DRAFT — Requires legal review before publication. Bracketed fields are operator configuration placeholders.
1. Data controller and contact
[LEGAL ENTITY NAME], [REGISTRATION NUMBER], [REGISTERED ADDRESS] is the intended data controller. Contact: [PRIVACY CONTACT EMAIL]. These details must be completed before publication.
2. Information collected
When you submit an inquiry, we receive your name, business email, message, inquiry type and consent. Company, Telegram and budget are optional. A pseudonymized network identifier and short-lived submission identifiers may be processed to prevent spam. No advertising analytics or non-essential cookies are currently implemented.
3. Purposes and legal bases
Inquiry data is used to assess and respond to business opportunities. Depending on applicable law and the inquiry, processing may rely on steps before entering a contract, legitimate interests in business communication and abuse prevention, or consent where appropriate. [CONFIRM APPLICABLE BASES AND LEGITIMATE INTEREST ASSESSMENT]. The checkbox acknowledges the processing described here; it is not marketing permission.
4. Recipients and processors
[HOSTING PROVIDER], [CRM OR EMAIL DELIVERY PROVIDER] and authorized personnel may process information as necessary. Complete the list and appropriate processing agreements before enabling delivery. Inquiry payloads are not written to application logs or stored in this application.
5. International transfers
[IDENTIFY PROCESSING LOCATIONS AND APPLICABLE TRANSFER SAFEGUARDS]. Assess any transfers before connecting a delivery provider.
6. Retention
[SET INQUIRY RETENTION PERIOD AND DELETION PROCESS]. Rate-limit identifiers expire after ten minutes; duplicate payload hashes expire after one minute. The configured CRM must implement the approved retention period.
7. Your rights
Depending on applicable law, you may have rights to access, correction, deletion, restriction, objection and portability, as well as withdrawal of consent where processing relies on it. Contact [PRIVACY CONTACT EMAIL]. You may also have a right to complain to [RELEVANT SUPERVISORY AUTHORITY].
8. Security
We use server-side validation, request size limits, origin checks, spam controls and restricted delivery credentials. Production delivery requires shared rate limiting. Complete access-control and incident-response procedures for the chosen hosting and CRM services.
9. Cookies and analytics
This implementation does not include non-essential cookies, advertising pixels or analytics. Review hosting infrastructure before launch. Any future non-essential tracking must be documented and consent-gated where required.
10. Contact and updates
Send privacy questions to [PRIVACY CONTACT EMAIL]. [INSERT EFFECTIVE DATE] and [DOCUMENT UPDATE PROCEDURE].