Privacy & personal data

A privacy policy is mandatory for any site collecting data: forms, signups, analytics, cookies. Ukrainian data-protection law + GDPR if you have EU users.

Minimum: what data you collect, why, legal basis, who you share with, retention period, user rights (access, correct, delete), contacts. Plain language — legalese is penalized as non-transparent.

A cookie banner is needed for non-essential trackers (analytics, ads). 'By continuing you agree' is invalid under GDPR: consent needs an active act, refusal as easy as acceptance.

The Personal Data Protection Law: consent or contract is the basis for processing. Notify the Ombudsman when processing sensitive data. Sanctions are mild so far, but data security is your responsibility.

On breach: document, assess scope, notify users if risk is real (GDPR — 72h to the regulator). Minimize collection — the best insurance is not storing what you don't need.