GDPR & Data Protection

Effective 16 February 2026

Measured North LLC serves clients in Ukraine and the European Union. Where we process the personal data of individuals located in the EU/EEA, we do so in accordance with Regulation (EU) 2016/679 — the General Data Protection Regulation (GDPR). This page explains the lawful bases on which we rely, your data-subject rights, and how to exercise them.

1. Data controller identity

The controller of your personal data is:

• Company: Measured North LLC
• Address: Unit 5, 12 Sportyvna Square, Kyiv 01023, Ukraine
• Data protection contact: privacy@measurednorth.com

We do not have a formal EU representative at this time; EU data subjects may contact us directly at the address above for any GDPR-related matters.

2. Lawful bases for processing

We rely on the following lawful bases under Article 6 GDPR when processing your personal data:

• Consent (Art. 6(1)(a)): when you submit our contact form, accept analytics cookies, or opt in to marketing communications. Consent is freely given, specific, informed and unambiguous. You may withdraw it at any time.
• Contract (Art. 6(1)(b)): where processing is necessary to perform a service agreement you have entered into with us, or to take pre-contractual steps at your request (e.g. preparing a proposal).
• Legitimate interests (Art. 6(1)(f)): to operate, secure and continuously improve our website; to communicate with prospective clients; to protect against fraud and misuse. Where we rely on this basis, we have assessed that our interests are not overridden by your rights and freedoms.
• Legal obligation (Art. 6(1)(c)): where processing is required to comply with applicable Ukrainian or EU law (e.g. accounting and tax obligations, lawful requests from authorities).

3. Your rights as a data subject

Under the GDPR, individuals whose data we process have the following rights. These rights apply in full to EU/EEA residents; Ukrainian residents have analogous rights under Ukrainian data-protection law (Law of Ukraine No. 2297-VI on Personal Data Protection).

3.1 Right of access (Art. 15)

You have the right to obtain confirmation of whether we process your personal data, and if so, to receive a copy of that data and information about how it is used, the categories processed, recipients, retention periods, and your other rights under this section.

3.2 Right to rectification (Art. 16)

You have the right to have inaccurate personal data corrected and, where appropriate, incomplete data completed without undue delay.

3.3 Right to erasure / “right to be forgotten” (Art. 17)

You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, you have withdrawn consent and there is no other legal basis, you have successfully objected to processing, the data has been unlawfully processed, or deletion is required to comply with a legal obligation. We will comply within one month unless an exception applies (e.g. legal obligations to retain records).

3.4 Right to restriction of processing (Art. 18)

You may request that we restrict processing (i.e. store but not use) your data where: you contest its accuracy, pending verification; processing is unlawful but you prefer restriction over erasure; we no longer need the data but you require it for legal claims; or you have objected to processing pending verification of our legitimate grounds.

3.5 Right to data portability (Art. 20)

Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format (e.g. JSON or CSV), and to transmit it to another controller where technically feasible.

3.6 Right to object (Art. 21)

You have the right to object at any time to processing of your personal data carried out on the basis of our legitimate interests, including profiling. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is necessary for legal claims. You may object to direct marketing at any time, without providing justification; we will honour such requests immediately.

3.7 Right to withdraw consent (Art. 7(3))

Where processing is based on your consent, you may withdraw it at any time by contacting us at privacy@measurednorth.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. We will update our records and cease consent-based processing within 30 days of receiving your request.

3.8 Rights related to automated decision-making (Art. 22)

We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects for you. If this changes, we will notify you and provide the protections required by Article 22 GDPR.

4. How to exercise your rights

To exercise any of the rights described above, please submit a written request to privacy@measurednorth.com with the subject line “Data Subject Request” and include:

• Your full name and email address (so we can identify your data).
• A description of the right you wish to exercise and any relevant details.
• A copy of identity verification if we are unable to identify you from the information provided (required only where there is reasonable doubt about your identity).

We will acknowledge receipt within 72 hours and respond substantively within one calendar month of receipt, as required by the GDPR. Where a request is complex or numerous, we may extend this period by a further two months; we will notify you of any extension within the first month.

5. International data transfers

Measured North is based in Ukraine. When we process data on behalf of EU/EEA clients or receive data from individuals in the EU/EEA, we ensure that appropriate safeguards are in place for any transfer of personal data outside the EU/EEA, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Transfers to countries that the European Commission has determined provide an adequate level of data protection.
• Your explicit consent, where applicable and where no other transfer mechanism is available.

Our primary hosting infrastructure is located in Germany (EU). Where we use sub-processors outside the EU (e.g. analytics tools), we ensure adequate transfer mechanisms are in place.

6. Data retention

We retain personal data only for as long as necessary for the purposes described in our Privacy Policy, or as required by applicable law. Specific retention periods are:

• Contact enquiry data: up to 24 months after the last communication.
• Client engagement data under a service contract: the duration of the contract plus 5 years, as required for commercial record-keeping under Ukrainian law.
• Analytics data: 14 months for session-level data; aggregated data may be retained indefinitely.
• Marketing opt-in records: until consent is withdrawn.

Upon expiry of the applicable retention period, data is securely deleted or anonymised.

7. Cookies and tracking technologies

For full details of our use of cookies and similar tracking technologies, including the specific cookies deployed and how to manage your preferences, please refer to Section 5 of our Privacy Policy.

8. Supervisory authority

If you are located in the European Union and believe that your data protection rights have been infringed, you have the right to lodge a complaint with the supervisory authority in your EU member state. A list of EU supervisory authorities is available at edpb.europa.eu.

For individuals in Ukraine, the relevant oversight body is the Ukrainian Parliament Commissioner for Human Rights (Ombudsperson), who acts as the supervisory authority for personal data protection under Ukrainian law.

We encourage you to contact us first so we can attempt to resolve your concern directly before you escalate to a supervisory authority.

9. Contact

For any data protection question, rights request or complaint, please contact Measured North LLC at privacy@measurednorth.com or by post at Unit 5, 12 Sportyvna Square, Kyiv 01023, Ukraine.