Legal
Privacy
Privacy notice for visitors and clients of dmitrydesign.org. Version 1, last updated 9 October 2026.
This notice covers what happens to your data when you visit this site, send a brief or a message, or become a client. If you were contacted about your business’s website, the notice about that applies too.
Who is responsible
The controller is Dmitry Lebedev, Riga, Latvia. Write to hello@dmitrydesign.org about anything on this page.
Visiting the site
The site sets no advertising or analytics cookies and does not track you across other sites. Like any website, its host (Cloudflare) processes your IP address and browser details to deliver pages and to protect the site from abuse; Cloudflare keeps these technical logs briefly under its own policy. The contact form uses Cloudflare Turnstile to tell people from bots, which processes technical data about your browser for that purpose only.
Sending a brief or a message
When you use the brief or contact form, what you write — your email address, your message, and your answers — is sent to Dmitry by email, and a copy may be stored in his project system so the conversation can continue. If you arrived from a link in an email, the reference in that link is attached so your brief is matched to that conversation.
Legal basis: steps at your request before entering into a contract (GDPR Article 6(1)(b)), and legitimate interests in answering enquiries (Article 6(1)(f)).
Kept: for 12 months after the last message if no project follows, then deleted.
Clients
If you commission a project, the details needed to deliver, invoice and support it are kept: contact details, project correspondence, files you provide, the scope and quote, payments and invoices.
Legal basis: the contract (Article 6(1)(b)) and legal obligations such as accounting and tax law (Article 6(1)(c)).
Kept: for the duration of the project and support, and afterwards for as long as accounting and tax law requires (in Latvia, generally up to 5 years for accounting records). Correspondence not needed for those purposes is deleted 24 months after the project ends.
Who else handles it
| What they do | Provider |
|---|---|
| Hosting the site and its forms | Cloudflare |
| Google (Google Workspace) | |
| AI tools that help draft replies and project documents | Anthropic |
| Payments (if you pay online) | Stripe |
Each processes data on Dmitry’s behalf under a data processing agreement. Some process data in the United States, under the EU–US Data Privacy Framework (and its UK extension) or standard contractual clauses. Your data is never sold.
Your rights
You can ask to access, correct, erase or restrict your data, to receive it in a portable form, and to object to processing based on legitimate interests (GDPR Articles 15–21). Requests are answered within one month. You can also complain to the Latvian Data State Inspectorate (www.dvi.gov.lv) or the authority where you live — in the UK the Information Commissioner’s Office, in Ireland the Data Protection Commission.