Version of 28 October 2026. Previous versions: none.
In short
- We are the Mapin agency, run by a sole proprietor (ФОП), Dmytro Ambrosiev. We process the data you send us yourself (a request form, a message, a call) and a minimum of technical data about visits to this website.
- We use the data to reply to your request, provide our services and meet legal requirements. We don't sell data or share it with others for their advertising.
- Form requests are stored on the server of our hosting provider, Hostinger, and we get notified about them in Telegram. The website uses no visitor analytics and sets no cookies.
- You can ask what data we hold about you, correct or delete it, withdraw your consent, or complain to the Ukrainian Parliament Commissioner for Human Rights. Write to hello@mapin.com.ua.
1. Who processes your data
Data controller ("володілець"): sole proprietor (ФОП) Dmytro Anatoliiovych Ambrosiev (Амбросьєв Дмитро Анатолійович), trading as Mapin ("we").
- Email for data protection matters: hello@mapin.com.ua
- Telegram: @mapin_ua
- Phone: +380 95 566 99 73
Person responsible for personal data protection (Art. 24 of the Law): Dmytro Ambrosiev, same contacts.
This policy covers:
- the website mapin.com.ua, in Ukrainian and English;
- our Telegram bot @mapin_ua_bot;
- our Telegram account and social media pages;
- phone calls and correspondence with us.
We process data under the Law of Ukraine "On Personal Data Protection" No. 2297-VI of 1 June 2010 (the "Law").
What this policy doesn't cover. We build chatbots and websites for other businesses. When you message the chatbot of a café, salon or clinic, that business is the controller of your data. We only process it under that business's contract and instructions, as a processor. The business's own privacy policy explains how that data is handled.
2. What data we process, why, and on what legal basis
The legal bases are those listed in Art. 11(1) of the Law.
| Situation | Data | Purpose | Legal basis |
|---|---|---|---|
| Website request form | Phone number or Telegram username; your Google Maps profile link, or business name and city; the page the form was sent from and a source tag, if any (see section 6); date and time; consent flag and policy version | To contact you, run the free audit and prepare an offer | Your consent (checkbox); steps taken at your request before a contract |
| Telegram bot | Messages and files you send to the bot (usually a Google Maps profile link, or business name and city); data Telegram passes to bots: Telegram ID, profile name, username; the source tag from the link you used to open the bot | To take your request or question and pass it to us, so we can reply in the same chat | Steps taken at your request before a contract; our legitimate interest in answering enquiries |
| Messages, email, calls | Name, phone number, username or email, message content | To reply and arrange an audit or work together | Steps taken at your request; our legitimate interest in answering enquiries |
| Prospective clients we find ourselves | Business name; the business's public phone number or account; city; link to its Google Maps or Instagram profile; our notes on the profile; contact person's name if you give it; call outcome; "do not call" flag | To offer our services to your business once | Our legitimate interest |
| Clients | Name or company name, business details; representatives' contacts; contract, invoices and certificates of completion; correspondence; emails of the Google accounts you grant us manager access to; other data needed to deliver the service | To conclude and perform the contract, and for accounting | Contract; legal obligation (tax records) |
| Case studies | Business name, results, screenshots, quotes | To show examples of our work | Your separate written consent. Without it we publish no case study. You can withdraw it |
| Website visits | IP address, browser and device type, page address, request time, referring website | To serve the website and protect it from attacks | Legitimate interest (website operation and security) |
Prospective clients: how we contact you. We find businesses we could help through public sources: Google Maps, Instagram pages, shop signs. We call each business individually, with no auto-diallers or mass messaging. At the start of the call we say who we are and where we got the number. We send a message only after you agree to receive it. If you say "don't call", we won't contact you again and keep the number only on our do-not-call list (see section 5).
What we don't need. Please don't send us passwords, payment card data, passport data, health information or other special categories of data (Art. 7 of the Law). We don't ask for them, and if you send them by accident, we delete them. We get access to your Google Business Profile only through a manager invitation, never through your password.
Automated decisions. We make no decisions with legal effects for you based solely on automated processing. The bot only takes your request and passes it to us; a person decides whether we work together.
3. Who else has access
We don't sell personal data or share it with third parties for their advertising.
Us. The founder and staff who need it for their work have access. Staff and contractors get access only to the data their work needs, and sign a confidentiality undertaking (Art. 10 of the Law).
Services that process data on our behalf (processors):
| Service | What it does | Where the servers may be |
|---|---|---|
| Hostinger International Ltd. (Cyprus) | Website hosting; the server that stores form requests and the bot's service data; the hello@mapin.com.ua mailbox; website protection and CDN; server logs | Lithuania (EU) for the website and request server; CDN nodes in various countries |
Platforms you use yourself. Telegram, Instagram (Meta) and Google also process your data as independent controllers, under their own terms. For example, messages to our Telegram bot and the request notifications we receive in Telegram pass through Telegram's servers.
Other recipients:
- our accountant, bank and payment services: clients' data only, for payments and accounting;
- public authorities: only where and as the law requires.
Where your consent terms or the law require it, we tell you about a transfer of your data to a third party within 10 working days (Art. 21 of the Law).
4. Transfers outside Ukraine
Hostinger's servers are in the EU (Lithuania); Telegram's servers may also be outside Ukraine, including in EU countries. Under Art. 29 of the Law, we transfer data abroad:
- to states that ensure adequate personal data protection: member states of the European Economic Area, states that have signed the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, and states on the Cabinet of Ministers' list;
- in other cases, with your unambiguous consent to the transfer, which you give in the request form, or where the transfer is needed to conclude or perform a contract in your interest.
