Introduction

MLK.STUDIO is a design studio brand. It is not a separate company: the studio is run by a Ukrainian individual entrepreneur (ФОП), who decides how and why personal data sent through this website is processed and is therefore the data controller.

The website is a portfolio with a project request form. You cannot buy services, pay or sign contracts on it.

This policy covers the studio website and the personal portfolio of the studio’s founder, Jack Milka, at /milka-cv/, which is run by the same entrepreneur. Where the personal portfolio works differently, this policy says so. The Upwork edition of the portfolio at /upwork/ has its own privacy policy.

Data Controller

Controller

Yevhenii Milka, Individual Entrepreneur (ФОП Мілка Євгеній Володимирович)

Country of registration

Ukraine

Brand

MLK.STUDIO

Privacy contact

mlkdesignweb@gmail.com

More details are on the Legal Information page.

Information We Collect

When you send a project request

• Name — as you enter it.
• Email address — so we can reply.
• Project details — the content of your message and anything you choose to include in it.

The form has no phone number field and no file upload. Please do not include sensitive information (for example health data or identity documents) in your message.

Technical data

• When you submit the form, our form service (Formspree) receives the technical data that comes with any web request, such as your IP address, browser type and the time of the request, and uses it to deliver the message and filter spam.
• When you open the website, our hosting provider (GitHub Pages) and the services that deliver the site's JavaScript libraries (unpkg.com, esm.sh) receive your IP address and browser information, as any web server does.

When you contact us elsewhere

If you write to us by email, Telegram, WhatsApp, Instagram, LinkedIn, Behance or Upwork, we receive what you send us there. Those platforms process your data under their own privacy policies.

Visit statistics on the personal portfolio

Only on /milka-cv/, and only after you click “accept” in the cookie banner, Google Analytics 4 records which pages you view, the device, browser and approximate location it derives from your connection, and clicks on a fixed set of elements (for example opening the request form or a case study). It never receives what you type into the form.

Visit statistics on the studio pages

On the studio’s own pages (the home page, case studies and these legal pages) Microsoft Clarity records how visitors use them: clicks, scrolling and mouse movement, which it turns into heatmaps and session recordings, together with the pages viewed, the device, the browser and the approximate location it derives from your connection. The project request form is marked so that Clarity does not record what you type into it. The project demos and /milka-cv/ do not load Clarity.

Nowhere do we use advertising pixels or build advertising profiles.

How We Use Information

• To read and answer your request.
• To discuss your project and prepare a proposal or estimate.
• To agree, carry out and invoice a project if we start working together.
• To keep the website and the form secure and working, including spam protection.
• To keep the records Ukrainian law requires once a contract exists.

We do not use your request for newsletters or other marketing, and we do not sell or rent personal data.

On the personal portfolio, and only with your consent, we use visit statistics to understand which work and pages interest visitors. On the studio pages we use Clarity’s heatmaps and session recordings to see how visitors use the site and to fix what gets in their way.

Legal Basis

We process personal data under the Law of Ukraine “On Personal Data Protection” and, where it applies to you, the EU General Data Protection Regulation (GDPR). We use a separate basis for each purpose; we do not rely on one general consent.

Purpose	Basis
Answering your request, preparing a proposal	Steps taken at your request before entering into a contract — GDPR Art. 6(1)(b); Art. 11 of the Ukrainian law (conclusion of a contract at the data subject’s request)
Carrying out an agreed project	Performance of a contract — GDPR Art. 6(1)(b)
Accounting and tax records for contracts	Legal obligation — GDPR Art. 6(1)(c)
Security of the website and spam filtering	Legitimate interest in a safe, working website — GDPR Art. 6(1)(f)
Visit statistics on the personal portfolio	Your consent, given in the cookie banner — GDPR Art. 6(1)(a); Art. 11 of the Ukrainian law. You can withdraw it at any time.
Visit statistics on the studio pages (Microsoft Clarity)	Legitimate interest in understanding how the website is used and improving it — GDPR Art. 6(1)(f). You can object at any time (see Your Rights) or block the Clarity cookies in your browser.

Sending a request is voluntary. Without a name, an email address and a short description we cannot reply through the form, but you can always contact us by email instead.

Third-Party Services

Service	What it does	Data it receives
GitHub Pages (GitHub, Inc., USA)	Hosts the website	IP address and browser data of every visitor; GitHub keeps visitor IP addresses in logs for security purposes
Formspree (Formspree, Inc., USA)	Receives the project request form and forwards it to our mailbox	Name, email, project details, IP address and browser data of the person submitting
Google (Gmail)	Our mailbox, where requests and emails arrive	Everything you send us by form or email
unpkg.com, esm.sh	Deliver the open-source JavaScript libraries the site uses for animation and scrolling	IP address and browser data when the page loads
Google Analytics 4 (Google)	Visit statistics on /milka-cv/ only, after you accept	A random visitor ID stored in cookies, pages viewed, device and browser data, approximate location, the fixed interaction events described above. Google signals and ad personalisation are switched off.
Microsoft Clarity (Microsoft Corporation, USA)	Heatmaps and session recordings on the studio pages	Clicks, scrolling and mouse movement, pages viewed, device and browser data, approximate location derived from the IP address, a random visitor ID stored in cookies. What you type into the request form is not recorded.

