Privacy Policy

01 Who I am

This website is operated by Klavdiya Bolshakova, trading as Klava London — a freelance full-stack web developer based in London, UK. “I”, “me”, and “my” throughout this policy refer to Klava London.

For UK GDPR and the Data Protection Act 2018, I am the data controller of personal data you provide to me. I am not required to register with the ICO as a sole trader handling only data necessary to run a small service business, but I take my obligations seriously.

Data contact: like@klava.london

02 Data I collect

Data you give me directly

• Contact enquiries — name, email address, and message content when you email me, use the booking API, WhatsApp, or other channels I offer.
• Booking requests — name, email, project type, preferred call time, and project details when booking via Cal.com or the API.
• Project delivery — if we work together: business name, brand assets, platform credentials (stored securely, deleted after handoff), billing details processed via Stripe, and content or materials you share.
• Email correspondence — content of emails exchanged during enquiry, onboarding, and project delivery.
• WhatsApp messages — if you contact me via WhatsApp, message content is processed by Meta. I retain relevant project information from those conversations.
• Testimonials — if you provide a testimonial or agree to be a reference, I use your name and company with your explicit consent only.

Data collected automatically

• Server logs — Vercel logs basic request data: IP address, browser type, pages visited, timestamps. Used for security and performance monitoring only.
• Anonymised analytics — Vercel Analytics collects aggregated, non-personal page view data using privacy-preserving hashing. No cookies, no personal data.
• API usage logs — requests to /api/book-call and /openapi.json are logged at server level for security monitoring.

Data I do not collect

• Advertising or cross-site tracking cookies
• Social media profile or third-party login data
• Sensitive personal data (health, ethnicity, religion, political views)
• Payment card numbers — handled exclusively by Stripe
• Data from children under 16

03 How I use your data

I will never use your data for unsolicited marketing, sell it to any third party, add you to mailing lists without consent, or use it for automated profiling that produces legal or significant effects.

04 Legal basis for processing

• Contract performance (Art. 6(1)(b)) — taking steps at your request before entering a contract, and performing that contract.
• Legitimate interests (Art. 6(1)(f)) — responding to enquiries, maintaining business records, keeping the site secure. I have carried out a balancing test and am satisfied these interests are not overridden by your rights.
• Legal obligation (Art. 6(1)(c)) — where required by law, such as HMRC tax records.
• Consent (Art. 6(1)(a)) — where you have explicitly opted in, such as agreeing to a published testimonial. You may withdraw consent at any time without affecting prior processing.

05 Sharing your data

I do not sell, rent, or trade personal data. I may share it only in these limited circumstances:

• Service providers — third-party tools listed in section 6. They act as data processors under contract and may only use your data as instructed.
• Legal requirements — if required by law, court order, or a public authority such as HMRC.
• Business transfer — in the unlikely event of a business succession, data would be transferred under equivalent protections and you would be notified.
• With your explicit consent — for example, if you ask me to liaise with a third party on your behalf.

I never share your data with advertisers, data brokers, or marketing platforms.

06 Third-party services

07 AI tools

I use AI tools including Anthropic Claude and OpenAI as part of my development workflow. My approach to client data:

• I do not input identifiable personal data about clients or their users into AI tools without explicit consent.
• When AI is used in a client project, this is disclosed and agreed in the project scope before work begins.
• Anonymised code, logic problems, and general technical questions may be processed by AI tools — these contain no personal data.
• The Anthropic Claude API is used in the Global Chic platform's event publishing pipeline to parse PDF flyers. Only event content is processed — no user personal data.

If you have concerns about AI tool usage in your project, raise this before we begin and I will confirm the approach in writing.

08 Cookies & analytics

This site does not use advertising cookies, tracking cookies, or cookie-based analytics. No cookie consent banner is shown because none is required.

Strictly necessary cookies may be set by embedded third-party tools such as Cal.com's booking widget, limited to what is essential for those tools to function.

Vercel Analytics provides anonymised, aggregated page view data using privacy-preserving hashing. Individual visitors are not identifiable and no cookies are set.

09 Data retention

You can request early deletion of your data at any time, subject to legal retention obligations.

10 Security

• All data transmission encrypted via HTTPS / TLS
• Credentials stored in an encrypted password manager, deleted after project handoff
• Project files stored on encrypted devices and services
• Platform access revoked after project completion
• Email protected with SPF, DKIM, and DMARC records
• Payment card data never stored — handled exclusively by Stripe

If you believe your data has been compromised, notify me immediately at like@klava.london and I will respond within 72 hours.

11 International transfers

Some third-party services may process data on servers outside the UK or EEA. Where this occurs I rely on UK adequacy decisions, Standard Contractual Clauses, and data processing agreements with each provider confirming UK GDPR compliance.

12 Your rights

Under UK GDPR you have the following rights. To exercise any of them, email like@klava.london — I will respond within 30 days, free of charge.

13 Children

This site is directed at business clients and professionals. I do not knowingly collect data from anyone under 16. If you believe a child has submitted data, contact me immediately and I will delete it promptly.

14 Changes to this policy

I may update this policy to reflect changes in services, tools, or legal obligations. The “Last updated” date reflects any changes. For material changes affecting how I use your data, I will make reasonable efforts to notify affected individuals directly.

15 Contact & complaints

For data questions, requests, or concerns:

Not satisfied with my response? Complain directly to the ICO at ico.org.uk/make-a-complaint.