Privacy
policy
This page explains what data oleksiikuzkin.com collects, why, and how you can control it. Last updated 2026-09-09. See also the Terms of service.
01 / Who we are
Oleksii Kuzkin, based in Bratislava, Slovakia, is the data controller for oleksiikuzkin.com. If you have questions about this policy or want to exercise the rights below, contact us at admin@kuzkin.com.
This site runs entirely on Amazon Web Services (S3, CloudFront, WAF, Cognito, Lambda, DynamoDB), which processes data on our behalf under AWS's standard GDPR terms. Google processes data on our behalf for the services described in sections 02 and 04.
02 / Data collected on the basis of consent
Upon your consent, we use Google Analytics 4 to understand how visitors use this site. No cookie is set until you click "Accept analytics" in the banner; if you click "Necessary only," or don't respond at all, nothing beyond the local storage below is stored.
ok-resume-theme and ok-resume-consent remember your light/dark preference and your cookie choice. These are strictly necessary for the site to remember your own choices, so they're set automatically and are exempt from consent under GDPR/ePrivacy.
_ga and _ga_<container-id> (Google Analytics 4), kept for up to 2 years, distinguish you from other visitors and measure page views, time on page, referrers, scroll depth, clicks on outbound links, and CV downloads. We don't receive your full IP address - Google uses it briefly to derive an approximate location, then discards it. We've switched off Google Signals and ad personalization on this property, so this data is never used for cross-site or cross-device advertising. Google Ireland Limited processes it, with transfers to the United States under the EU-U.S. Data Privacy Framework. Event-level data is kept for 2 months, then deleted automatically.
You can withdraw this consent at any time using "Cookie settings" in the footer - that stops future collection, but can't recall data already sent to Google. See Google's privacy policy.
03 / Data collected on the basis of legitimate interest
We also process a small amount of data without asking for consent, where we have a legitimate interest in doing so under GDPR Art. 6(1)(f) - mainly, keeping the site secure and working.
Access and security logs: every request to this site is logged by CloudFront (the CDN in front of it) and by AWS WAF (which screens requests for abuse and attacks) - each log entry includes IP address, path, timestamp, and request headers. These are infrastructure logs, not analytics: they're used only for security monitoring, troubleshooting and abuse detection, are kept for 90 days and then automatically deleted, and aren't linked to the Google Analytics data above or to any individual identity. This is standard practice for essentially any web server or CDN, not something specific to visitors of this site.
04 / CV access (Google sign-in)
The CV download is gated behind sign-in, so nothing happens until you actively click "Sign in with Google to download CV." That button sends you to AWS Cognito's Hosted UI, which redirects to Google - your password is entered on Google's own page and never seen by this site or by Cognito. Google returns your email address and account identifier to Cognito, which issues a short-lived access token back to your browser.
That token (kept in sessionStorage, cleared when you close the tab - not a cookie, not persisted) is sent once to a Lambda function to request the file, which also caps downloads at 3 per hour per account to stop the link being abused. The Lambda checks the token is genuinely from Cognito, then signs a one-time, 60-second download link and records the access: your Cognito account id, email, IP address, user agent and timestamp, in a DynamoDB table, kept for 12 months and then automatically deleted. The same information is also emailed to us via AWS SNS as a download notification - this isn't a new purpose, just a second copy of the same record. Legal basis: legitimate interest in controlling and auditing access to the file (Art. 6(1)(f)), and performance of the access you requested by signing in (Art. 6(1)(b)). This data isn't linked to the Google Analytics data above and isn't used for marketing.
Cognito's Hosted UI sets its own session cookies on *.auth.eu-north-1.amazoncognito.com during sign-in - that's Amazon's domain, governed by AWS's privacy notice, not set directly by this site.
05 / Your rights pertaining your data
If you have used this site's Google sign-in or accepted analytics, you can request an export of the personal data we hold about you, or ask us to erase it, at any time. More specifically, under the GDPR you have the right to:
- ›Withdraw consent - use "Cookie settings" in the footer to reopen the banner and choose "Necessary only."
- ›Access the personal data we hold about you.
- ›Rectification of inaccurate personal data.
- ›Erasure of your personal data, including the CV-access log described above.
- ›Restrict or object to processing of your personal data.
- ›Data portability - receive an exported copy of your data, where applicable.
- ›Be notified if a data breach affecting you occurs.
- ›Lodge a complaint with a supervisory authority - in Slovakia, the Úrad na ochranu osobných údajov SR, or your own country's data protection authority.
To exercise any of these, email admin@kuzkin.com. We'll respond within one month, as required under GDPR Art. 12(3).