Skip to content

Privacy policy

Effective date: 2026-11-06

This policy explains how we handle personal data when you visit this website, contact us, or order our services — custom websites and web applications, customer support and messaging automation, private AI agents and AI consulting, isolated private cloud and managed self-hosted infrastructure, and related support and managed operations. It is written for our predominantly international business clientele and follows a data-minimising approach: we collect little, we do not sell personal data, and we do not use it for advertising.

Who is responsible

ИП Зиверт Давид (tax number 23108198950056) is the controller for the processing described here as our own processing. Contact for privacy matters: hi@david-siewert.com. Public business/contact address: Issyk-Kul Region, Karakol, 722000, Voskhod Microdistrict, Building 20, Apartment 33. Where the law applicable to you provides for a representative or additional contact details, we will provide them on request through the contact above.

When we act as controller or as processor

We act as controller for our own business processes: operating and securing this website, responding to inquiries, arranging meetings, and agreeing, invoicing, and accounting for our services. Sections below describe this controller processing.

We act as processor (service provider) for the personal data that a client, its team, its customers, or other users store or process in systems we build, host, or operate for that client — for example a website or web application, a customer support inbox, a private AI environment, or a private cloud. In that role the client is the controller: we process such data only on the client's documented instructions and as set out in the order and any agreed data processing agreement (DPA), we do not use it for our own purposes, and the client's own privacy notice applies to its users. If you are a user of a client's system, please contact that client first; we will forward requests we receive to the client concerned where required and support the client in handling them. A DPA can be included in or added to an order, for example for clients subject to the GDPR or comparable laws.

Categories of personal data

As controller, we handle only the personal data that is relevant to running this website and our client work. Depending on how you interact with us, this may include, for example:

  • Contact and communication details, such as your name, company, email address, and the content of messages you send us, including any attachments and information you choose to share about an inquiry or project.
  • Meeting details, such as your name, contact details, and appointment times, where you arrange a conversation with us, for example through a scheduling link on this site.
  • Order, project, and billing records, such as order references, contracts, invoices, payment status, and transaction identifiers needed to agree, deliver, support, and account for our services.
  • Client team and administration details for managed services, such as the names, business contact details, roles, and account or access records of your authorised users, where needed to set up, secure, and support systems we operate for you.
  • Technical and usage records generated when this site (and, in our processor role, client systems) is delivered and kept secure, such as network identifiers, request times, requested pages, browser or device information, and error or security logs.
  • Preferences stored locally on your own device, such as display settings you choose in your browser; these remain on your device and can be removed through your browser's site-data settings.

We do not ask for sensitive (special-category) personal data, full payment card details, or personal data about other people. Please do not send such data unless an order expressly provides for it with suitable safeguards. If you contact us on someone else's behalf, please make sure you are entitled to share their details.

We use personal data only for relevant, lawful purposes, including to operate, maintain, and secure this website; to respond to inquiries and arrange meetings; to prepare proposals; to agree, deliver, invoice, and support orders and projects, including administering authorised users of managed systems; to keep business, accounting, and tax records; to address complaints and protect or defend claims; and to comply with legal obligations.

Depending on the purpose, we rely on one or more of the following grounds: steps you ask us to take before entering into a contract and performance of that contract; our legitimate interests, for example in a functioning and secure website, orderly business communications, fraud and abuse prevention, and the establishment, exercise, or defence of claims, balanced against your rights; your consent, where it is required; and compliance with a legal obligation.

Merely visiting this site does not amount to consent to any additional processing. Where consent is required, it is obtained separately and may be withdrawn at any time without affecting the lawfulness of earlier processing. We do not require consent as a substitute for a contract or another applicable legal ground. If information is necessary to respond to an inquiry or perform an order, not providing it may prevent that response or performance. We do not send marketing emails to persons who have not asked for them; where we occasionally contact existing business contacts about our own similar services, you may object at any time and we will stop.

What we do not do

  • We do not sell personal data and do not share it for third-party advertising or cross-context behavioural advertising.
  • We do not use analytics or advertising tracking on this website (see the cookies section below).
  • We do not train AI models on client content or on personal data processed in a client's private AI environment, support inbox, web application, or private cloud — neither for other clients nor for our own general purposes. Where an order provides for a private or local AI model, processing stays within that environment as agreed; external AI model providers are connected only where the order provides for them or the client instructs us to do so.
  • We do not access client content in systems we operate for a client except as needed to provide, secure, or support the agreed service, on the client's instruction, or as required by law; support access is limited to authorised persons.
  • We do not make decisions about website visitors based solely on automated processing that produce legal or similarly significant effects. AI features inside client systems operate under the respective client's control and responsibility, with human review as agreed with that client.

Cookies and similar technologies

This site itself relies only on technologies that are strictly necessary for it to function and for choices you store locally in your own browser, such as a display (theme) preference kept in your browser's local storage. We do not use analytics or advertising cookies on this site. If that ever changes, this policy will be updated and, where required, your consent will be requested before any such technology is used.

