Privacy policy

Last updated: September 29, 2026

This policy explains what personal data I collect through the English-language pages of izotov.agency (all pages under /en/), why I need it, where it is stored, who else can access it and how long I keep it. It applies to site visitors, people who send me a request, and clients and their representatives who give me their contact details.

You can browse the site without giving me your name or contact details. Some technical data is still processed when you visit – it is listed below and in the cookie policy. The Russian-language pages of the site have their own policy, in Russian.

1. Who is responsible for your data

The controller of your personal data (the "operator" under Kyrgyz and Russian law) is me, Aleksandr Olegovich Izotov, an individual entrepreneur in the Kyrgyz Republic, tax ID (INN) 23006199301704. Izotov Agency is the name I work under.

Address: Toktonaliev St. 104, apt. 31, Bishkek, Kyrgyz Republic.

For privacy questions and requests, email order@izotov.agency. I read and answer these messages myself.

2. Which laws apply

I am based in the Kyrgyz Republic and comply with its Digital Code (No. 178 of July 31, 2025). Where Russian Federal Law No. 152-FZ "On Personal Data" applies – for example, to personal data of Russian citizens – I comply with it as well.

The English pages are meant for clients outside the Russian-speaking market, including in the EU and the UK. For readers covered by the EU or UK General Data Protection Regulation (GDPR), I give the legal bases and rights below in GDPR terms.

3. What data I collect

I collect only what you send me and what the site needs to work. Information about a company counts as personal data only where it relates to an identifiable person.

• Form data – your name, the email address or messenger handle I should reply to, your website, your message, the name of the service or page the form is on and, if you chose a plan using a plan button, that plan.
• Form metadata – the page you sent the form from, the UTM tags of the link that brought you to the site, the referring site, the date and time you sent the form, and the date of the policy version you agreed to.
• Server logs – your IP address, browser type and the URL of the requested page, which the web server records every time a page loads. The form also holds your IP address in server memory to block repeated automated submissions; it is not saved with your request.
• Analytics data, collected only after you click "Accept analytics" in the cookie banner – pages viewed, where you came from, your browser and device, approximate connection details, clicks and other actions on the page, and Yandex Metrica and Google Analytics cookies and identifiers. Whether this is personal data depends on what exactly is collected and whether it can be linked to you.
• Messages you send me directly by email, Telegram or WhatsApp, along with the contact details those services show me.

4. Data I do not ask for

The site is not designed to collect passwords, payment card details, passport or ID numbers, health information, biometric data, political or religious views, information about sex life or sexual orientation, or other special categories of personal data. Please do not include any of this in your message.

If your message includes someone else's personal data, you confirm that you have a legal basis to share it with me. I may delete unnecessary or sensitive details from a message if I do not need them to reply.

5. Why I use your data and the legal basis for it

Each purpose has its own legal basis. I do not use the details from your request to send you marketing emails unless I have a separate legal basis or your separate consent. I do not sell personal data or pass it to data brokers.

• To reply to your request, discuss what you need and prepare a proposal. Legal basis – taking steps at your request before entering into a contract (GDPR Art. 6(1)(b)) and my legitimate interest in answering inquiries (Art. 6(1)(f)); where Kyrgyz or Russian law requires consent, the consent you give with the checkbox on the form.
• To perform our contract and stay in touch during the project, if we agree to work together. Legal basis – the contract (Art. 6(1)(b)) and legal obligations such as accounting and tax records (Art. 6(1)(c)).
• To see which pages and channels bring in requests, using the form metadata. Legal basis – my legitimate interest (Art. 6(1)(f)).
• To keep the site running and secure, prevent abuse and investigate technical incidents. Legal basis – my legitimate interest (Art. 6(1)(f)).
• To measure visits to the English pages with Yandex Metrica and Google Analytics. Legal basis – your consent (Art. 6(1)(a)), which you give by clicking "Accept analytics" in the cookie banner. Without it, neither service loads.

6. The consent checkbox

The form has a separate checkbox labeled "I agree to the processing of my personal data." By checking it and sending the form, you agree that I may process the form data and form metadata listed in section 3 to reply to you, clarify what you need, prepare a proposal and, if we sign a contract, start the work.

This consent does not cover newsletters or marketing emails.

If we do not sign a contract, your consent lasts until you withdraw it or its purpose is fulfilled. In any case, I keep your request for no more than three years after our last meaningful exchange, unless another legal basis applies.

You can withdraw your consent at any time by emailing order@izotov.agency – it is as easy as giving it. I may take reasonable steps to check that the request comes from you or someone authorized to act for you. Withdrawing consent does not affect processing that took place before it, and it does not require me to delete data I must or may keep on another legal basis.

