Privacy notice

1. Controller

Victoria Zalutskaya
Rosensteinstr. 15
70736 Fellbach, Deutschland
+49 177 5469842
victoriyazalutskaya@gmail.com

You can use the email address above for privacy questions and to exercise your rights.

2. Overview

Website visits involve technical connection data processed by the hosting infrastructure. Online delivery of contact and valuation forms is currently disabled: the website code does not transmit entries to Victoria or an email delivery service. When you contact Victoria directly by email, telephone or WhatsApp, the information you provide is used to handle your enquiry.

The website code contains no analytics or advertising trackers. This notice covers this website and the contact channels described here. Separate social media profiles and their lead forms require privacy information for their own processing; this notice does not replace it.

3. Hosting and connection data

This website uses OpenAI ChatGPT Sites. The provider for EEA users is OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. Cloudflare is part of the hosting infrastructure.

Visits involve your IP address, time, requested page, browser information and, where provided, the referring page. Processing supports delivery, troubleshooting and abuse prevention under Article 6(1)(f) GDPR, based on the interest in a secure, reliable website. Device access is addressed in section 7.

The applicable hosting privacy contracts depend on account type, including the ChatGPT Sites DPA or organisational DPA. Account-specific contractual responsibilities have not all been confirmed.

Victoria Zalutskaya is responsible for the website services described here. Publication currently uses a technical administrator’s OpenAI account with her permission. The administrator’s privacy role and required written agreements are being clarified separately; permission to publish does not replace those agreements.

Cloudflare registers the domain and provides DNS. Transfer from the existing domain account to Victoria’s own Cloudflare account is prepared but not completed. Provider: Cloudflare, Inc., 101 Townsend St., San Francisco, California 94107, USA. The Cloudflare DPA applies where Cloudflare acts as processor. Moving the domain does not automatically move the OpenAI hosting account.

4. Contact and valuation forms

Online delivery is disabled. Visible fields are for reference only; submission is disabled and the website code does not send entries to Victoria or a delivery provider. Please use email, telephone or WhatsApp to enquire.

Fields cover topic, first and last name, email, optional telephone and message. Valuation fields additionally show property type, address and relevant characteristics such as area, rooms, year and condition. The valuation form does not currently calculate a property value automatically.

The website code does not persist entries in browser storage or a database. They may remain visible in an open tab. Autofill and tab restoration are controlled by your browser.

Acknowledging this notice is not advertising consent. The website does not enrol you in newsletters or automated appointment reminders.

5. Email, telephone and Gmail

Contact information and enquiry contents are used to respond. Contract-related or precontractual enquiries rely on Article 6(1)(b) GDPR; other enquiries rely on Article 6(1)(f), based on the interest in answering them. Information is voluntary, but missing necessary contact details or facts may prevent a response.

Direct email goes to victoriyazalutskaya@gmail.com. The mailbox uses Google Gmail, which processes messages and connection data under its service terms; see Google. This is a consumer Gmail mailbox; a Google Workspace processing agreement for it has not been confirmed. The website currently sends no form emails.

6. WhatsApp and external services

You may contact Victoria through WhatsApp Business. The website provides an external link only and loads no WhatsApp widget on a simple visit. Opening the link involves processing by WhatsApp; sending a message also involves your contact information and message contents. See WhatsApp Business and WhatsApp privacy information.

Messages are used to handle enquiries on the bases in section 5. WhatsApp Business processing terms describe the relevant roles and contracts. Contact access and backups on Victoria’s device are not yet confirmed; disabled synchronisation or exclusively European storage is not promised.

The chat button opens a local contact menu. Separate social media accounts and lead forms require their own privacy information.

7. Cookies, fonts and media

The website code sets no cookies of its own and contains no analytics or advertising trackers. It embeds no Google Analytics, Meta Pixel, external maps, videos or review widgets. Fonts come from your system and images from the website infrastructure.

Cloudflare hosting protection processes connection data and browser signals to prevent automated and abusive requests. Checks on 11 October 2026 found __cf_bm; Cloudflare says it expires after 30 minutes of uninterrupted inactivity. An additional browser check may set cf_clearance, whose actual use and lifetime are not fully confirmed for this configuration. See Cloudflare.

Personal-data processing for security relies on Article 6(1)(f) GDPR. Device access requires consent or a statutory exception under section 25 TDDDG. Whether these functions are strictly necessary for the requested service remains under review; exemption from consent is not promised. “Cookie information” is an information dialog, not a consent mechanism.

8. Recipients and processing outside the EEA

OpenAI and Cloudflare hosting process technical visit data. Google processes direct email, WhatsApp its messages, and telecommunications providers establish calls. Disabled forms transmit nothing. No CRM is used for these enquiries and website code does not forward enquiries to financing partners.

These services may process data outside the EEA, including the USA. Exclusively European storage is not promised. The Sites DPA and Cloudflare DPA provide transfer frameworks including Standard Contractual Clauses or adequacy decisions. Applicable account contracts and safeguards for the Gmail and WhatsApp accounts are not all confirmed. You may request information and copies of applicable safeguards at the contact address in section 1.

Contacting Victoria does not generally authorise sharing with partners. Any additional processing requires information about actual recipients, purposes and legal bases.

9. Retention and deletion

The website code maintains no enquiry database or persistent form storage. Disabled delivery creates no new form emails.

Direct enquiries are needed for handling and necessary follow-up. Once complete, data no longer needed must be deleted unless required by law or necessary for legal claims. Contract and billing records follow the duties applicable to them.

Technical logs support delivery, troubleshooting and abuse prevention. Retention depends on necessity for those purposes and any necessary preservation of evidence. Actual hosting periods and backup cycles are not confirmed. The Sites DPA provides return or deletion on instruction after termination, subject to statutory retention; it gives no fixed period for individual security logs. Cookie lifetimes appear in section 7.

Disabling the website or form does not automatically erase existing email, messenger or former delivery-provider copies. Deletion requests are handled with the relevant contact channel and available copies in mind.

10. Your rights

Subject to statutory conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17) and restriction (Article 18). Portability (Article 20) applies in particular to information you provided where processing is based on consent or contract and carried out by automated means.

You may withdraw consent at any time for the future without affecting the lawfulness of prior processing.

Objection (Article 21 GDPR): you may object to processing under Article 6(1)(f) for reasons relating to your particular situation. You may object to processing for direct marketing at any time without giving reasons.

Contact victoriyazalutskaya@gmail.com to exercise your rights. Where needed to locate your request, include the contact channel and approximate date. Do not send an identity-document copy without a specific request.

You may complain to a supervisory authority (Article 77), particularly where you live, work or suspect an infringement. In Baden-Württemberg: LfDI Baden-Württemberg.

11. Security and updates

The website uses HTTPS and offers no document uploads. Please provide only information necessary for your enquiry.

The website makes no automated decisions about enquiries, including profiling under Article 22 GDPR, and calculates no automated property value.

This notice changes when the services or processing actually used change. Outstanding checks are expressly marked.