Privacy Policy

Last updated: 16 October 2026

This policy explains what personal data SH Consulting collects through sh.consulting and related booking and contact tools, why we collect it, who we share it with, and what rights you have

1. Who we are

SH Consulting is a sole proprietorship registered in Poland, operated by Oleksandr Shakhov.
Address: Foksal 17B, 00-372 Warsaw, Poland
Email: hello@sh.consulting
VAT: PL5252743430

We are the data controller for the personal data described in this policy.

2. What data we collect and why

Dangling DNS Check. When you use our free Dangling DNS Check, we collect your work email address and its domain, the scan results for that domain, and the IP address used to request a verification code (only to limit how many codes can be requested). Verification codes and session tokens are stored only in hashed form. We use this to confirm you control the domain, run the check, show you the report, prevent abuse of the tool, and contact you about the findings. Your email address and domain are also added to our customer relationship management system so we can follow up on the results. Legal bases: providing the check you requested (Art. 6(1)(b) GDPR) and our legitimate interest in following up on security issues found in your domain and preventing misuse of the tool (Art. 6(1)(f) GDPR). The check only reads public DNS records. We don’t scan domains you haven’t verified, and we don’t publish or share individual results.

Contact form. When you submit a form on our website, we collect the details you enter (typically your name, email address, company, website domain and your message). We use this to reply to you and, where relevant, to prepare a proposal. Legal basis: taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR).

Booking a call. When you book a call through Calendly, we collect your name, email address, the time you chose, your time zone and any answers you give to booking questions. We use this to hold the call and follow up afterwards. Legal basis: Art. 6(1)(b) GDPR.

Paid sessions. If you book a paid session, payment is processed by Calendly's payment provider (Stripe). We do not receive or store your card details.

Working with us. If you become a client, we process the data needed to deliver our services, invoice you and meet our legal obligations (Art. 6(1)(b) and 6(1)(c) GDPR).

How you found us. When you arrive on our website from a link that carries tracking parameters (for example from a partner website), and you accept cookies, we store those parameters in a cookie so that we know which website or campaign brought you to us. If you later book a call or submit a form, that information is attached to your record. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by declining or clearing cookies.

Website analytics. With your consent, we use Google Analytics to understand how visitors use our website. Legal basis: your consent (Art. 6(1)(a) GDPR).

Email correspondence. If you email us, we keep the correspondence for as long as needed to handle the matter and for our records (Art. 6(1)(f) GDPR).

We do not sell personal data and we do not use it for automated decision-making.

3. Cookies

We use the following cookies:

Consent choice — remembers whether you accepted or declined cookies — 12 months

First-touch attribution — stores the tracking parameters (utm_*) and landing page from your first visit, so we know how you found us — 90 days

Google Analytics — anonymised statistics about how the website is used — up to 2 years

Widgetbe — visitor identifier for a site widget (cookie WidgetTrackerCookie and local storage), set only after you click Accept — up to 10 years as set by the provider; most browsers shorten this (Chrome: 400 days)

Apart from strictly necessary session cookies set by our hosting provider, only the consent-choice cookie is set before you make a choice. The other cookies are set only if you click Accept on the cookie banner. If you decline, only the consent choice is stored. Calendly's booking widget may set its own cookies when you use it; these are governed by Calendly's privacy policy.

If you are visiting from the European Economic Area, the UK or Switzerland, we ask for your consent before setting the attribution and analytics cookies; elsewhere they are set when you visit.

4. Who we share data with

We use third-party providers for website hosting and forms, call scheduling, customer relationship management, workflow automation, email, and website analytics. The Dangling DNS Check runs on our own servers in the EU; we use third-party providers for network security and bot protection and for sending verification emails. They process data on our behalf under data processing agreements. Some are located in the United States; those transfers are covered by the EU–US Data Privacy Framework or Standard Contractual Clauses.

Partner referrals. Some of our calls can be booked through links published on partner websites. When you book through such a link, the partner is notified that a booking was made so that the referral can be recorded. This notification includes the booking details you entered (name, email, time). We only share booking data with the partner whose link you used, and only for bookings made through that link. Bookings made directly on our website are not shared with any partner.
We may also disclose data where required by law.

5. How long we keep data

Enquiries and bookings that do not lead to an engagement: up to 3 years from our last contact with you.

Client data: for the duration of the engagement and afterwards for as long as required by Polish tax and accounting law (generally 5 years from the end of the tax year).
Attribution cookie data: 90 days in your browser; once attached to your record, it is kept together with that record.

Analytics data: as set out in the cookie durations above.

Dangling DNS Check: verification codes expire after 10 minutes and are deleted, together with the requesting IP address, after 1 day. Sessions are deleted after 30 days. Scan results and tool accounts are deleted after 7 days without sign-in. Email addresses and domains added to our CRM are kept as for enquiries (up to 3 years from our last contact). Server logs do not contain visitor IP addresses and are deleted within 30 days. Our email provider keeps a record of sent verification emails for a limited period under its standard retention.

6. Your rights

Under the GDPR you can ask us to:

- access the personal data we hold about you;
- correct it if it is inaccurate;
- delete it, where we have no overriding reason to keep it;
- restrict or object to its processing;
- provide it to you in a portable format;
- withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, email hello@sh.consulting. We will respond within one month.

You also have the right to lodge a complaint with the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.

7. Changes

We may update this policy when our tools or practices change. The date at the top shows the latest version.