Privacy Policy

1. Introduction

Dmytro Doroshenko (“Dymix”, “we”, “us”, “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, how long we keep it, and what rights you have.

This policy covers our website at dymix.pro, our sales and consultation process, our client relationships, and our own marketing and recruitment activities.

Privacy contact: [info@dymix.pro]

2. Our two roles: controller and processor

We handle personal data in two distinct capacities, and different parts of this policy apply to each.

As a controller, we decide why and how personal data is processed. This applies to data about visitors to our website, prospective clients, people who book consultations with us, our clients’ contact persons, suppliers, and job applicants. Sections 3 to 14 of this policy describe this processing.

As a processor, we handle personal data on behalf of and under the documented instructions of our clients, when we build, operate or maintain automation systems for them. In this case our client is the controller and determines the purposes of processing. Our processing is governed by a Data Processing Agreement with that client, and this policy does not replace it. If you are an individual whose data is processed through a system we operate for a client and you wish to exercise your rights, please contact that client directly; if you contact us, we will forward your request to the relevant client without undue delay. Section 15 describes this in more detail.

3. Personal data we collect

Website visitors. Technical and usage data including IP address (which may be truncated), device and browser type, operating system, referring URL, pages viewed, time on page and interaction events, and cookie or similar identifiers. See section 7 for cookies.

Enquiries and consultation bookings. When you contact us or book a call — including through our scheduling provider — we collect your name, business email address, company name, job title, phone number where provided, time zone, scheduling preferences, and the content of your enquiry or the answers you give in the booking form.

Clients and their personnel. Contact details of authorised representatives, correspondence and meeting records, project documentation, feedback and approvals, contractual details, billing information, and access administration records. We do not collect full payment card details; payments are handled by our payment provider.

Prospective clients (business development). Business contact information such as name, job title, company, business email address, professional social media profile and publicly available company information. We collect this from public sources, professional networks, and reputable B2B data providers. See section 5 for the lawful basis and section 12 for your right to object.

Communications. Emails, messages via messaging platforms, call notes and, where you have been informed and consent is obtained as required by law, recordings or transcripts of video calls.

Job applicants. CV, cover letter, contact details, work history, portfolio and interview notes.

We do not intentionally collect special category data (such as health, biometric, political or religious data) and we ask that you do not send it to us. We do not knowingly collect data from children — see section 13.

4. Where we get your data

We collect data directly from you when you contact us, fill in a form, book a call, sign a contract or apply for a role; automatically when you use our website, through cookies and analytics; and from third parties, including public sources and company registries, professional networking platforms, B2B data and enrichment providers, referral partners, and our clients where they provide contact details of their personnel.

Where we obtain your data from a source other than you, we will inform you at the point of first contact and no later than one month after obtaining it, as required by Article 14 of the GDPR.

5. Why we use your data and our lawful basis

We use your personal data to respond to enquiries and arrange consultations, on the basis of steps taken at your request prior to entering a contract, or our legitimate interest in responding to business enquiries.

We use it to deliver, administer and support our services, on the basis of performance of a contract with you or with the organisation you represent, or our legitimate interest in managing that relationship.

We use it for invoicing, accounting, tax and statutory record-keeping, on the basis of compliance with a legal obligation.

We use it for direct marketing and business development, including targeted outreach to business contacts about services relevant to their professional role, on the basis of our legitimate interest in promoting our business, or your consent where required by applicable electronic marketing law. You may object or unsubscribe at any time, free of charge, using the link in any message or by emailing us.

We use it to operate, secure, analyse and improve our website, on the basis of your consent for non-essential cookies, and our legitimate interest in the security and integrity of our systems.

We use it to establish, exercise or defend legal claims, prevent fraud, and comply with regulatory requests, on the basis of our legitimate interests or a legal obligation.

We use it to assess job applications, on the basis of steps taken prior to entering an employment contract or our legitimate interest in recruitment.

Where we rely on legitimate interests, we have carried out a balancing assessment to confirm that our interests are not overridden by your rights and freedoms. You may request a summary of that assessment.

6. Artificial intelligence and automated processing

We use AI tools internally to assist with tasks such as drafting, research, summarising communications and preparing proposals. Where we use third-party AI providers, we select providers whose terms exclude the use of submitted data for training their general models, and we configure our tools accordingly wherever that option is available.

We do not use personal data obtained through our website, enquiries or client engagements to train our own AI models.

We do not carry out solely automated decision-making that produces legal effects concerning you or similarly significantly affects you. Where AI assists in prioritising or scoring business enquiries, the outcome is always subject to human review before any decision is taken.

7. Cookies and similar technologies

Our website uses cookies and similar technologies. Strictly necessary cookies are required for the site to function and are set on the basis of our legitimate interest. All other categories — analytics, performance, functional and marketing — are set only with your consent, which you give through our cookie banner and can withdraw or change at any time through the cookie settings link in the footer.

We currently use or may use the following categories of provider: [website hosting and CDN, e.g. Cloudflare], [analytics, e.g. Google Analytics 4 / Plausible], [scheduling, e.g. Calendly], [marketing and advertising pixels, if any], and [embedded media providers]. A full, current list of cookies with their purpose and duration is available in our [Cookie Policy / cookie settings panel].

Our website may embed content or media hosted by third parties. Those providers may set their own cookies and process your data under their own privacy policies.

