Privacy Notice

1. Who is responsible

Anton Karizsky, trading as EvidView, is the controller of personal data processed for this website and related business inquiries. EvidView is currently operated by an individual and is not a separate incorporated legal entity. For privacy questions, rights requests or complaints, contact privacy@evidview.com.

No UK or EU representative is appointed for the current non-trading, neutral informational, occasional, and low-risk processing scope. This position relies on the absence of an active locally targeted service or behavioural monitoring and, where applicable to an occasional inquiry, the representative exceptions for low-risk processing without large-scale special-category or criminal-offence data. It is not a general exemption from UK or EU data-protection law and will be reassessed before trading, locally targeted activity, analytics, profiling, sensitive data, or material growth.

We do not publish a residential location. The project role email addresses are the public contact channels for the current informational site. A verified service or representative address will be added if a later entity, registration, appointment, trading, contractual, consumer, or other applicable obligation requires one.

2. Scope

This notice covers visits to the public website, consent choices, and information you choose to submit through website contact journeys. It does not cover the authenticated EvidView product, customer-controlled document processing, employment, or third-party sites linked from this website.

3. Personal data and technical information

We collect the information you choose to provide: inquiry type, email address, and, where shown, optional name, organization, role, and non-confidential note. We also record a receipt identifier, submission time, locale, and the version of the Privacy Notice shown to you.

Cloudflare processes technical data needed to deliver and protect the site, which may include IP address, request time and path, user-agent and browser information, TLS and bot-detection signals, approximate country, security-cookie identifiers where enabled, and request/response metadata. Turnstile does not receive your form entries, but it processes security signals described in Cloudflare's Turnstile Privacy Addendum.

Optional website analytics is currently disabled. If we introduce optional analytics, we will update this Notice before collection begins and request consent before activating it.

Do not send controlled documents, source excerpts, credentials, patient information, special-category data, export-controlled material, or confidential content. If we discover prohibited content in a submission, we will restrict access and delete it unless retention is legally required.

4. Why we use data and legal basis

We process inquiry information to assess, route, and respond to the conversation requested. For ordinary business inquiries from representatives of an organisation, we ordinarily rely on our legitimate interests in handling relevant B2B communications and document that assessment. Taking steps before entering a contract applies only where the person providing the data is expected to be a party to that contract and asks us to take those steps.

We process delivery, security, abuse-prevention, and operational metadata on the basis of our legitimate interests in operating and protecting the website and, where applicable, compliance with legal obligations.

We record the Privacy Notice and Website Terms versions presented with a production inquiry so that we can demonstrate which information and terms applied. Optional analytics is currently disabled. If introduced later, it will require an explicit opt-in and a persistent way to withdraw that choice; withdrawal will not affect processing already carried out.

We do not add a person to a marketing list merely because they submitted an inquiry. Any promotional follow-up must use a separately documented lawful basis and provide a clear opt-out.

Email and inquiry type are required so that we can route and respond to the request. Other form fields are optional. There is no statutory requirement to submit the form. Submitting an inquiry does not create a contract for a product, pilot, design-partner engagement, or services; the Website Terms separately govern use of the website and submission journey.

5. Providers and transfers

We use Cloudflare, Inc. for DNS, website delivery and security, Workers, Turnstile, and D1 storage. Cloudflare acts as our processor when it uses Turnstile signals to protect the website and as a controller when it uses those signals to improve Turnstile. Cloudflare explains this processing at https://www.cloudflare.com/turnstile-privacy-policy/.

The form database is configured to run and persist in the European Union. This setting does not prevent Workers, security systems, logs, or support personnel from processing data elsewhere. Cloudflare's standard Data Processing Addendum version 6.4 records the EU Standard Contractual Clauses and UK Addendum as applicable transfer safeguards. Information about available safeguards may be requested at privacy@evidview.com.

We use Beget LLC for project mailboxes, forwarding of role-address messages, delivery of minimal receipt notifications, and replies to business inquiries. Beget's public policy states that its own user databases are located in Russia, that service providers may receive data to deliver services, and that cross-border transfers may occur to perform a customer contract or request. Its public materials do not state a mailbox-backup deletion period or UK/EU transfer safeguard for message content. We therefore minimise notification content: a form receipt email contains only a receipt identifier, inquiry category, and timestamp, with no visitor-entered form fields. There is no separate CRM or relationship-management system at launch.

