How Drevantos collects, stores, and handles visitor information.

When did this privacy disclosure take effect?

This privacy statement took effect on 2026-10-27. It governs all interactions on drevantos.com, including submitted inquiry forms, live support chat transcripts, and tracking telemetry delivered through search engine marketing campaigns. Any future revisions will update this effective date directly.

Who operates this website and controls your personal data?

The data controller for all personal information collected on this website is Drevantos, trading at drevantos.com. Our physical operations base and postal address are:

Drevantos
400 East Monroe Street, Chicago, Illinois 60603, Chicago, Illinois, United States
Telephone: +1 (707) 555-6244
Official email: [email protected]

Drevantos operates as an independent residential carpentry workshop led by finish carpenter Ivan Petrov. We process all customer records strictly for scope assessment, project scheduling, and customer communication.

What personal and technical data does this site record?

We do not host user accounts, customer login portals, or payment card processors. Nothing is sold online and no credit card details are ever taken. Data collection is restricted to three defined categories:

• Inquiry Form Submissions (wono392.php): When requesting a scope assessment, we receive your full name, telephone number, email address, job site street address or neighbourhood, carpentry category (trim, doors, fitting, framing), requested specifications, project notes, and explicit consent confirmation.
• Technical and Server Log Records: With every form submission and page load, our systems log the visitor IP address, web browser user-agent string, referring URL, timestamp of page rendering, and timestamp of transmission.
• Live Support Chat Records (vecob6f.php): Conversation transcripts and a random session token stored in browser localStorage to allow returning visitors to continue ongoing carpentry discussions with Ivan Petrov.
• Advertising & Click Identifiers: Marketing parameters appended to incoming campaign URLs by ad networks, including gclid from Google Ads, msclkid from Microsoft Advertising, and fbclid from Meta Ads.
• Consent Preferences: Your choice to allow or deny tracking is preserved locally in your browser storage under the key site_consent_v2.

Why do we process your personal data?

Personal information is processed for specific, limited objectives:

• To evaluate interior trim, moulding, and door hanging inquiries, prepare itemised estimates, and schedule on-site visits in Chicago.
• To maintain two-way communication regarding carpentry orders, wood moisture checks, and installation schedules via telephone, SMS, or email.
• To detect automated spam bot submissions, prevent malicious form injections, and preserve web server stability.
• To measure the cost-effectiveness and audience relevance of our search engine advertising campaigns on Google Ads and Microsoft Advertising, strictly when explicit visitor consent has been granted.

What are the legal bases for our data processing?

In accordance with statutory standards including GDPR Article 6 and applicable US State regulations, our processing relies on the following lawful bases:

Which advertising platforms run traffic to this site?

This website is a live destination for paid commercial advertising. We actively run acquisition campaigns across google ads and microsoft advertising, and may run campaigns on Meta Ads. When a visitor arrives via a sponsored listing, the referring network appends a unique cryptographic click identifier to the landing page URL:

• google ads: Attaches the Google Click Identifier parameter (gclid) to evaluate search query intent and track conversions.
• microsoft advertising: Attaches the Microsoft Click Identifier parameter (msclkid) to verify Bing and MSN search campaign interactions.
• Meta Ads: Attaches the Facebook Click Identifier parameter (fbclid) when social marketing campaigns are active.

Neither Google, Microsoft, nor Meta has reviewed, approved, or certified Drevantos or this website. We use these commercial platforms under standard advertiser agreements.

How does Consent Mode v2 govern tracking tags?

We have built technical compliance with Google consent mode v2 directly into our page architecture. When you load any page on drevantos.com, the four core storage signals are initialized to a strict denied status before any third-party script executes:

• ad_storage: Denied by default. Blocks writing or reading of advertising cookies.
• ad_user_data: Denied by default. Prevents transmitting user information for advertising purposes.
• ad_personalization: Denied by default. Blocks audience remarketing and ad profile building.
• analytics_storage: Denied by default. Restricts statistical tracking and device fingerprinting.

Only when a visitor clicks “Allow Storage” on our consent dock are these four signals updated to granted. If you select “Decline” or modify your choices using the “Cookie Preferences” link in the footer, all four signals are immediately reset to denied, and tracking storage is purged.

Who are the third-party data processors?

Drevantos does not sell, lease, or rent customer lists. We share data only with designated service providers essential to hosting our site, delivering emails, and measuring paid traffic:

• Google LLC / Google Ireland Ltd: Advertising infrastructure and tag routing. Subject to Google Ads privacy frameworks.
• Microsoft Ireland Operations Ltd / Microsoft Corporation: Search advertising network. You may review the complete Microsoft privacy practices at privacy.microsoft.com.
• Meta Platforms Ireland Ltd / Meta Platforms, Inc.: Social advertising and analytics infrastructure when active.
• Web Hosting & Server Infrastructure Provider: Secure cloud data centre hosting our Linux server, executing PHP backend handlers, and storing our local relational database in encrypted volumes.
• Transactional Email Relay Provider: Encrypted SMTP transport delivering incoming scope assessment submissions directly to [email protected].

How are international data transfers managed?

Drevantos operates in Chicago, Illinois, within the United States. If you access our website from the European Economic Area (EEA), the United Kingdom, or Switzerland, your data is transmitted to and stored on servers located in the United States.

Where data is transferred internationally through our technology partners (Google, Microsoft, Meta), transfers are executed under European Commission Standard Contractual Clauses (SCCs) and the EU-U.S. Data Privacy Framework (DPF) adequacy mechanisms, ensuring equivalent data protection safeguards.

