Privacy Policy

Effective date: 8 August 2026 Data Controller: AVIGAN Engineering Bureau LLC

1. Who we are

The data controller of your personal data is AVIGAN Engineering Bureau LLC (hereinafter — “we”, “us”, “AVIGAN”), the official partner of WIKA AG in Ukraine since 2003. We provide services for selecting and supplying industrial pressure, temperature, level, and flow measurement equipment.

Legal address: [___] EDRPOU: [___] Email: info@avigan.com.ua Phone: +38 (067) 285-77-70 Website: https://avigan.com.ua

This Privacy Policy describes what personal data we collect through the website avigan.com.ua/wika, for what purposes, on what legal grounds, and how we process it. It complies with the requirements of the EU Regulation 2016/679 (GDPR) and the Law of Ukraine “On the Protection of Personal Data” No. 2297-VI.

2. What data we collect

Data you provide to us

When you fill out a request form (request for a commercial offer, consultation, or technical selection), we collect:

• First name and last name — for a personal response
• Email — to send a reply or a commercial offer
• Phone number — for prompt communication (optional)
• Company name — to understand the context of the request and prepare the commercial offer
• Request text — a description of your task, questions, or equipment requirements
• Technical product specifications — if you provide them optionally to clarify the selection

We do not request payment information, passport data, or any other sensitive category of data through the website form.

Data collected automatically

When visiting the website, our systems automatically record:

• IP address — used exclusively to protect against spam and abuse (automatically deleted after 30 days)
• Browser and device type (user-agent) — for proper display of the website and analysis of technical errors
• Referrer page address (referrer) — to understand where visitors came from
• Language settings (locale cookie) — to display the website in the corresponding language

AI assistant data

When you use the AI equipment-selection assistant, the query text you enter is transmitted to external AI providers (see Section 5) to automatically compile a selection of instruments. Please do not include personal data (name, email, phone number) in your query — it is not needed for equipment selection. Email addresses and phone numbers that accidentally end up in the text are automatically masked before being stored in our technical logs.

3. Legal grounds for processing

We process your data only when there is a lawful basis under Article 6 GDPR:

• Art. 6(1)(b) — Performance of a contract or pre-contractual measures. When you submit a request for equipment selection or a commercial offer, processing your contact data is necessary to fulfill your requests before a contract is concluded.

• Art. 6(1)(f) — Legitimate interests. We have a legitimate interest in processing the received contact data to respond to your request and support business communication. This interest does not override your rights and freedoms because you initiated contact yourself.

• Art. 6(1)(c) — Compliance with a legal obligation. Certain data (e.g., data about business transactions) is processed to comply with the requirements of accounting and tax legislation of Ukraine.

• Art. 6(1)(a) — Consent. If we ever offer a mailing list or marketing communications, they will be based exclusively on your explicit consent, which you can withdraw at any time. As of today, marketing mailing is not available.

4. How we use your data

Your personal data is used exclusively for the following purposes:

Processing and responding to a request. After receiving your request, an AVIGAN manager processes it and contacts you to clarify details, select the appropriate equipment, or prepare a commercial offer. Without your contact details, we cannot respond.

Protection against spam and abuse. The request form and the AI assistant are protected by server-side rate limiting; your IP address is processed briefly as part of this protection.

Equipment selection by the AI assistant. The query text entered into the AI assistant is processed automatically to find suitable instruments in the catalog; the result is a list of recommended models. Queries are not linked to your identity; your IP address is used briefly (a few minutes) solely for rate limiting.

5. Who receives your data

We do not sell your data to third parties and do not transfer it for advertising purposes. To operate the website, we engage the following data processors, each of which acts exclusively on our instructions:

In addition, we may be required to disclose certain data to Ukrainian government authorities (State Tax Service, courts) in cases provided for by law. Such disclosure is carried out exclusively based on an official request and to the minimum necessary extent.

6. Data transfers outside Ukraine and the EEA

Some of our processors (Resend, Vercel, OpenRouter, OpenAI, Upstash) are located in or process data in the United States of America, which is not a country with an “adequate level of protection” within the meaning of GDPR.

To ensure proper protection of your data during such transfers, we take the following measures:

• We enter into a Data Processing Agreement with each of the specified processors in accordance with GDPR requirements.
• We rely on Standard Contractual Clauses (SCC) approved by the European Commission as a mechanism for data transfers.
• Additionally, we verify the presence of appropriate technical and organizational measures at the providers.

Regardless of where processing takes place, your rights described in Section 8 remain fully applicable.