Content and links provided by third parties, such as a scheduling service you choose to open or social profiles you choose to visit, apply their own notices and technologies once you leave this site or interact with them; please consult those notices. Websites and systems we build for clients have their own privacy and cookie notices provided by the respective client.

Recipients and service providers

We share personal data only where relevant to the purpose, and only with appropriate categories of recipients, such as: providers that host, deliver, or secure this website; providers that host or operate client systems in the location agreed for the respective project (for example a dedicated server in the client's preferred region or on the client's premises); communication and scheduling services used for business correspondence and requested appointments; payment providers and participating banks where a payment option is offered for a particular order; external AI or platform providers only where a client's order provides for their use; and professional advisers or public authorities where necessary and lawful, for example for accounting, legal compliance, or claims.

The specific providers we use may change from time to time as our setup evolves; the categories above remain the reference. For managed services, the order or DPA may name specific sub-processors or a procedure for informing the client about changes. We limit each disclosure to what its purpose requires and apply appropriate contractual and security measures with service providers.

Where card payment is offered for an order, payment details are entered only through the payment provider's designated secure interface. We do not request or store full card numbers or card security codes, including by email; please do not send them to us.

International transfers

We are based in the Kyrgyz Republic and serve clients internationally, so processing may involve more than one country — for example where you are located abroad, where a client system is hosted in the region the client chose, or where a service provider is established. If processing involves a transfer of personal data to another country, the applicable legal transfer requirements and safeguards must be satisfied (such as an adequacy decision, standard contractual clauses, or another safeguard recognised by the law applicable to the transfer); this policy does not assume any particular destination country, nor that a transfer is permitted without those safeguards. You may contact us for information about the recipients and safeguards relevant to your data, and, where applicable, for a copy of the safeguard used with any confidential parts removed.

Retention and security

We keep personal data only for as long as necessary for the relevant purpose: inquiry correspondence while handling your request and for a reasonable follow-up period; order, project, and billing records for the duration of the contract and the applicable accounting, tax, or other legal retention duties; and technical or security logs for a limited period needed to operate and secure the systems, longer only where needed to investigate an incident or defend claims. Data that is no longer needed is deleted or anonymised, subject to lawful retention requirements. For data processed as processor, retention and deletion follow the client's instructions and the order or DPA, including deletion or return after the service ends as agreed there.

We use proportionate technical and organisational safeguards appropriate to the service, such as access restrictions on a need-to-know basis, individual accounts with multi-factor authentication where appropriate, encryption of data in transit, and, for managed systems within the agreed scope, security updates, monitoring, and backups. No system can guarantee absolute security. If a personal-data incident affects data for which we are processor, we will inform the client concerned without undue delay after becoming aware of it and support the client as agreed in the order or DPA; where we are controller, we will meet the notification duties of the applicable law.

Your rights, complaints, and other jurisdictions

Under the applicable provisions of the Kyrgyz Republic's Digital Code No. 178 of 31 July 2025, you may request information about processing and access to your data, correction, deletion, or restriction, and exercise applicable objection and portability rights. These rights are subject to their legal conditions and exceptions; identity verification may be necessary. You may withdraw any consent given and challenge unlawful processing. We respond to requests within the periods required by the applicable law and, as a rule, free of charge unless that law allows a fee for manifestly unfounded or excessive requests.

If you are located in another jurisdiction, additional or corresponding rights under your local law may apply. For persons in the European Economic Area or the United Kingdom, these include in particular access, rectification, erasure, restriction, portability, and objection under the GDPR or UK GDPR. For persons in certain US states and other jurisdictions with comparable privacy laws, rights may include knowing, correcting, or deleting personal data and opting out of a "sale" or "sharing" of personal data — we do not sell or share personal data in that sense, so no opt-out is needed. Contact us and we will assess and handle your request under the law applicable to you. You may also contact the supervisory authority in your country. For data processed as processor for a client, please direct your request to that client as controller; we will support the client in responding.

Send requests or privacy complaints to hi@david-siewert.com or the public contact address above. You may also complain to the State Agency for Personal Data Protection under the Cabinet of Ministers of the Kyrgyz Republic, or seek judicial protection. Official regulator information and the Digital Code are available at dpa.gov.kg and the regulator's legal register. Nothing here limits mandatory rights.

Children

This site and our services are directed at business clients and are not directed at children. We do not knowingly collect personal data from children; if you believe a child has provided us with personal data, please contact us so that we can remove it where required.

Changes

The effective date above identifies this version. Material changes will be published on this page with a new effective date; where appropriate for ongoing client relationships, we will also draw material changes to affected clients' attention through the usual contact channels. Any new processing that requires consent or another legal step will not be authorised merely by changing this notice.