Fonts are served from this website itself, so opening the site does not send your data to Google Fonts. There are no embedded videos, social widgets or CAPTCHA. Links to Instagram, LinkedIn, Behance, Upwork, Telegram and WhatsApp only take you to those platforms when you click them. The Kowalski & Partners project demo loads one image from Unsplash.

If we work with you on a project, members of the studio team who take part in it may see your request.

Data Retention

• Requests that do not lead to a project — we delete them from the mailbox and from Formspree 12 months after our last exchange.
• Requests that lead to a project — we keep the correspondence for as long as the contract runs and afterwards for as long as Ukrainian tax and accounting law requires, or as needed to settle a legal claim.
• Hosting and delivery logs — kept by the providers listed above under their own retention rules.
• Visit statistics — Google Analytics keeps event data for the retention period set in our account (2 months, the GA4 default), then deletes it.
• Studio page statistics — Microsoft Clarity keeps recordings and statistics for the retention periods Microsoft sets for the service, then deletes them.

The 12-month period is our own rule, not a legal requirement. You can ask us to delete your request earlier at any time.

International Data Transfers

We are based in Ukraine. When you send us a request from the EU, the EEA or anywhere else, you send it directly to us in Ukraine.

GitHub, Formspree, Google and Microsoft process data in the United States and other countries. These providers state that they protect international transfers with the EU–U.S. Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses. Ukraine does not currently have an EU adequacy decision.

Your Rights

Depending on the law that applies to you, you can ask us to:

• tell you whether we process your data and give you a copy (access);
• correct inaccurate or incomplete data;
• delete your data where there is no reason to keep it;
• restrict processing while a question about it is being resolved;
• stop processing based on our legitimate interest (objection);
• give you the data you provided in a common machine-readable format (portability);
• withdraw consent at any time, where processing is based on consent.

Write to mlkdesignweb@gmail.com. We reply within one month. We may ask you to confirm that the request comes from you.

You can also complain to a supervisory authority: in the EU/EEA, to the data protection authority of the country where you live or work; in Ukraine, to the Ukrainian Parliament Commissioner for Human Rights. You can also go to court.

Security

The website is served only over HTTPS, and the form sends your request to Formspree over an encrypted connection. Requests are read in a password-protected mailbox that only the people who answer them can access. The website does not store your request in the page, in its address or in your browser.

No method of transmitting or storing data is completely secure, so we cannot guarantee absolute security.

Cookies & Analytics

Studio pages (Microsoft Clarity)

The studio pages use Microsoft Clarity, which can set the cookies below on this website. Microsoft may also set its own cookies on its clarity.ms domain. Clarity does not wait for the cookie banner, and there are no advertising trackers; you can block or delete these cookies in your browser settings, and the site works the same without them.

Name	Purpose	Kept for
_clck	Microsoft Clarity: keeps the same random visitor ID across visits	Up to 1 year
_clsk	Microsoft Clarity: joins the pages you view into one session	1 day

Personal portfolio (/milka-cv/)

Google Analytics is off by default: until you click “accept”, the analytics script is not loaded and nothing is sent to Google. “decline” keeps it off and the site works the same. You can change or withdraw your choice at any time with the “cookie settings” link at the bottom of the page; withdrawing deletes the analytics cookies.

Name	Purpose	Kept for
_ga	Google Analytics: tells visits from different browsers apart (set only after you accept)	Up to 2 years
_ga_4RJRW3679Y	Google Analytics: keeps the state of the current visit (set only after you accept)	Up to 2 years

Local storage

Your browser’s local storage keeps only what the pages need to work:

Name	Purpose	Kept for
mlk-language	Remembers the language you chose (uk / en)	Until you clear your browser data
mlk-language-scroll-reset	Returns the page to the top after a language switch	Removed immediately after use
jack-milka-language	The same, on the personal portfolio	Until you clear your browser data
jack-milka-cookie-preference	Remembers your analytics choice on the personal portfolio	Until you change it or clear your browser data

You can clear this data at any time in your browser settings.

Contact & Updates

For any question about your data, write to mlkdesignweb@gmail.com.

We update this policy when the way the website works changes. The date at the top shows the latest version.

Effective from 29 October 2026. Last updated 31 October 2026.