We may also disclose limited information when required by law, to protect legal rights, or to professional advisers subject to confidentiality duties.

• Form D1 uses an EU jurisdiction constraint. That controls where the database runs and persists; it does not by itself restrict every location from which Workers may access it.
• No new remote font, media host, CRM, scheduler, tag manager, or provider may receive data until the subprocessor inventory and notice are updated and approved.

6. Retention and deletion

Active website inquiry rows are deleted 30 days after submission unless deleted earlier following an approved request or retained for a specific legal obligation. Under the current Cloudflare Workers Free plan, D1 recovery history may remain available for up to seven additional days after active deletion. Recovery history is not used for ordinary access, and any restoration must reapply recorded deletions before access resumes.

A minimal deletion ledger is retained for 35 days from the time each deletion action is recorded. It contains an action ID, receipt ID, reason code, recorded time, and expiry time, but no email address, name, organisation, role, note, IP address, or form body. Because a receipt ID may remain linkable to a person, the ledger is treated as personal data. Its recovery history may remain available for up to seven additional days under the current plan.

Worker observability is disabled for the production form at launch, and visitor-entered fields are not intentionally written to operational logs. Cloudflare may retain infrastructure and security records under the enabled service and provider terms for service operation, abuse prevention, security, and legal obligations. The browser privacy preference expires after six months.

Project email concerning an inquiry is retained for up to 12 months after the last meaningful human contact. Automated notices do not restart that period. EvidView reviews and deletes the relevant Beget mailbox, forwarded Gmail copy, Sent folders, and manually maintained archives. Provider backups may expire on the provider's own undisclosed schedule and are not used for ordinary access. A separately governed contractual relationship, an earlier appropriate deletion, or a legal obligation or legal hold may change the period.

Optional analytics is disabled. Its production retention and deletion rules will be documented in an updated Notice before analytics is enabled.

• A qualified opportunity may move to a separately governed relationship system only after an accountable person records the purpose; the original website row still expires on schedule.
• A specific legal hold or legal obligation may require limited longer retention.
• An opaque receipt identifier remains personal data while it can be linked back to a submission.

7. Your choices and rights

Depending on the law and our reason for processing, you may ask for access, correction, deletion, restriction, or portability of your personal data, or object to processing. You may withdraw consent at any time. The right to object to direct marketing is unconditional.

Send a rights request or data-protection complaint to privacy@evidview.com. We may request only information reasonably necessary to confirm identity. We normally respond to UK rights requests within one calendar month, subject to permitted clarification or extension. We acknowledge UK data-protection complaints within 30 days, investigate them without undue delay, keep the complainant informed, and communicate the outcome.

UK visitors may complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/. Visitors elsewhere may contact their competent privacy regulator.

8. Tracking and California disclosure

We do not sell personal information, share it for cross-context behavioral advertising, or use third-party advertising trackers. Cloudflare may process Turnstile signals under its own notice to improve bot detection; we do not receive or use those signals for advertising.

Because the site does not perform cross-site advertising tracking, browser Do Not Track signals do not change essential delivery or security processing. Optional analytics is currently disabled. Other parties are not permitted to collect personally identifiable information across unrelated websites through EvidView for advertising purposes.

9. Automated decisions and children

The public website is not intended to make decisions with legal or similarly significant effects about visitors. EvidView is a business website and is not directed to anyone under 18. People under 18 should not submit the contact form. We do not knowingly collect children's personal data through the form; if we learn that this occurred, we will delete it unless the law requires otherwise.

10. Security and incidents

We use controls proportionate to the current public website, including TLS, browser security headers, secrets management, origin checks, rate controls, Turnstile, restricted operational monitoring, short form retention, and rehearsed deletion and recovery procedures. No system is absolutely secure, and this is not a claim of certification, regulatory compliance, penetration testing, or absence of risk. Security concerns may be reported to security@evidview.com.

11. Changes to this notice

Effective date: 17 September 2026. Version: privacy-2026-09-17-v1. We post the current Notice at this URL. Material changes will be identified on the page and, where appropriate, communicated before the changed processing begins. Where a new purpose requires consent, we will request a new choice.