Privacy Policy

This Policy applies to relations regarding the processing of personal data using automated, partially automated, and non-automated means.

1.1. Definition of Terms:

• Personal data database — a collection of organized personal data in electronic form and/or in the form of personal data files;
• Responsible person — a designated person who organizes work related to the protection of personal data during its processing, in accordance with the law;
• Personal database owner — an individual or legal entity authorized by law or with the consent of the personal data subject to process this data, who approves the purpose of processing and determines the composition of data and processing procedures;
• State Register of Personal Databases — a unified state information system for collecting, accumulating, and processing information on registered personal data databases;
• Publicly available sources of personal data — directories, address books, registries, lists, catalogs, and other systematized collections of open information;
• Consent of the personal data subject — any documented, voluntary expression of an individual's will regarding the granting of permission to process their personal data;
• Anonymization of personal data — the extraction of information that allows for identification of an individual;
• Personal data — information or a set of information about an individual who is identified or can be specifically identified;
• Personal data subject — an individual in relation to whom, in accordance with the law, their personal data is processed;
• Third party — any person other than the personal data subject, the owner or manager of the personal database, and the authorized state body for the protection of personal data;
• Special categories of data — personal data on racial or ethnic origin, political, religious, or ideological beliefs, membership in political parties and trade unions, as well as data related to health or sexual life.

1.2. This Policy is binding for the responsible person and the seller's employees directly processing and/or having access to personal data in connection with the performance of their official duties.

2.1. The seller is the owner of the following personal databases: counterparty (buyer) personal database — personal data of online store customers for order fulfillment, service provision, and civil law relations.

3.1. The purpose of processing personal data in the system is to ensure the implementation of civil law relations, the provision, receipt, and payment for purchased goods and services in accordance with the Tax Code of Ukraine and the Law of Ukraine "On Accounting and Financial Reporting in Ukraine."

4.1. Consent of a personal data subject must be a voluntary expression of the individual's will to allow the processing of their personal data in accordance with the stated purpose of processing.

4.2. Consent of a personal data subject may be provided in the following forms:

• A paper document containing details identifying the document and the individual;
• An electronic document containing mandatory details identifying the document and the individual. It is advisable to certify the voluntary expression of will with the personal data subject's electronic signature;
• A mark on the electronic page of the document or in an electronic file processed in the information system based on documented software and hardware solutions.

4.4. The personal data subject is notified of the inclusion of their personal data in the database, their rights defined by the Law of Ukraine "On the Protection of Personal Data," the purpose of data collection, and the persons to whom their personal data is transferred, when formalizing civil law relations in accordance with applicable law.

5.1. The personal databases specified in Section 2 of these Regulations are located at the seller's address. Data may be stored on servers within Ukraine and/or in cloud services in compliance with applicable legislation.

6.1. The procedure for accessing third-party personal data is determined by the terms of the personal data subject's consent to the processing of such data provided to the owner, or in accordance with legal requirements.

6.2. Access to personal data is not granted to a third party if the said person refuses to undertake the obligation to ensure compliance with the requirements of the Law of Ukraine "On the Protection of Personal Data" or is unable to ensure such compliance.

6.3. The request for access to personal data must include: the applicant's full name, place of residence, and identity document details; the purpose of the request and the list of personal data being requested.

6.4. The period for reviewing a request shall not exceed 10 business days from the date of its receipt. The request shall be fulfilled within 30 calendar days from the date of receipt, unless otherwise provided by law.

7.1. Personal data protection is carried out through technical and organizational measures that prevent unauthorized access, destruction, modification, or distribution of personal data. Protection measures include data encryption, need-to-know access restrictions, and regular security audits.

7.2. Responsible person: Oleksii Ignatenko.

7.3. Personal data retention period: for the duration of contractual obligations and for 3 years after their fulfillment, unless otherwise provided by law.

• To know about the sources of collection, location of their personal data, the purpose of its processing, and the location of the owner or manager of the personal database;
• To receive information about the conditions for providing access to personal data, including information about third parties to whom their personal data is transferred;
• To access their personal data;
• To receive, within 30 calendar days of submitting a request, a response as to whether their personal data is stored and to receive the content of such personal data;
• To present a motivated request to change or destroy their personal data if this data is being processed illegally or is inaccurate;
• To protection of their personal data from unlawful processing and accidental loss, destruction, or damage;
• To file complaints about the processing of their personal data with the Authorized Body or with a court;
• To withdraw consent to the processing of personal data;
• To know the mechanism of automated processing of personal data;
• To protection from automated decisions that have legal consequences for them.

9.1. The personal data subject has the right to submit requests regarding access to their personal data, its modification or deletion. Request review period: 30 calendar days from the date of receipt.

9.2. Send requests to: