Privacy policy

1. Who processes the data

This page describes data processing on the CEH website. The enquiry recipient is a designated CEH manager whose private Telegram chat is technically verified before every delivery.

The legal operator details and a dedicated privacy contact will be published once approved. Users may also contact the team through the published personal phone, Telegram and email details.

2. Data transmitted

The fields depend on the selected route: specialist or company.

• For a specialist: name, phone or Telegram, an optional objective, and a preference for a message or short call.
• For a company: name, company, objective, phone or Telegram, email, preference and suitable contact time.
• Technical context: the selected route and a unique enquiry ID.
• A hidden honeypot field is used only to reject automated spam.

3. How the data is used

The data helps the CEH manager understand the enquiry, select a relevant next step and reply through the supplied channel.

Data is not sold, used for automated legally significant decisions or delivered by this form to any other recipient.

4. Consent

Before submission, the user explicitly agrees to processing for the purpose of answering the enquiry. The server rejects the enquiry unless the checkbox is selected.

Analytics consent is requested separately. Declining analytics does not limit the form, materials or direct contacts.

5. Delivery and retention

The website server accepts a validated POST request and sends the message through the Telegram Bot API only to a fixed private chat whose allowed username is rechecked before delivery. The bot token and numeric chat ID remain server-only environment variables.

The site does not use Supabase, its own lead database, email distribution, a CRM, webhook or fallback recipient list. If Telegram is unavailable, the form does not claim success and keeps the entered fields in page memory for a retry.

To limit repeated submissions, the server temporarily retains only a short SHA hash of a network hint and the supplied contact plus the identifier of an already delivered enquiry; these in-memory entries expire automatically and contain no plain-text enquiry content.

After delivery, the message remains in the recipient’s Telegram chat until it is deleted through Telegram or by the manager in line with the enquiry purpose and applicable requirements. The hosting provider and Telegram may process standard technical logs under their own policies; the application does not write enquiry contents to its own logs.

6. Cookies, local storage and analytics

The website stores only the analytics choice in localStorage. Form values and the enquiry ID are not written to localStorage or sessionStorage.

GA4 and Yandex Metrica load only after consent and only when their identifiers are configured. Form values are not included in analytics events.

Telegram and other external links are subject to the relevant service’s own privacy, cookie and retention rules.

7. Security and minimisation

The server validates request type and size, allowed fields, consent, origin, honeypot and request frequency. The browser never chooses the recipient: before each delivery the server verifies that the configured Telegram ID belongs to the allowed private chat.

Integration secrets are excluded from client code. Telegram markup is limited to fixed field labels; user-provided values are escaped and are not interpreted as markup.

No internet service can guarantee absolute security; CEH applies controls proportionate to the volume and nature of the data.

8. User rights

Users may request information, correction, cessation or deletion by writing to any published personal CEH team email and identifying the contact used in the enquiry. A delivered message is deleted from the recipient’s Telegram chat within applicable requirements.

9. Policy updates

The current version is published here with its update date. A change of recipient, delivery channel, fields, purpose or retention must be reflected in this policy and the server configuration.