How long do we keep your information?

We reject indefinite data retention. Data is stored only for defined operational periods before being permanently expunged:

What security measures protect your data?

We implement physical, administrative, and technical controls to safeguard stored records against unauthorized interception, destruction, or exposure:

• Transport Layer Security (TLS): Enforced HTTPS with 256-bit encryption for all browsing sessions, form transmissions, and support chat messages.
• Server Access Restrictions: Backend database servers and SSH administration require public-key cryptographic authentication; root password logins are disabled.
• Sanitized Input Handling: All inquiry fields are processed through server-side sanitization routines preventing SQL injection and cross-site scripting (XSS).
• Zero Payment Exposure: No banking numbers, credit card tokens, or payment credentials ever enter our server perimeter.

What rights do you hold under the GDPR?

If you access our services from within the European Economic Area, the General Data Protection Regulation (gdpr) grants you the following statutory rights regarding your personal records:

• Right of Access: You may request an itemised copy of all personal records we hold about you.
• Right to Rectification: You may request correction of inaccurate, outdated, or incomplete project details.
• Right to Erasure (“Right to be Forgotten”): You may request permanent deletion of your inquiry data and chat logs, subject to statutory tax and legal dispute retention rules.
• Right to Restriction: You may restrict processing while a contest regarding accuracy or legitimacy is being reviewed.
• Right to Data Portability: You may receive your provided personal data in a structured, commonly used, machine-readable format.
• Right to Object: You may object at any time to data processing carried out under our legitimate interest grounds.
• Right to Withdraw Consent: Where processing is predicated on consent (such as advertising tracking), you may withdraw it at any time via our Cookie Preferences dock without affecting prior lawful processing.

What are your rights under US State privacy laws and CCPA?

Residents of California are protected by the California Consumer Privacy Act as amended by the California Privacy Rights Act (ccpa). Similar protections apply to residents of Virginia, Colorado, Connecticut, Utah, and other states with active consumer privacy frameworks:

• Right to Know and Access: You may request disclosure of the specific categories of personal information collected, the sources of collection, the commercial purpose, and third parties receiving that data over the preceding 12 months.
• Right to Delete: You have the right to request deletion of personal information collected directly from you.
• Right to Correct: You may request correction of inaccurate personal records.
• Right to Opt Out of Sale or Sharing: Drevantos does not sell personal information for monetary compensation. However, the sharing of click identifiers (gclid, msclkid, fbclid) with ad networks may qualify as “sharing” for cross-context behavioral advertising under California law. You may opt out at any time using our Cookie Preferences dock or via Global Privacy Control.
• Non-Discrimination: We will never deny services, charge differing rates, or provide lower craftsmanship quality if you exercise your statutory privacy rights.

How do we honor Global Privacy Control?

We fully support and recognize global privacy control (GPC). If your browser or operating system broadcasts the Sec-GPC header indicating a universal opt-out of online tracking and data sharing, our client script automatically interprets this as a binding refusal of advertising cookies.

Consent Mode v2 signals (ad_storage, ad_user_data, ad_personalization, analytics_storage) will remain strictly denied without presenting repeated modal prompts.

Is this website intended for children?

No. Drevantos provides architectural woodworking, door hanging, and residential trim carpentry exclusively to homeowners and commercial property clients. Our website and services are not directed at minors, and we do not knowingly solicit or collect personal data from anyone under the age of 16.

If a parent or guardian becomes aware that a child has submitted personal details through our assessment form, contact us at [email protected] and we will immediately purge the record from our database.

Where can you lodge a formal privacy complaint?

If you believe our handling of your personal data infringes applicable data protection statutes, you have the right to register a complaint with a regulatory supervisory authority:

• Illinois Residents: Office of the Illinois Attorney General, 100 West Randolph Street, Chicago, IL 60601.
• California Residents: California Privacy Protection Agency (CPPA) (cppa.ca.gov) or the California Attorney General.
• Other US States: The Attorney General’s Consumer Protection Division in your state of residence.
• European Residents: The competent Data Protection Authority (DPA) in the EU member state of your habitual residence or place of work.

How do you submit a Data Subject Access Request (DSAR)?

To exercise any of your statutory rights under CCPA, US State laws, or GDPR (including access to your project records, deletion of past inquiries, or opt-out confirmation), submit your written request to:

Drevantos Privacy Desk
400 East Monroe Street, Chicago, Illinois 60603
Email: [email protected]
Telephone: +1 (707) 555-6244

Response Timeline: We verify applicant identity against the email address or phone number on file and provide a formal written confirmation within 10 days of receipt. We do not charge a fee for standard data access or deletion requests.

How will you be notified of changes to this policy?

We may periodically update this policy to reflect changes in our advertising platforms, telemetry integrations, or statutory obligations. Any modification will be posted directly to this URL with an updated effective date at the top of the page.

We encourage visitors to review this page periodically. Continued use of drevantos.com following the posting of modifications indicates your acknowledgment of the updated terms.

How can you reach our privacy team?

For questions regarding this policy, Consent Mode v2 configurations, or our finish carpentry practices, contact us directly:

Drevantos Workshop
Attention: Ivan Petrov, Finish Carpenter & Operator
400 East Monroe Street, Chicago, Illinois 60603, United States
Direct Phone: +1 (707) 555-6244
Direct Email: [email protected]