Legal Information (Aviso Legal), Privacy Policy and Cookies

LEGAL NOTICE AND TERMS OF USE OF THE WEBSITE

(hereinafter jointly referred to as the “Document”)

Date of last update: 04.03.2026

1. DETAILS OF THE WEBSITE OWNER (PROVIDER OF INFORMATION SOCIETY SERVICES)

Owner/service provider: Autónomo Pavlo Azarov (Great Step Consulting brand)
Identifier (NIE): Z1865608Z
Address: Calle Pio Baroja, nº1, 5-E, Irún (20305), Gipuzkoa, Spain
Contact email: azarovpavel2017@gmail.com
Website: Great Step Consulting (domain: great-step.top)

2. PURPOSE OF THE WEBSITE
The Website is intended to provide information about Great Step Consulting services and to receive inquiries/requests for consultations, as well as to interact with potential clients and partners.

3. TERMS OF USE
3.1. The user undertakes to use the Website lawfully, in good faith, and not to perform any actions that may disrupt the operation of the Website, infringe the rights of third parties, or violate applicable law.
3.2. Attempts at unauthorized access, interference with the operation of the Website, automated data collection without permission (scraping), distribution of malicious software, spam, and other abuses are prohibited.

4. INTELLECTUAL PROPERTY
All materials on the Website (texts, design, graphics, brand elements, and other objects) are the property of the owner or are used on lawful grounds. Copying, distribution, or any other use of the Website materials is permitted only with the prior written consent of the owner, unless otherwise expressly permitted by law.

5. LIABILITY AND LIMITATION OF WARRANTIES
5.1. The information on the Website is of a general informational nature and does not constitute a public offer, unless expressly stated otherwise.
5.2. The owner takes reasonable measures to ensure the proper operation of the Website; however, uninterrupted operation and the absence of technical errors are not guaranteed.
5.3. The owner is not liable for the actions of third parties or for the content of third-party resources to which links may be posted on the Website.

6. LINKS TO THIRD-PARTY PLATFORMS (MESSENGERS / SOCIAL NETWORKS)
The Website may contain links/buttons to third-party platforms (for example, WhatsApp / Instagram / Facebook Messenger / Telegram, etc.). When accessing such platforms, data processing is carried out by the respective platforms in accordance with their own rules and policies.

7. APPLICABLE LAW AND DISPUTES
Relations related to the use of the Website shall be governed by the laws of Spain and EU regulations. Disputes shall be submitted to the competent courts at the owner’s location, unless otherwise required by mandatory provisions of law (for example, consumer protection rules).

8. CONTACTS
For questions regarding the operation of the Website and this Document: azarovpavel2017@gmail.com

PRIVACY POLICY

1. WHO IS RESPONSIBLE FOR DATA PROCESSING

Data controller: Autónomo Pavlo Azarov (Great Step Consulting brand)
NIE: Z1865608Z
Address: Calle Pio Baroja, nº1, 5-E, Irún (20305), Gipuzkoa, Spain
Email for questions regarding personal data and the exercise of rights: azarovpavel2017@gmail.com
DPO (Data Protection Officer): not appointed (not required for this type of activity).

2. WHAT RULES APPLY
We process personal data in accordance with:
— GDPR (Regulation (EU) 2016/679);
— applicable Spanish legislation, including LO 3/2018 (LOPDGDD);
— rules on the use of cookies and similar technologies in Spain (LSSI-CE, art. 22.2) and EU ePrivacy rules.

3. CATEGORIES OF DATA WE MAY COLLECT
We process only the data necessary for the purposes indicated below.
3.1. Data you provide through forms/inquiries
— name;
— phone number;
— chosen method of communication (for example, Telegram / Viber / WhatsApp);
— information you specify in the form (for example, position/role, team size);
— content of the message/request (if you send it).
3.2. Technical data when visiting the Website
— IP address (may be recorded in security logs);
— browser/device parameters, interface language, traffic source;
— data on actions on the Website (events) — only if you have given consent to analytical/marketing cookies;
— security logs (to protect the Website and prevent abuse).
Important: We do not request special categories of data (health, religion, etc.). Please do not submit such data through forms/messages.

4. MANDATORY NATURE OF PROVIDING DATA
Data marked in forms as mandatory (usually indicated with the “*” symbol) are necessary to process your request and contact you. If you do not provide the mandatory data, we will not be able to properly process your inquiry and/or arrange a consultation.

