Privacy Policy

Overview

This Privacy Policy explains how Kamilla Gafurzianova ("I", "me", or "Operator") collects, uses, and safeguards personal information when you visit https://kamillek.com or correspond with me regarding operations consulting, AI systems architecture, or advisory services. This Policy is effective as of October 13, 2026.

Because I live and operate in Los Angeles, State of California, United States, and serve clients and partners across both the United States and Europe, this Policy is drafted in full compliance with the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA / CPRA), the California Online Privacy Protection Act (CalOPPA), and the European Union, EEA, United Kingdom, and Swiss General Data Protection Regulation (GDPR / UK GDPR).

Section 1: Data Controller Identity & Contact Information

For the purposes of EU/EEA and UK data protection law (GDPR) and California privacy law (CCPA/CPRA), the Data Controller and Business Operator responsible for your personal information is:

  • Data Controller / Business Operator: Kamilla Gafurzianova, operating as an independent operations and AI systems consultant
  • Principal Place of Business: Los Angeles, State of California, United States
  • Privacy & Data Subject Request (DSAR) Contact: kamillek.com/contact.html#inquiry-form

Section 2: Information We Collect

In accordance with strict data minimization principles (GDPR Article 5(1)(c) and California Civil Code § 1798.100), kamillek.com is engineered with zero user accounts and zero behavioral tracking databases. Over the preceding twelve (12) months, personal information is limited strictly to the following categories:

Executive Inquiry Form & Direct Professional Correspondence

When you voluntarily submit an inquiry through the protected Executive Inquiry Form (kamillek.com/contact.html#inquiry-form) or reach out through verified professional networks such as LinkedIn or Telegram, I collect the contact identifiers and business context you choose to provide, such as your name, role, organization, work email address, engagement track, and project inquiry details. Submissions through the inquiry form are processed through server-side anti-spam and prompt-injection security filters before being logged to our encrypted advisory ledger.

Edge Network Security Logs & Web Typography

When your browser requests a page from kamillek.com, our static hosting edge network automatically processes standard HTTP request metadata, including your IP address, request timestamp, requested URI, HTTP status code, User-Agent, and Referer header. In addition, your browser requests static font files (Inter, Literata, and JetBrains Mono) from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). This technical data is processed solely to establish TLS encryption, deliver page assets, and mitigate distributed denial-of-service (DDoS) or malicious network traffic.

Zero Sensitive Personal Data

I do not request, collect, or infer Special Categories of Personal Data under GDPR Article 9 or Sensitive Personal Information under CPRA (Cal. Civ. Code § 1798.121), such as government identification numbers, financial account credentials on this site, precise geolocation, biometric identifiers, or health records.

Section 3: How We Use Information & GDPR Lawful Bases

For visitors and clients located in the European Union, EEA, United Kingdom, or Switzerland, personal data is processed strictly under the following legal bases set forth in GDPR Article 6(1):

  • Performance of a Contract & Pre-Contractual Steps (Article 6(1)(b) GDPR): Responding to your consulting or advisory inquiries, scoping Statements of Work (SOWs), and delivering contracted services under a Master Services Agreement (MSA).
  • Legitimate Interests (Article 6(1)(f) GDPR): Maintaining network and information security at the CDN edge layer, preventing fraudulent or abusive traffic, delivering readable web typography, and conducting standard B2B professional communications.
  • Legal & Tax Obligations (Article 6(1)(c) GDPR): Retaining executed contracts, invoices, and accounting records required under California and U.S. federal tax laws.
  • Consent (Article 6(1)(a) GDPR): Where you explicitly opt into ongoing correspondence outside an active contractual engagement (you may withdraw consent at any time under Article 7(3) by emailing kamillek.com/contact.html#inquiry-form).

Section 4: Cookies, Local Storage & Global Privacy Control (GPC)

kamillek.com sets zero advertising, analytics, or behavioral tracking cookies, writes zero persistent identifiers to browser localStorage or sessionStorage, and embeds zero third-party marketing pixels. Interactive search and category filtering on the portfolio and certifications pages execute entirely in your browser's local memory without transmitting search terms to a backend server.

Pursuant to the California Online Privacy Protection Act (CalOPPA, Cal. Bus. & Prof. Code § 22575) and CPRA (Cal. Civ. Code § 1798.135), this website honors browser Global Privacy Control (GPC) signals and Do Not Track (DNT) headers by default, as no cross-site tracking, profiling, or selling/sharing of personal information ever occurs.

Section 5: Data Sharing, Subprocessors & External Links

I never sell your personal information (as defined under CCPA/CPRA), never share it for cross-context behavioral advertising, and never disclose client correspondence to data brokers or third-party AI foundation models for training.

