# Privacy Policy (CCPA/CPRA & EU/UK GDPR) · Kamilla Gafurzianova
**Website:** [https://kamillek.com](https://kamillek.com) · **Controller:** Kamilla Gafurzianova (Los Angeles, California, USA) · **Direct Email:** [kamillek.com/contact.html#inquiry-form](https://kamillek.com/contact.html#inquiry-form)  
*Effective Date: October 13, 2026*

---

## Privacy by Design Summary
`kamillek.com` is engineered as a static Dual-Plane architecture (HTML + Markdown) with zero commercial tracking cookies, zero third-party advertising pixels, zero behavioral telemetry, and zero web input forms. I **never sell, rent, or share** personal information for cross-context behavioral advertising, and I honor full statutory data protection rights for residents of **California (CCPA/CPRA)** and the **European Union, EEA, United Kingdom, and Switzerland (GDPR)**.

## 1. Data Controller Identity & Scope
- **Data Controller (GDPR) / Business Operator (CCPA/CPRA):** Kamilla Gafurzianova, independent operations and AI systems consultant.
- **Principal Place of Operation:** Los Angeles, State of California, United States.
- **Privacy & DSAR Contact:** [kamillek.com/contact.html#inquiry-form](https://kamillek.com/contact.html#inquiry-form)

## 2. Categories of Personal Data Collected (12-Month Lookback)
1. **Direct Professional Correspondence:** `kamillek.com` contains no HTML input forms or backend databases. When you initiate contact via direct email (`https://kamillek.com/contact.html#inquiry-form`) or verified external profiles (LinkedIn, Telegram), I receive the contact identifiers and project context you voluntarily supply.
2. **Static Edge Telemetry:** Transient HTTP logs (IP address, timestamp, URI, HTTP status, `User-Agent`, and `Referer`) processed at the CDN edge layer solely for TLS termination, DDoS mitigation, and asset delivery.
3. **Web Typography (Google Fonts):** Browser requests to `fonts.googleapis.com` and `fonts.gstatic.com` (Google LLC) to load `Inter`, `Literata`, and `JetBrains Mono` font files.
4. **No Sensitive Data:** No GDPR Article 9 special-category data or CPRA Sensitive Personal Information (Cal. Civ. Code § 1798.121) is requested or collected.

## 3. Lawful Bases for Processing (EU / EEA / UK GDPR Article 6(1))
- **Article 6(1)(b) (Contract / Pre-Contractual Steps):** Responding to consulting inquiries, scoping Statements of Work (SOWs), and performing client engagements.
- **Article 6(1)(f) (Legitimate Interests):** Edge network security, DDoS defense, and typography delivery.
- **Article 6(1)(c) (Legal Obligation):** Tax, accounting, and statutory record-keeping for executed engagements.
- **Article 6(1)(a) (Consent):** Optional correspondence outside an active contract (withdrawable at any time under Article 7(3)).

## 4. Cookies, Local Storage & Global Privacy Control (ePrivacy & CalOPPA)
Zero tracking cookies, zero `localStorage` or `sessionStorage` identifiers, and zero third-party analytics SDKs are used. Interactive filtering on `work.html` and `certifications.html` executes strictly in volatile browser memory. `Global Privacy Control (GPC)` and `Do Not Track (DNT)` signals are honored by default.

## 5. Data Retention Schedule
- **Edge Security Logs:** 7 to 30 days.
- **Preliminary Inquiries (No Engagement Executed):** Up to 24 months from last correspondence, or erased immediately upon request.
- **Executed Contracts & Tax Records:** Duration of engagement plus 7 years per California and U.S. tax statutes.

## 6. International Data Transfers (EU / EEA / UK / Switzerland to the United States)
Personal data voluntarily sent by European clients or visitors is processed in California, United States, safeguarded under GDPR Chapter V via: (a) infrastructure providers certified under the **EU-U.S. Data Privacy Framework (DPF)**, UK Extension, and Swiss-U.S. DPF; (b) European Commission **Standard Contractual Clauses (SCCs, Decision (EU) 2021/914)** and the **UK IDTA** in B2B agreements; and (c) **GDPR Article 49(1)(b)** for pre-contractual and contractual performance requested by the client.

## 7. European (GDPR) & California (CCPA/CPRA) Privacy Rights
- **European Data Subjects (GDPR Arts. 15-22 & 77):** Rights of access, rectification, erasure ("right to be forgotten"), restriction, portability, objection, and the right to lodge a complaint with an EU/EEA supervisory authority (`edpb.europa.eu`), the UK ICO (`ico.org.uk`), or the Swiss FDPIC. Verified DSARs are fulfilled within **30 calendar days**.
- **California Residents (CCPA/CPRA & Cal. Civ. Code § 1798.83):** Rights to know/access, delete, correct, and non-discrimination. Zero personal information is sold or shared for cross-context behavioral advertising or third-party direct marketing.
- **Submit Requests To:** [kamillek.com/contact.html#inquiry-form](https://kamillek.com/contact.html#inquiry-form)