We choose providers that commit to protecting data by contract, through data processing agreements (DPAs) and EU Standard Contractual Clauses.
5. How long we keep data
We keep data no longer than its purpose requires (Art. 6 of the Law).
| Data | Retention period |
|---|---|
| Form or bot requests that don't lead to a contract | 6 months from the date of the request, then we erase the personal data |
| Messages with prospective clients | 6 months from the last message |
| Messages you send to the bot | We don't store message text on our server: the bot forwards messages to our working Telegram chat, where they stay, as they do in your chat with the bot. So that our reply reaches you, the server keeps only a technical link between the message in our chat and your Telegram ID, for 6 months. On request, we delete both the messages and this link |
| Prospective clients from public sources we don't end up working with | 6 months from the day they're added to our list |
| Do-not-call list | Only the number or business name and the date of refusal. Kept while we do direct sales, so we never contact you again |
| Client data and contract documents | Contract term plus 3 years (general limitation period, Art. 257 of the Civil Code of Ukraine). Primary accounting documents: at least 1,095 days (Art. 44.3 of the Tax Code of Ukraine) |
| Consents to processing and to case study publication | While the consent is in force, plus 3 years as proof |
| Requests about your rights and our replies | 3 years |
| Hostinger server logs | Under Hostinger's rules. We don't export or keep them separately |
When the period ends, we delete the data or anonymise it so it can no longer identify you (Art. 15 of the Law). If the law requires us to keep something longer, we keep only what the law requires.
6. Cookies and analytics
This website sets no cookies: no advertising, analytics or technical ones.
Visit statistics. We currently use no visitor analytics services. Our hosting server keeps standard technical request logs (IP address, browser, page, time) that the website needs to work and to protect itself from attacks.
How you found us. If you opened the website from a link or QR code on our card, video or Google profile, the link may contain a source tag (for example, utm_source=card). The website keeps this tag in your browser's session storage, which is cleared when you close the tab. We receive it only together with a request you choose to send.
Fonts are hosted on our own server. We don't embed Google Maps, YouTube videos or social media widgets.
If we ever add analytics or advertising tools that use cookies (for example, Google Analytics), we'll ask for your consent first in a separate window and update this policy.
7. Your rights
Under Art. 8 of the Law, you have the right to:
- know the sources of collection and the location of your personal data, the purpose of processing, and the location or residence of the controller or processor;
- get information on the conditions of access to your data, including the third parties it's transferred to;
- access your personal data;
- get an answer within 30 calendar days of your request on whether your data is processed, and get the data itself;
- submit a reasoned objection to the processing of your data;
- submit a reasoned demand to change or destroy your data if it's processed unlawfully or is inaccurate;
- have your data protected from unlawful processing and from accidental loss, destruction or damage, and from the provision of inaccurate information or information that damages your honour, dignity and business reputation;
- complain about the processing of your data to the Ukrainian Parliament Commissioner for Human Rights or to a court;
- use legal remedies if data protection law is breached;
- set limits on the processing of your data when giving consent;
- withdraw consent;
- know how automatic processing of your data works;
- be protected from an automated decision that has legal effects for you.
8. How to exercise your rights
- Write to us at hello@mapin.com.ua or on Telegram at @mapin_ua. To delete messages you sent to our bot, just ask in the bot.
- Tell us which right you want to use and the contact you used to reach us (phone number, username or email), so we can find your data and confirm the request is yours. We don't ask for copies of documents, and ask follow-up questions only if we can't identify you otherwise.
- Timing. We acknowledge your request within 3 working days. We review an access request within 10 working days and fulfil it within 30 calendar days of receipt (Art. 16 of the Law). We review a demand to change or delete data, or an objection, within 10 days. We tell you about a change, deletion or restriction of your data within 10 working days (Art. 21 of the Law).
- Free of charge. We don't charge for handling requests.
- Withdrawing consent. You can withdraw consent at any time, in the same or a simpler way: just write to us. Withdrawal doesn't affect the lawfulness of processing before it. After you withdraw, we stop processing and delete the data, unless another legal basis requires us to keep it (for example, a contract or tax law).
- Complaints. If you think we've breached your rights, you can complain to the Ukrainian Parliament Commissioner for Human Rights: 21/8 Instytutska St., Kyiv, 01008; hotline@ombudsman.gov.ua; hotline 0 800 50 17 20. You can also go to court. Please write to us first: we'll try to fix things quickly.
9. How we protect data
We take organisational and technical measures under Art. 24 of the Law:
- only the founder and staff who need it for their work have access to requests, email and service accounts; requests are stored on the server outside the public part of the website and can't be opened by link;
- the website works only over HTTPS;
- staff and contractors access only the data they need and sign confidentiality undertakings;
- we regularly delete data whose retention period has ended;
- if an incident could expose your data to others and harm you, we'll tell you without undue delay and act to limit the consequences.
10. Children
Our services are for business owners and their representatives. We don't knowingly collect children's data. If we learn we've received a child's data without the consent of a parent or other legal representative, we delete it.
11. Changes to this policy
We may update this policy, for example when we change our services or the law changes. We publish each new version on this page with its date. For material changes, such as a new purpose or a new provider we transfer data to, we also notify clients and people who gave consent, and ask for new consent where needed. Previous versions are available on request.
12. Language versions
This policy exists in Ukrainian and English. If they differ, the Ukrainian version prevails.
Legal basis: Law of Ukraine "On Personal Data Protection" No. 2297-VI of 1 June 2010; Model Procedure for Personal Data Processing approved by Order of the Ukrainian Parliament Commissioner for Human Rights No. 1/02-14 of 8 January 2014.