Privacy Policy

Last updated: 15 April 2026

1. Data Controller

As the Data Controller, I determine the purposes and means of processing your personal data. You may contact me at any time regarding your data rights or this policy.

2. Scope of This Policy

This policy covers personal data collected through:

• This website (www.petrohrys.com) and all subpages
• All mobile applications published by Petro Hrys on the Apple App Store and Google Play Store
• Any email communications with me

3. Core Privacy Principles

All apps I build are designed around privacy by default and privacy by design (Article 25 GDPR):

• No user accounts required to use any app
• Files and documents are processed locally on your device and never uploaded to my servers
• No advertising SDKs, no tracking pixels, no behavioural profiling
• No sale or transfer of personal data to third parties for commercial purposes
• Data minimisation: I collect only what is strictly necessary

4. What Personal Data I Collect and Why

4.1 Website Analytics (www.petrohrys.com)

This website uses Google Analytics 4 (Google Ireland Ltd.) to understand how visitors use the site. The following data is collected automatically:

Google Analytics is configured with IP anonymisation enabled. Data is processed under Google's Data Processing Agreement. You can opt out at any time by installing the Google Analytics Opt-out Browser Add-on.

4.2 Email Communications

When you contact me by email, I process your email address and any personal data you include in your message. This data is used solely to respond to your enquiry. The legal basis is Art. 6(1)(b) GDPR (performance of a contract or pre-contractual steps) or Art. 6(1)(f) (legitimate interest in responding to communications).

4.3 App Usage Data

My apps process files and data entirely on your device. No file content, document data, or personally identifiable information is transmitted to my servers during normal app use. Where an app integrates with Apple's CloudKit or similar device-native services, data is governed by Apple's own privacy policy, not mine.

Some apps may use Apple's crash-reporting framework (CrashKit / TestFlight diagnostics) if you have enabled "Share with App Developers" in your iOS settings. This data is anonymised and governed by Apple's privacy policy.

4.4 In-App Purchases

All payment transactions are handled exclusively by Apple (App Store) or Google (Google Play). I do not receive, store, or process your payment card details. Purchase receipts may be validated with Apple/Google servers to confirm entitlements.

5. Cookies and Tracking Technologies

This website uses the following cookies:

Analytics is off until you accept it. On your first visit a banner asks; nothing analytic is loaded or requested unless you agree, and declining loads nothing at all. You can change your mind at any time through the Cookie settings link in the footer of every page. Only the choice itself is stored, in your browser, and it is never sent anywhere. You can also control cookies through your browser settings. Disabling analytics will not affect your ability to use this website.

6. Third-Party Services and Data Processors

I have Data Processing Agreements (or equivalent contractual safeguards) in place with all data processors. Where data is transferred outside the European Economic Area (EEA), such transfers are covered by Standard Contractual Clauses (SCCs) approved by the European Commission.

7. Data Retention

When data is no longer needed for its stated purpose and retention period, it is securely deleted or anonymised.

8. Your Rights Under the GDPR

If you are located in the European Economic Area (EEA), UK, or Switzerland, you have the following rights under applicable data protection law:

• Right of access (Art. 15 GDPR): Request a copy of the personal data I hold about you.
• Right to rectification (Art. 16 GDPR): Request correction of inaccurate or incomplete data.
• Right to erasure / "right to be forgotten" (Art. 17 GDPR): Request deletion of your personal data, subject to legal retention obligations.
• Right to restriction of processing (Art. 18 GDPR): Request that I limit processing while a dispute is resolved.
• Right to data portability (Art. 20 GDPR): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21 GDPR): Object to processing based on legitimate interests; I must cease unless I can demonstrate compelling legitimate grounds.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Rights related to automated decision-making (Art. 22 GDPR): I do not use automated decision-making or profiling that produces legal or similarly significant effects.

To exercise any of these rights, contact me at hrhelperg@gmail.com. I will respond within 30 days as required by Art. 12 GDPR. I may need to verify your identity before fulfilling a request.

9. Right to Lodge a Complaint

If you believe I have processed your personal data unlawfully, you have the right to lodge a complaint with a data protection supervisory authority. In the EU, you may contact the authority in your country of residence or the authority where the alleged infringement took place. A list of EU supervisory authorities is available at edpb.europa.eu.

10. Children's Privacy

My services are not directed to children under 16 years of age (or the applicable minimum age in the relevant EU member state). I do not knowingly collect personal data from children. If you believe a child has provided personal data to me, please contact me immediately at hrhelperg@gmail.com and I will delete it promptly.

11. Data Security

I implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These include:

• HTTPS encryption for all web traffic (TLS 1.2+)
• Local-only data processing in apps (no server transmission)
• Access controls limiting who can access any data I do hold
• Regular review of third-party data processors and their security practices

No method of transmission or storage is 100% secure. In the event of a data breach that is likely to result in high risk to your rights and freedoms, I will notify you and the relevant supervisory authority within the timeframes required by law.

12. International Data Transfers

Some third-party services (e.g. Google Analytics) may transfer data to servers located outside the EEA, including the United States. Such transfers are safeguarded by Standard Contractual Clauses (SCCs) or other approved transfer mechanisms under Chapter V GDPR. You may request information about these safeguards by contacting me.

13. Changes to This Policy

I may update this Privacy Policy from time to time to reflect changes in my services, legal obligations, or data practices. The "Last updated" date at the top of this page indicates when the policy was last revised. Material changes will be communicated via a notice on this website. Continued use of my services after the effective date constitutes acceptance of the updated policy.

14. Contact