7. Who else can access your data

Access is limited to what the site and my work require. Below are the providers and situations where someone other than me may have access. If I start using a new provider that can access personal data, I will review this policy and update it if needed.

• Timeweb Cloud (Russia) – hosting for the server, database and technical infrastructure. The database is in Saint Petersburg.
• Beget (Russia) – email infrastructure and delivery of system notifications. When a new request comes in, the email I receive contains only its number; I open the request itself in a password-protected admin panel.
• Yandex (Russia), through Yandex Metrica – web analytics; on the English pages, only after you click "Accept analytics" in the cookie banner. Yandex processes this data on my behalf under the terms of the service.
• Google (USA), through Google Analytics – web analytics, only on the English pages and only after you click "Accept analytics" in the cookie banner. Google processes this data on my behalf under the Google Ads Data Processing Terms, which cover Google Analytics. Advertising features and Google signals are turned off.
• Professional copywriters and developers I bring in for a specific project – only on my instructions and only with the data that task needs, for example a brief with facts from your company, an expert interview or access to your CMS that you grant.
• Telegram and WhatsApp – only if you choose to message me there. They process your messages under their own terms and privacy policies.
• Government authorities or other parties – only when the law requires it, when I need to defend my rights in a dispute, or when you ask me to and there is a legal basis for it.

8. Where your data is stored and transferred

My main database of requests is on a server in Saint Petersburg, Russian Federation. Some of my clients are in Russia, and Russian law requires personal data of Russian citizens collected online to be stored in a database located in Russia.

I am based in the Kyrgyz Republic and access the database remotely from there. This means your data is transferred to Russia and accessed from the Kyrgyz Republic. For transfers between the two countries, I comply with the notification and other requirements of Kyrgyz and Russian law.

If you are visiting from the EU or the UK: neither Russia nor the Kyrgyz Republic is covered by an EU adequacy decision or UK adequacy regulations, which means their laws are not recognized as protecting personal data to the same standard as the GDPR. Your data is protected by the measures in this policy: I collect a short list of data, access is limited to me and the providers named in section 7, and data is kept only for the periods set out in section 9.

If you accept analytics, Google Analytics data may be processed in the United States. Google states that it complies with the EU-U.S. Data Privacy Framework and its UK Extension; where that framework does not apply, its data processing terms rely on the European Commission's standard contractual clauses.

Please note that if you send the form, your data will be stored in Russia and accessed from the Kyrgyz Republic as described in this section.

9. How long I keep your data

I keep data only as long as its purpose requires. If you withdraw consent, I stop the processing that relies on it, but data I need on another legal basis – for example, records of a signed contract – is kept for the period that applies to it.

• Requests that did not lead to a contract – no more than three years after our last meaningful exchange, unless their purpose is fulfilled sooner or another legal basis requires me to keep them.
• Client data – for the term of the contract and afterwards for as long as accounting and tax laws require or as needed to handle claims.
• Server logs and analytics data – for as long as security and analytics require, depending on the settings of the services involved and applicable law. After that, the data is deleted or anonymized. Google Analytics keeps user-level and event-level data for no longer than 14 months, the maximum its settings allow.

10. Your rights

Depending on the law that applies to you, including the GDPR, you have the right to ask me to:

• Confirm whether I process your data and give you a copy of it.
• Correct inaccurate or incomplete data.
• Erase your data, unless I must keep it on another legal basis.
• Restrict processing of your data while a question about it is being resolved.
• Stop processing based on my legitimate interest if you object to it, unless the law allows me to continue.
• Send you the data you gave me in a common machine-readable format.
• Stop processing based on your consent once you withdraw it. Processing that took place before then remains lawful.

11. How to make a request or complaint

Email order@izotov.agency. To make sure I do not give your data to the wrong person, I may ask for reasonable proof that the request comes from you or someone authorized to act for you. I respond to and act on valid requests within the time limits set by applicable law – under the GDPR, usually within one month.

You also have the right to file a complaint with a supervisory authority and to go to court. In the Kyrgyz Republic, that authority is the State Agency for Personal Data Protection under the Cabinet of Ministers; where Russian law applies, it is Roskomnadzor; in the EU or the UK, it is the data protection authority where you live or work.

12. Security

I use legal, organizational and technical measures, in proportion to the scale of the processing, to protect data against unauthorized or accidental access, alteration, blocking, copying, disclosure, loss and deletion. Requests are stored in a password-protected admin panel, and access to them is limited to me and the services named in section 7.

13. Changes to this policy

I update this policy when there are changes in the law, in the services I use or in how I handle data. The current version is always on this page with its date, and the form records that date with each request. An update never counts as your consent to anything that legally requires your separate agreement.