5. FOR WHAT PURPOSES WE USE THE DATA AND ON WHAT BASIS
We process data only where there is a lawful basis and only to the minimum extent necessary.
5.1. Processing the request and arranging the consultation
Purpose: to contact you, clarify your request, and agree on the consultation/terms.
Basis: pre-contractual measures and/or performance of a contract (Art. 6(1)(b) GDPR), as well as legitimate interest (Art. 6(1)(f) GDPR) — communication regarding your request.
5.2. Lead and interaction management (CRM/inquiry records)
Purpose: to record inquiries, status, and communication history in order not to lose requests and to improve service quality.
Basis: legitimate interest (Art. 6(1)(f) GDPR) and/or contract (Art. 6(1)(b) GDPR).
5.3. Sending service messages regarding your request/consultation
Purpose: to send messages related to your inquiry (confirmations, clarifications, organizational details).
Basis: pre-contractual measures/contract and legitimate interest.
5.4. Marketing messages
Purpose: to send news/offers (if you have separately agreed to receive them).
Basis: consent (Art. 6(1)(a) GDPR). Consent may be withdrawn at any time by emailing us.
5.5. Analytics and Website improvement
Purpose: to understand how the Website is used and to improve it.
Basis: consent to analytical cookies (Art. 6(1)(a) GDPR and ePrivacy/LSSI-CE rules). Without consent, analytical cookies are not enabled.
5.6. Security and prevention of abuse
Purpose: protection of the Website from spam/attacks, error diagnostics, and ensuring stable operation.
Basis: legitimate interest (Art. 6(1)(f) GDPR).
5.7. Compliance with legal obligations (where applicable)
Purpose: compliance with tax/accounting and other mandatory legal requirements (for example, when concluding a contract and providing services).
Basis: legal obligation (Art. 6(1)(c) GDPR) and/or contract.

6. TO WHOM WE MAY DISCLOSE THE DATA (RECIPIENTS/PROCESSORS)
We may disclose data only to those service providers who help ensure the operation of the Website and the processing of requests, and only to the extent necessary. As a rule, these are:
6.1. Processors (acting on our behalf)
— Tilda Publishing: website platform, hosting, forms;
— Kommo (amoCRM/Kommo): management of inquiries/leads and communications;
— Google (depending on settings): Google Tag Manager (tag container), Google Analytics (if connected), Google Sheets (if submission of requests to a spreadsheet is configured);
— notification/integration services (if connected), for example, notifications about inquiries.
6.2. Separate controllers (independently determine the rules of processing)
If you choose to communicate through third-party messengers/social networks (Telegram / WhatsApp / Instagram / Facebook Messenger, etc.), the relevant platform may process data according to its own rules and acts as an independent controller in relation to the processing that takes place on its side.
Important: We do not sell your personal data.

7. TRANSFER OF DATA OUTSIDE THE EEA
Some providers (for example, Google and/or certain messengers/platforms) may process data outside the European Economic Area. In such cases, we apply the GDPR mechanisms and safeguards provided for, including:
— adequacy decisions (where applicable to the specific provider and transfer);
— Standard Contractual Clauses (SCCs) and/or other contractual and organizational protection measures.

8. DATA RETENTION PERIODS
We retain personal data no longer than necessary for the purposes of processing and compliance with legal obligations.
Typical retention periods:
— Requests/leads (if no contract is concluded): up to 24 months from the last contact, followed by deletion/anonymization;
— Correspondence and service communications: up to 24 months from the end of the interaction;
— Security logs: up to 12 months;
— Marketing contacts: until consent is withdrawn or up to 24 months of inactivity (whichever comes first);
— Client data/contractual documents: for the duration of the contract + the periods required by law (including usually at least 4 years for tax purposes; and certain accounting/documentary requirements may require retention for up to 6 years, depending on the applicable rules and type of document).

9. YOUR RIGHTS
You have the right to:
— request access to your data, its rectification, or erasure;
— restrict processing;
— object to processing based on legitimate interest;
— receive the data in a portable format (where applicable);
— withdraw consent (if processing is based on consent) — at any time.
How to exercise your rights:
Write to azarovpavel2017@gmail.com. In the subject line, you may indicate: “Personal Data / GDPR”.
We may request proof of identity to protect your data.
As a rule, we respond within up to 1 month (in certain cases the period may be extended in accordance with GDPR, of which we will inform you).
Right to lodge a complaint:
You have the right to lodge a complaint with the data protection supervisory authority in Spain — Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan, 6, 28001 Madrid.

10. AUTOMATED DECISION-MAKING AND PROFILING
We do not carry out decision-making based solely on automated processing (including profiling) that produces legal effects or similarly significantly affects you.
If such processes are introduced in the future, we will update this Document and provide the required information before the processing begins.

