Privacy policy
Last updated: 15 November 2026. This page explains which personal data is processed when you visit this website or send an enquiry, why, and for how long.
Controller
The controller under the GDPR is MXMANAGEMENT LTD, 45 Taxiaphon Avenue, 8036 Paphos, Cyprus, represented by Alexej Boger, Director.
You can reach us at hey@alexejboger.com or by phone on +49 162 3130476.
Visiting the website, hosting and Cloudflare
The website is hosted by Hostinger and delivered through Cloudflare. Each time a page is requested, the hosting server and Cloudflare process technically necessary connection data: IP address, date and time, requested address, referrer URL, browser and system information and the response status code.
We need this data to deliver the site, keep it stable and protect it against attacks. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is secure and fast operation. We do not use this data to identify individual visitors. How long Hostinger and Cloudflare keep log data depends on their settings and terms.
Hostinger processes data for us as a processor under Art. 28 GDPR, based on its Data Processing Addendum. Cloudflare, Inc. is based in the USA. The transfer relies on the adequacy decision for the EU-US Data Privacy Framework, where Cloudflare is certified under it, and on standard contractual clauses.
Contact by email or phone
If you contact us by email or phone, we process your contact details and the content of your message to deal with your request. The legal basis is Art. 6(1)(b) GDPR where this serves steps before a contract, and otherwise Art. 6(1)(f) GDPR. We delete the data once it is no longer needed for that purpose and no statutory retention duty applies.
Sending an enquiry through a form
When you submit the contact form or the form for the free opportunity review, we process the details you enter: name, email address, and where requested your company, website, goal, timeframe, your message and preferred language. We also record when the enquiry arrived, the language of the page, any campaign parameters in the address (UTM values) and proof that you took note of this privacy information.
We use these details to answer your enquiry and prepare the conversation with you. The legal basis is Art. 6(1)(b) GDPR where this serves steps before a contract, and otherwise Art. 6(1)(f) GDPR (handling business enquiries). The proof that you took note serves our accountability duty, and its legal basis is also Art. 6(1)(f) GDPR.
The enquiry is stored in this website's database and transferred to our own custom-built CRM system. We do not pass it on to third parties, except to the technical service providers named above where they need it to run the site.
Providing the required fields is voluntary. Without them we cannot process your enquiry.
Protection against form abuse
To protect against automated submissions, we store a hash of your IP address. It is valid for one hour, cannot be converted back to your IP address and is only used to limit too many submissions in a short time. After that it is no longer used and is deleted in the next automatic database cleanup. For the same reason we keep a hash of the submitted enquiry for up to 24 hours, so that submitting twice does not create a second entry. The legal basis is Art. 6(1)(f) GDPR.
Cookies and local storage
This website does not set any cookies when you visit it. After you submit a form we set a technically necessary cookie named aboger_ok. It is valid for 30 minutes, contains no information about you and only makes sure the confirmation page is shown after you submit.
On the home page, the assistant ORBIT accompanies you. If you hide it, your browser remembers that choice in local storage (entry aboger_orbit_hidden) so that ORBIT stays hidden. The entry contains no information about you. You can delete it at any time in your browser settings.
Both are technically necessary for us to provide the function you asked for. The legal basis is § 25(2) no. 2 TDDDG. The processing that follows relies on Art. 6(1)(f) GDPR.
We load fonts from this server, not from Google or other providers.
Analytics, advertising and other services
This website uses no analytics, tracking, advertising or social media services, sets no advertising pixels and embeds no appointment booking or messenger. It loads no content from third parties, apart from the technical services Hostinger and Cloudflare named above.
If we start using such services in future, for example web analytics, advertising pixels, appointment booking or a messenger link, we will update this policy first and, where required, ask for your consent before anything loads.
Retention
Enquiries in this website's database are deleted automatically 12 months after they arrive. If your enquiry leads to a conversation or a working relationship, we keep the related data in our CRM for as long as the business relationship requires. After that, the statutory retention periods for business records and accounting apply, which follow from the law applicable to us. The aboger_ok cookie expires after 30 minutes. The ORBIT entry stays in your browser until you delete it.
Your rights
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent at any time with effect for the future. Write to hey@alexejboger.com to exercise these rights.
Right to object
Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then stop processing the data unless we can demonstrate compelling legitimate grounds.
Complaints to a supervisory authority
You can lodge a complaint with a data protection authority. The authority responsible for us is the Cypriot data protection authority, the Office of the Commissioner for Personal Data Protection (dataprotection.gov.cy). You can also contact the supervisory authority where you live.
Automated decisions
No automated decision-making, including profiling, under Art. 22 GDPR takes place.