedev, a web designer based in Riga, Latvia, about your business’s website. This page explains where your business’s details came from, what is held and why, who else handles it and for how long, and how to make it stop.
The short version: reply “no” to any email, or use the opt-out form. You won’t be contacted again, and no one will ask why.
Who is responsible for your data
The controller is Dmitry Lebedev, Riga, Latvia. Write about anything on this page to hello@dmitrydesign.org, or reply to any email you received.
What is held
Only details about your business, and our correspondence with you:
- Your business’s public details: its name, address, phone number, and the email address it publishes — usually a general address such as info@.
- Your website: its address, and notes from looking at its public pages — for example, whether it loads securely, whether it works on a phone, whether its contact form works.
- Your public company record: for example, the company number and status in a public register.
- A contact name, where your business publishes one, and the likely legal form of the business (for example, a limited company).
- Our correspondence: the emails sent to you, any reply you send, and when they were sent; also whether an email was delivered or bounced.
Not held: sensitive personal data, your home address, social-media profiles, or any record of whether you opened an email or clicked a link. Emails are not tracked.
Where it came from
Your business’s details came from one or more of these public sources:
- Public company registers, such as Companies House in the UK and the Companies Registration Office in Ireland;
- your business’s own website;
- public map listings and directories, used to find businesses in an area.
Data from leaked or hacked sources is never used. If you’d like to know which source your details came from, ask, and you’ll be told.
Why, and on what legal basis
Purpose. To offer web design services to businesses whose website is missing or has a specific problem that is costing them customers, and to answer you if you reply.
Legal basis. Legitimate interests (GDPR Article 6(1)(f)): the direct marketing of business services to businesses (Recital 47). Those interests were weighed against yours in a written assessment, which you can ask to see. Among its safeguards: each business gets at most a few short emails; every email says plainly who is writing; stopping takes one word and works permanently. In the UK, emails go only to limited companies and other corporate bodies at their business addresses, as the Privacy and Electronic Communications Regulations allow.
If you become a client, your project details are handled under the privacy notice.
Automated tools and AI
Automated tools help find businesses, look at their public websites, and choose which businesses to write to. An AI assistant helps draft the emails under rules Dmitry sets, and every email says so in its signature. If you ask whether you are talking to an AI, you will be told the truth. To deal with Dmitry personally, reply “human” to any email.
No automated decision has legal or similarly significant effects on you (GDPR Article 22).
Who else handles it
Your data is not sold, rented or shared with anyone for their own marketing. It is handled on Dmitry’s behalf by service providers (processors), each bound by a data processing agreement (GDPR Article 28):
| What they do | Provider |
|---|---|
| Sending and receiving email | Google (Google Workspace) |
| Website, forms and storage | Cloudflare |
| AI models that help draft emails | Anthropic |
If a provider is added or changed — for example an email-sending platform or a server host — this table is updated first. Data may also be disclosed where the law requires it.
Transfers outside the European Economic Area and the UK
Some of these providers process data in the United States. Such transfers rely on the EU–US Data Privacy Framework and its UK extension where the provider is certified, or on the European Commission’s standard contractual clauses (and the UK addendum) otherwise. You can ask for a copy of the relevant safeguards.
How long it is kept
12 months from when your business’s details were collected. After that it is deleted, including any correspondence. The exceptions:
- If you opt out, object, or have your data erased, a one-way coded fingerprint (a keyed hash) of your email address and business is kept indefinitely. Its only job is to make sure you are never contacted again, even if your details reappear somewhere. It can’t be turned back into your address.
- If you reply that you’re not interested, the same kind of fingerprint is kept for 24 months, so your business isn’t approached again in that time, and then deleted.
- If an email to your address bounces permanently, the same kind of fingerprint is kept so the address is never tried again.
- If you become a client, project records are kept as the privacy notice and accounting law require.
Your rights
You have the right to access what is held about you (Article 15), to have it corrected (Article 16), erased (Article 17), or its use restricted (Article 18).
You also have the right to object at any time to the use of your data for direct marketing (Article 21(2)). This right is absolute: when you object, the marketing stops, with no questions. You can also object to any other use based on legitimate interests, on grounds relating to your situation (Article 21(1)).
Requests are answered within one month.
How to stop the emails
Any of these works at any time and takes effect immediately:
- reply “no” to any email;
- use the opt-out form;
- write to hello@dmitrydesign.org.
Your address is then added to the do-not-contact list and removed from any sending.
Complaints
If you think your data has been handled wrongly, please say so first and it will be put right. You also have the right to complain to a data protection supervisory authority (GDPR Article 77): the Latvian Data State Inspectorate (Datu valsts inspekcija), www.dvi.gov.lv, or the authority where you live or work — in the UK the Information Commissioner’s Office, in Ireland the Data Protection Commission.
You don’t have to do anything
You are not obliged to reply or to provide any information. If you ignore the emails, the sequence ends by itself after at most three messages, and your business isn’t written to again for at least 12 months. If you reply that you’re not interested, not for at least 24 months. If you reply “no” or opt out, never.