7. Retention periods

We store your data no longer than necessary to achieve the processing purposes:

• Request form data (name, email, phone, company, message) — 36 months from the date of the last contact or until your written request for deletion, whichever occurs first.
• Anti-spam verification logs (IP) — 30 days, after which they are automatically deleted.
• Accounting and tax records documents that may contain your details — 7 years in accordance with the Law of Ukraine “On Accounting and Financial Reporting” and the requirements of the State Tax Service.
• Cookie NEXT_LOCALE (language setting) — until the end of the browser session or until manually cleared.
• AI assistant query log (query text with masked emails/phone numbers, language, list of recommended models) — 90 days, after which it is automatically deleted.
• AI query rate-limiting counters (IP) — a few minutes, after which they are automatically deleted.

8. Your rights

Pursuant to GDPR (Articles 15–22) and the Law of Ukraine “On the Protection of Personal Data” No. 2297-VI, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR). You have the right to obtain confirmation as to whether we process your data and a copy of such data.

• Right to rectification (Art. 16 GDPR). If your data is inaccurate or outdated, you may request its rectification.

• Right to erasure (Art. 17 GDPR). You have the right to request deletion of your personal data if it is no longer necessary for the purposes for which it was collected, or if you object to its processing. Erasure does not apply to data processed based on a legal obligation (e.g., accounting documents).

• Right to restriction of processing (Art. 18 GDPR). In cases provided by law, you may request that we restrict the processing of your data, leaving only its storage.

• Right to data portability (Art. 20 GDPR). You have the right to receive your data in a structured, commonly used, machine-readable format and to transmit it to another controller if processing is based on consent or a contract.

• Right to object (Art. 21 GDPR). You have the right to object to processing based on legitimate interests if your specific circumstances require it. We will stop processing if we cannot demonstrate the existence of overriding legitimate grounds.

• Right to withdraw consent. If we ever process your data based on consent, you can withdraw it at any time without giving reasons. Withdrawal does not affect the lawfulness of processing before the withdrawal.

• Right to lodge a complaint with a supervisory authority. If you believe your rights have been violated, you have the right to file a complaint with the Authorized Representative of the Verkhovna Rada of Ukraine for Human Rights (ombudsman.gov.ua). For EU residents, a complaint to the competent data protection supervisory authority in your country is also available.

To exercise any of these rights, contact us using the method specified in Section 11.

9. Cookies and local storage

We aim to minimize the use of cookies. On the website avigan.com.ua/wika, only technically necessary cookies are installed:

What we do not use:

• No web analytics — the website does not use analytics services that identify visitors or build usage profiles.
• No marketing cookies (Facebook Pixel, Google Ads, LinkedIn Insight Tag, etc.).
• No retargeting pixels and other cross-site tracking mechanisms.
• No third-party cookies to track behavior on other websites.

Fonts. To render the interface, the website loads fonts from Google Fonts servers (fonts.googleapis.com). Your browser transmits your IP address to Google in the process; no cookies are set and no visitor profiles are built.

Since we do not install analytics or marketing cookies, a separate cookie consent banner is not required under the ePrivacy Directive. Technically necessary cookies may be used without prior consent.

10. Data security

We take technical and organizational measures to protect your data from unauthorized access, disclosure, alteration, or destruction:

• Encrypted connection (HTTPS/TLS) for all communications between your browser and the website.
• Encryption at rest at the level of the Vercel hosting infrastructure.
• Access control — only authorized AVIGAN employees directly involved in processing requests have access to form data.
• Data minimization — we collect only the data that is truly necessary to respond to your request.

If a security breach is detected that poses a risk to your rights, we will notify the relevant supervisory authorities within the timeframes set by GDPR (72 hours) and, if necessary, notify you personally.

11. How to submit a request regarding your data

For matters related to exercising your rights in the field of personal data protection, contact us:

• Email: info@avigan.com.ua (email subject: “Personal data protection”)
• Phone: +38 (067) 285-77-70
• By mail: to the legal address [___], with the note “Personal data”

We will review your request and provide a response within 30 calendar days from the date of receipt. In exceptional cases, this period may be extended by an additional 60 days with a mandatory notice to you about the reason for the delay. The response is provided free of charge if the request is not clearly unfounded or excessive.

To verify your identity, we may ask you to provide additional information — exclusively to ensure that we respond to you, not to a third party.

12. Changes to this Privacy Policy

We may update this Privacy Policy in case of changes in our data processing practices, changes in legal requirements, or changes in the list of technology processors.

We notify you of material changes in one of the following ways:

• Posting a notice on the website indicating the new effective date.
• Sending an email notification to individuals whose data we store if the changes directly affect the manner in which their data is processed.

We recommend reviewing this page periodically. The effective date is shown at the top of the document. Using the website after the effective date of the updated version means that you have reviewed it.

Previous versions of the Privacy Policy are available upon request by email to info@avigan.com.ua.

AVIGAN Engineering Bureau LLC | info@avigan.com.ua | +38 (067) 285-77-70 | [___]