Last updated: March 13, 2026
NAKO Agency ("we", "our", "Company") acts as the data controller for personal data collected through this website.
Website: nakoagency.com.
This Privacy Policy applies to all users worldwide, regardless of location.
We operate across the following jurisdictions: Moldova, Romania, Ukraine, Poland, Germany, Italy, Russia, and Kazakhstan.
Applicable data protection regulations include: the General Data Protection Regulation (GDPR) for the European Union; Law No. 195/2024 on Personal Data Protection (Moldova); Law No. 2297-VI on Personal Data Protection (Ukraine); Federal Law No. 152-FZ on Personal Data (Russia); Law No. 94-V on Personal Data and Their Protection (Kazakhstan).
Personal data provided through forms: name, email address, phone number, Telegram username, company name, and project description.
Automatically collected data: IP address (anonymized for EU users), browser type, device information, pages visited, and referrer URL.
Cookies: we use necessary, analytics, marketing, and preference cookies. For details, please see our Cookie Policy.
Third-party services that may collect data: Google Analytics 4 and Vercel Analytics.
Processing form submissions — legal basis: your consent (Art. 6(1)(a) GDPR).
Communication about projects and services — legal basis: contractual necessity (Art. 6(1)(b) GDPR).
Website improvement and analytics — legal basis: legitimate interest (Art. 6(1)(f) GDPR).
Legal compliance — legal basis: legal obligation (Art. 6(1)(c) GDPR).
Marketing communications (only with your explicit consent) — legal basis: consent (Art. 6(1)(a) GDPR).
We use the following categories of cookies: necessary (always active), analytics (opt-in), marketing (opt-in), and preferences (opt-in).
Google Consent Mode v2 is implemented on our website.
Before you provide consent, no non-essential cookies are set.
You can manage your cookie preferences via the cookie banner displayed on your first visit, or through the "Cookie Settings" link in the website footer at any time.
For full details on the cookies we use, their purposes, and retention periods, please see our Cookie Policy page.
We do NOT sell your personal data under any circumstances.
We share data with the following service providers (data processors): Vercel Inc. (hosting, United States — protected by EU Standard Contractual Clauses); Resend Inc. (email delivery, United States — protected by EU Standard Contractual Clauses); Google LLC (analytics, United States — protected by EU Standard Contractual Clauses); Telegram FZ-LLC (lead notifications via Telegram Bot API, UAE/UK — data transmitted in transit only, not stored).
We may disclose data to legal authorities upon lawful request.
All third-party processors are bound by Data Processing Agreements (DPAs) that ensure an adequate level of data protection.
Our website is hosted on the Vercel Inc. platform (USA). When you submit a form, your data is processed in transit by Vercel servers located in the USA and EU, and immediately forwarded to our email and Telegram. Personal data is not stored on Vercel servers or in any databases.
By submitting a form, you consent to the cross-border transfer of your data to the specified jurisdictions.
Third-party services and their locations: Vercel Inc. (USA/EU) — hosting and transit form processing; Google LLC (USA) — analytics (Google Analytics 4); Resend Inc. (USA) — email delivery; Telegram FZ-LLC (UAE/UK) — lead notifications.
Safeguards for EU residents: data transfers to the USA are based on EU Standard Contractual Clauses (SCCs) concluded between us and our service providers. All data is encrypted in transit (TLS 1.2+).
For Russian residents (152-FZ): personal data submitted through website forms is processed in transit and is not stored on servers outside the Russian Federation. Data is forwarded to the operator's email and messenger. By submitting a form, you confirm your consent to cross-border data transfer in accordance with Art. 12 of Federal Law No. 152-FZ.
For Kazakh residents (Law No. 94-V): personal data is processed in transit and is not stored on servers. By submitting a form, you confirm your consent to cross-border data transfer in accordance with the legislation of the Republic of Kazakhstan on personal data.
For residents of Moldova, Ukraine, Poland, Germany, Italy, and Romania: safeguards provided by the GDPR (EU Regulation 2016/679) and the respective national legislation apply.
Form submissions: retained for 2 years from the date of submission, then permanently deleted.
Analytics data: retained for 14 months (Google Analytics 4 standard retention period).
Cookies: retention varies by type; see our Cookie Policy for specific durations.
Cookie consent records: retained for 3 years as proof of GDPR compliance.
Upon your request: personal data will be deleted within 30 days.
All users have the right to: access their personal data, request rectification of inaccurate data, request deletion of their data, and withdraw consent to data processing.
EU residents (under GDPR) additionally have the right to: data portability, restriction of processing, objection to processing, and the right not to be subject to automated decision-making. Relevant supervisory authorities: ANSPDCP (Romania), UODO (Poland), BfDI (Germany), Garante per la protezione dei dati personali (Italy).
Russian residents (under 152-FZ) have the right to: access, correction, blocking, and destruction of personal data, as well as withdrawal of consent. Supervisory authority: Roskomnadzor.
Kazakh residents (under Law No. 94-V) have the right to: access, correction, and deletion of personal data. Contact: Committee on Information Security of the Ministry of Digital Development.
Moldovan residents (under Law No. 195/2024) will have GDPR-equivalent rights from August 2026. Supervisory authority: National Centre for Personal Data Protection (NCPDP).
Ukrainian residents (under Law No. 2297-VI) have the right to: access, correction, deletion of personal data, and withdrawal of consent. Supervisory authority: Ukrainian Parliament Commissioner for Human Rights (Ombudsman of Ukraine).
To exercise any of your rights, please contact us at: hello@nakoagency.com. We will respond within 30 days of receiving your request.
All data is encrypted in transit using HTTPS/TLS protocols.
Access to personal data is restricted to authorized personnel only.
We conduct regular security reviews of our systems and processes.
While no method of electronic transmission or storage is 100% secure, in the event of a data breach we will notify affected users within 72 hours as required by the GDPR.
This website is not intended for use by children.
Age thresholds for consent vary by jurisdiction: under 16 in Germany and the Netherlands; under 14 in Italy; under 13 in Poland and by default in other jurisdictions.
We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.
We may update this Privacy Policy from time to time. Changes become effective upon publication on the website.
In the event of material changes, users will be notified via a banner on the website.
The date of the last update is indicated at the top of this document.
Data Controller: NAKO Agency.
Email: hello@nakoagency.com.
Website: nakoagency.com.
For GDPR-specific inquiries, please write to: hello@nakoagency.com.