11. SECURITY
We apply reasonable organizational and technical measures to protect data (access restrictions, account control, backups, updates, protection against abuse, security logs, etc.). However, no method of data transmission over the internet can guarantee absolute security.

12. MINORS
The Website is not intended for children. If the user is under 14 years old, the provision of personal data based on consent is possible only with the consent of parents/legal representatives. If you believe that a child has provided us with data without such consent, please contact us so that we can delete the data.

13. CHANGES TO THE POLICY
We may update this Document. The current version is always available on the Website in the section “Privacy Policy and Personal Data Processing” (and/or in the relevant pop-up/section).

COOKIES

1. WHAT COOKIES ARE

Cookies are small files (or similar technologies, for example localStorage/pixels) that are stored in your browser/device when you visit the Website. They help ensure the operation of the Website, security, and also (with your consent) analytics and marketing.

2. CATEGORIES OF COOKIES WE USE
2.1. Mandatory (technical)
These are necessary for the operation of the Website, security, and basic functions. They are always enabled. They cannot be disabled via the banner, but you can restrict cookies through your browser settings (please note that this may affect the functioning of the Website).
2.2. Analytical
These help measure traffic and improve the Website (for example, visit statistics). They are enabled only with your consent.
2.3. Marketing
These may be used for advertising, limiting repeated displays, measuring campaign effectiveness, and, in some cases, forming interests (profiling). They are enabled only with your consent. If marketing cookies are not used, the corresponding category will remain disabled.

3. HOW TO GIVE CONSENT, REFUSE, OR CHANGE YOUR CHOICE
When you first visit the Website, you may:
— “Accept all”,
— “Reject all”,
— “Configure” (choose categories).
Refusing non-essential cookies is no more difficult than accepting them.
You can change your choice at any time through the cookie settings (banner/“Configure” button) and/or through your browser settings. If you delete cookies in your browser, your choice may be reset.

4. VALIDITY PERIOD OF COOKIE CONSENT
We store (in technical form) information about your cookie choice. As a rule, consent is requested again no less frequently than once every 24 months or earlier if you delete cookies/change your browser settings.

5. LIST OF MAIN COOKIES ON THE WEBSITE
Below are the cookies that are usually used by the Website platform and/or connected services. The actual set may depend on the current Website settings, the categories selected by you, and the connected tools.
5.1. Mandatory / functional (website platform and consent management)
Provider: Tilda Publishing (as a rule, first-party cookies)
— t_cookiesCategories — stores the selected cookie categories; retention period: up to 1 year
— t_cookiesConsentGiven — stores the consent status; retention period: up to 1 year
— tildauid — technical identifier/unique visitor ID for the functioning of the platform; retention period: up to 3 months
— tildasid — technical session/platform operation identifier; retention period: session / up to 1 year (depending on settings)
— previousUrl — stores information about the previous page (for navigation/proper functioning); retention period: usually up to 30 minutes
— TILDAUTM (if used) — stores UTM parameters of the source/campaign; retention period: as a rule, session / short-term
5.2. Analytical (only with your consent and if analytics is actually connected)
Provider: Google (for example, Google Analytics via Google Tag Manager)
Typical Google Analytics cookies:
— _ga — distinguishes users; retention period: usually up to 24 months
— ga — stores session state/parameters for a specific counter; retention period: usually up to 24 months
— _gid — distinguishes users; retention period: usually up to 24 hours
— _gat / gat — limits request frequency; retention period: usually up to 1 minute
5.3. Marketing (only with your consent and if advertising/marketing tools are actually connected)
If advertising tools are connected on the Website (for example, advertising pixels/conversions), they may set cookies, for example:
— _gcl_au (Google Ads) — retention period: usually up to 3 months
— _fbp (Meta/Facebook) — retention period: usually up to 3 months
If such tools are not connected, the listed cookies are not used.

6. THIRD-PARTY SERVICES AND CROSS-BORDER TRANSFERS IN THE CONTEXT OF COOKIES
With consent to analytical/marketing cookies, data may be processed by third-party providers (for example, Google) and potentially outside the EEA. In such cases, the safeguards described in the section “Transfer of Data Outside the EEA” apply.

7. HOW TO MANAGE COOKIES THROUGH THE BROWSER
You can delete cookies and/or restrict their use through your browser settings. Please note: disabling mandatory cookies may lead to the incorrect functioning of certain Website features.

8. CHANGES TO THE COOKIE POLICY
We may update this Cookie Policy when tools, providers, and Website settings change. The current version is always available on the Website.