Privacy policy

1. Who we are and when this policy applies

The controller and website operator is IE Bastion (“Bastion”, “we”, “us” or “our”). Our legal address is Vechirnii Boulevard, Kryvyi Rih 50000, Ukraine.

This policy applies when you visit this website, request a free Brand Check, contact us, discuss or receive our services, or receive a business communication from us. Business contact information is personal information when it identifies an individual.

Privacy questions and rights requests may be sent to privacy@getbastion.cc.

2. Information we collect

Information you provide

• enquiry information, including your name, work email, brand name, official website, selected marketplaces, requested service, approximate listing volume, and any context you choose to provide;
• business correspondence and records relating to a potential or existing engagement; and
• information reasonably needed to carry out an agreed service, where this is governed by a separate agreement.

Information collected automatically

Our hosting and security providers may receive technical information such as your IP address, request time, browser or device type, requested page, referring page, and security signals. We do not use this website for advertising tracking or cross-site behavioural profiling.

If you consent to analytics, PostHog also receives an analytics identifier, page and referrer information, UTM campaign parameters, approximate device and location information, clicks, navigation, scroll depth, form-stage events, and, when session replay is enabled, a privacy-masked representation of the session. We do not send the values entered into enquiry forms to PostHog, and all form fields are masked in session replay.

You can accept, refuse, or later change this optional processing using Analytics settings. Cloudflare’s strictly necessary security technologies remain active either way.

Business information from other sources

When we contact someone in a professional capacity, we may use their name, role, employer, business contact details, public professional profile, and the source of those details. Sources may include company websites, professional networks, public registers, marketplace pages, conference or partner information, and referrals. We provide this notice at or before our first communication, or otherwise within the period required by applicable law.

Please do not send passwords, payment card details, government IDs, health information, or other sensitive personal information through either enquiry form.

3. Why we use information and our legal bases

On a smaller screen, swipe horizontally or focus the table and use the Left and Right Arrow keys to see every column.

Submitting a Brand Check or project enquiry does not subscribe you to a newsletter and is not treated as consent to unrelated marketing. Where consent is required for a specific activity, we ask separately and you may withdraw it at any time.

4. US notice at collection

At or before collection, US visitors should understand that the form collects identifiers and professional or commercial information for the purposes of responding to the request, evaluating a possible business relationship, preventing misuse, and keeping necessary records. We retain these categories as described in section 7.

Bastion does not sell personal information for money, share it for cross-context behavioural advertising, use it for targeted advertising, or use it to make solely automated decisions with legal or similarly significant effects.

5. Who receives information

We share information with service providers that help us operate, secure, and deliver the website and requested business services. They include:

• Cloudflare and other relevant hosting, infrastructure, content-delivery, and security providers;
• PostHog EU Cloud, only after your explicit analytics consent, for website analytics and privacy-masked session replay when enabled;
• Google Workspace and the Gmail API, which route Brand Check and project enquiry submissions from our Cloudflare Worker to our designated mailbox;
• our email, IT, storage and communications providers;
• professional advisers, marketplaces or service partners where necessary for an engagement and subject to appropriate duties; and
• courts, regulators, law enforcement, counterparties or a successor to our business where disclosure is required or permitted by law.

These providers may process technical or submitted business interaction data only as needed to perform services on our behalf, subject to applicable agreements, data-protection terms, and their own privacy notices. You may email us directly instead of using either enquiry form.

6. International transfers

Bastion is operated from Ukraine, and our infrastructure and technical service providers may process information in the United States and other countries. These jurisdictions may not provide the same level of data protection as your home jurisdiction.

Where EU/EEA, UK, or Swiss law restricts a transfer to a country without an applicable adequacy decision, we use the safeguards available for the relevant provider and transfer. Depending on the service, these may include the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, or another lawful transfer mechanism. Contact privacy@getbastion.cc to request information about the mechanism used for a particular transfer.

7. How long we keep information

• The PostHog project is configured with a 12-month event-retention setting for consented analytics and, when enabled, session replay. Effective provider-level deletion also follows applicable account settings and terms. Withdrawing consent stops future collection on that browser; you may contact us to ask about deletion of analytics data that can reasonably be linked to you.
• We ordinarily keep an enquiry and related correspondence for up to 24 months after the last substantive interaction, so that we can respond, understand the history of the request, and manage legal or operational questions.
• If an engagement begins, relevant records are kept for the period stated in the service agreement or as required for accounting, legal claims, regulatory duties, and dispute resolution.
• Technical and security records are kept for the period reasonably needed by us or our infrastructure providers to secure, diagnose, and operate the service.
• Cloudflare processes a form submission while our Worker validates and transmits it to the Gmail API. Google Workspace then processes and stores the resulting message under the applicable account settings and terms. We retain that message under our enquiry and correspondence periods above. Provider-level operational records follow the providers’ applicable settings and terms.

We may delete or anonymise information earlier when it is no longer needed, and retain it longer where law, a legal hold, fraud prevention, or the establishment or defence of claims requires this.

8. Your privacy rights

EU/EEA and United Kingdom

Depending on the circumstances, you may have rights to access, correct, erase, restrict or object to processing, receive portable data, and withdraw consent without affecting earlier lawful processing. You have an unconditional right to object to processing for direct marketing. You may also complain to the data protection authority where you live or work, or where an alleged infringement occurred. UK residents may contact the Information Commissioner’s Office.

United States

Where a US state privacy law applies, you may have rights to know or access, correct, delete, and obtain a portable copy of personal information, and to opt out of a sale, qualifying sharing or targeted advertising, and certain profiling. You may also have a right to use an authorised agent, appeal a refusal, and receive equal service after exercising a right. These rights and exceptions vary by state and may not apply to information used solely in a business-to-business role.

We do not currently conduct sale, cross-context behavioural sharing, targeted advertising, or qualifying profiling, so Global Privacy Control and “Do Not Track” signals do not change those practices. If our practices change, we will implement legally required browser-based opt-outs before the change takes effect.

International and other jurisdictions

Depending on your location, including in Canada under PIPEDA, Brazil under LGPD, or South Korea under PIPA, you may have specific statutory rights regarding your personal information. These may include rights to access, correct, update, or request deletion of your information, and to object to or restrict certain processing activities.

We respond to requests from individuals wishing to exercise their data-protection rights in accordance with the law that applies to the request. Use the “How to make a request” instructions below.

How to make a request

Email privacy@getbastion.cc with the subject “Privacy request” and tell us what you are asking us to do. We may ask for information reasonably needed to verify your identity and authority. We respond within the period required by the law that applies to your request and will explain any lawful refusal or appeal route.

9. Security

We use proportionate administrative and technical measures intended to protect personal information. No internet transmission, mailbox or storage system is completely secure, so we cannot promise absolute security.

10. Children

Our website and services are intended strictly for professional business-to-business use. We do not knowingly collect personal information from individuals under the age of 18 (or the minimum legal age for data protection consent in your jurisdiction). If we learn that we have collected information from a minor without an appropriate legal basis, we will take prompt steps to delete it. Please contact us if you believe a minor has provided information to us.

11. Changes and contact

We may update this policy when our practices, providers or legal obligations change. We will post the revised version here, update the date above, and provide additional notice where required.