We do not currently respond to browser “Do Not Track” signals; where required, we honour Global Privacy Control signals as a valid opt-out of sale or sharing.

8. Who we share your data with

We share personal data only where necessary, and always under appropriate contractual safeguards. Recipients fall into the following categories: cloud hosting and infrastructure providers; workflow automation and integration platforms; AI and large language model providers; CRM, email, communications and scheduling providers; analytics providers; B2B data enrichment and verification providers; payment processors and accounting software; professional advisers such as lawyers and accountants; and, where required, regulators, law enforcement or courts.

We maintain a current list of our sub-processors, which is available to clients on request and updated in accordance with our Data Processing Agreement.

We do not sell your personal data. We do not share your personal data for cross-context behavioural advertising unless you have consented to marketing cookies, and you may opt out at any time.

If our business is involved in a merger, acquisition or asset sale, personal data may be transferred to the acquiring entity, subject to this policy and prior notice where required.

9. International transfers

We are based in [the United Kingdom] and some of our providers are located outside the UK and the European Economic Area, including in the United States.

Where we transfer personal data outside the UK or EEA, we ensure an appropriate safeguard is in place, which will be one of: an adequacy decision or UK adequacy regulations covering the destination country; the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses; or the EU Standard Contractual Clauses, supplemented where necessary by additional technical and organisational measures identified through a transfer risk assessment.

You may request a copy of the relevant safeguard by contacting us.

10. How long we keep your data

We keep personal data only for as long as necessary for the purposes described in this policy.

Website analytics data is retained for up to [14 / 26] months. Enquiries that do not lead to an engagement are retained for up to [24] months from last contact. Prospect and marketing contact data is retained until you object or unsubscribe, and thereafter we keep a minimal suppression record indefinitely so that we do not contact you again. Client records, contracts and correspondence are retained for the duration of the engagement and for [six (6)] years afterwards, in line with limitation periods and statutory record-keeping requirements. Financial and tax records are retained for [six (6)] years. Unsuccessful job applications are retained for [six (6)] months unless you consent to a longer period.

Where data no longer needs to be retained, it is securely deleted or irreversibly anonymised.

11. How we protect your data

We implement technical and organisational measures appropriate to the risk, including encryption of data in transit using TLS and encryption at rest where supported by the underlying platform; role-based access control and the principle of least privilege; multi-factor authentication on business-critical accounts; secure credential and secrets management, with client credentials never stored in plain text; logging and monitoring of access to production systems; regular review of third-party providers; confidentiality obligations and security training for personnel; and documented incident response and breach notification procedures.

No system can be guaranteed to be completely secure. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours where required, and notify affected individuals without undue delay where the risk is high.

12. Your rights

Subject to the conditions in applicable law, you have the right to be informed about how we use your data; to request access to a copy of your personal data; to request rectification of inaccurate or incomplete data; to request erasure in certain circumstances; to request restriction of processing; to data portability where processing is based on consent or contract and carried out by automated means; to object to processing based on legitimate interests, including an absolute right to object to direct marketing at any time; and to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any right, email [privacy@dymix.pro]. We will respond within one month, which may be extended by two further months for complex requests, in which case we will tell you. We may need to verify your identity. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive.

If you are in the UK, you may lodge a complaint with the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. If you are in the EEA, you may complain to your local supervisory authority. We would appreciate the chance to address your concerns first.

If you are a California resident, you have the right to know the categories and specific pieces of personal information collected, the sources, the purposes and the categories of third parties with whom it is shared; the right to delete; the right to correct; the right to opt out of sale or sharing; the right to limit the use of sensitive personal information; and the right not to receive discriminatory treatment for exercising these rights. We do not sell personal information or share it for cross-context behavioural advertising as those terms are defined under the CCPA/CPRA. You may submit a request to [privacy@dymix.pro], and you may authorise an agent to act on your behalf with proof of authorisation.

Residents of other US states with comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah and Texas, have broadly equivalent rights and may contact us at the same address, including to appeal a refused request.

13. Children

Our website and services are directed at businesses and are not intended for children. We do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

14. Third-party links

Our website and materials may contain links to third-party websites, scheduling tools and platforms. We are not responsible for their content or privacy practices, and we encourage you to read their privacy policies before providing any personal data.

15. Processing on behalf of our clients

When we build and operate automation systems for a client, we may process personal data belonging to that client’s customers, community members, subscribers or prospects — for example contact details, message and interaction history, CRM records, engagement metrics and enrichment attributes.

In this role we act strictly as a processor. We process such data only on the client’s documented instructions, we do not use it for our own purposes, we do not sell it, and we do not use it to train AI models. We apply the security measures described in section 11, engage sub-processors only under written terms imposing equivalent obligations and with prior notice to the client, assist the client with data subject requests and with data protection impact assessments where required, notify the client without undue delay of any personal data breach, and delete or return the data at the end of the engagement in accordance with the client’s instructions.

The client remains responsible for establishing a lawful basis for the processing, for providing privacy notices to its own data subjects, and for the lawfulness of the instructions it gives us.

16. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal requirements. The current version is always available at [dymix.pro/privacy] with the “Last updated” date. Where changes are material, we will notify you by email or through a prominent notice on the website before they take effect.

17. Contact us

Dmytro Doroshenko Email: info@dymix.pro Website: https://dymix.pro