To operate this website and communicate securely, I rely on vetted infrastructure subprocessors bound by GDPR Article 28 Data Processing Agreements and CPRA Service Provider terms (using TLS 1.3 encryption in transit and AES-256 encryption at rest):

  • Static Edge Hosting & CDN Security: Vercel Inc. / Cloudflare, Inc.
  • Business Email Infrastructure: Google LLC (Google Workspace / Gmail)

This website contains outbound links to verified professional profiles (LinkedIn, GitHub, Telegram, Instagram, X, Substack, Google Developer) and official credential registries (Credly, Salesforce Trailhead, Coursera, PMI, USOPC). Once you follow an external link, your interaction is governed by the privacy policy of that destination platform.

Section 6: International Data Transfers (Europe to the United States)

Because I operate from California, United States, personal data voluntarily sent to me by clients or visitors in the European Union, EEA, United Kingdom, or Switzerland is transferred to and processed in the United States. Cross-border transfers are protected in accordance with GDPR Chapter V and UK GDPR through:

  • EU-U.S. Data Privacy Framework (DPF): Reliance on core infrastructure providers (including Google LLC and Cloudflare, Inc.) certified under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.
  • Standard Contractual Clauses (SCCs / UK IDTA) & Article 49(1)(b) GDPR: Execution of European Commission Standard Contractual Clauses (Decision (EU) 2021/914) and the UK International Data Transfer Addendum (IDTA) in B2B client agreements where required, alongside GDPR Article 49(1)(b) for transfers necessary to perform a contract or pre-contractual measures requested by a European client.

Section 7: Data Retention

Personal data is retained only for as long as necessary to fulfill the purposes outlined in this Policy (GDPR Article 5(1)(e) and Cal. Civ. Code § 1798.100(a)(3)):

  • Edge Network Security Logs: Retained transiently at the CDN edge layer and automatically rotated within 7 to 30 days.
  • Prospective Business Inquiries (No Executed Contract): Retained for up to 24 months from the date of last correspondence to maintain professional continuity, or deleted immediately upon your request.
  • Executed Consulting Contracts & Tax Records: Retained for the duration of the engagement plus seven (7) years to comply with California and U.S. federal tax and accounting statutes.

Section 8: European Data Subject Rights (EU, EEA, UK & Switzerland)

If you reside in the European Union, EEA, United Kingdom, or Switzerland, you have the following rights under GDPR Articles 15 through 22 and Article 77:

  • Right of Access (Art. 15) & Data Portability (Art. 20): Request confirmation of whether your personal data is processed and receive a structured, machine-readable copy of the data you provided.
  • Right to Rectification (Art. 16) & Erasure (Art. 17 "Right to be Forgotten"): Request correction of inaccurate information or permanent deletion of your correspondence, subject only to mandatory statutory tax retention.
  • Right to Restriction (Art. 18) & Objection (Art. 21): Request restricted processing or object to processing based on legitimate interests. No automated decision-making or profiling (Art. 22) takes place on this website.
  • Right to Lodge a Complaint (Art. 77): You have the right to lodge a complaint with your national EU/EEA Data Protection Authority (listed at edpb.europa.eu), the UK Information Commissioner's Office (ICO, ico.org.uk), or the Swiss Federal Data Protection and Information Commissioner (FDPIC).

Verified European Data Subject Access Requests (DSARs) are fulfilled free of charge within 30 calendar days by contacting kamillek.com/contact.html#inquiry-form.

Section 9: California Privacy Rights (CCPA / CPRA & "Shine the Light")

If you are a California resident, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.) and California's "Shine the Light" law (Cal. Civ. Code § 1798.83) provide you with the following rights:

  • Right to Know & Access: Request disclosure of the categories and specific pieces of personal information collected about you in the preceding 12 months, the sources of that information, and the business purposes for collection.
  • Right to Delete & Correct: Request deletion or correction of personal information maintained about you, subject to statutory exceptions (fulfilled within 45 calendar days).
  • Zero Sale, Sharing, or Direct Marketing Disclosures: I do not sell personal information, share it for cross-context behavioral advertising, or disclose it to third parties for their direct marketing purposes under Cal. Civ. Code § 1798.83.
  • Right to Non-Discrimination: You will never receive discriminatory treatment for exercising any of your California privacy rights.

You or your verified Authorized Agent may submit a request by emailing kamillek.com/contact.html#inquiry-form with the subject line Privacy Rights Request. Verification is performed by matching the email address associated with your prior correspondence without requiring unnecessary government identification.

Section 10: Children's Privacy, Policy Updates & Contact

This website and all consulting services are directed exclusively to adult business professionals and institutional entities (18+) and never knowingly collect personal data from children under 16 years of age (COPPA and GDPR Article 8). If material changes are made to this Privacy Policy, the updated text and revised effective date will be published on this page.

For any questions, privacy inquiries, or data subject requests, please contact Kamilla Gafurzianova at kamillek.com/contact.html#inquiry-form (Los Angeles, California, United States).