1.1. This Privacy Policy (the “Policy”) describes how personal data is collected, used, stored, protected, disclosed, and otherwise processed when you access or use https://karmalita.store (the “Website”), purchase products, digital products, or services, contact the Seller, or otherwise interact with the Website.
1.2. The data controller of personal data processed through the Website is:
Sole Proprietor Halyna Karmalita (hereinafter referred to as the “Seller”).
1.3. This Policy has been prepared in accordance with:
the Law of Ukraine “On Personal Data Protection”;
Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR), where applicable;
other applicable privacy and data protection laws.
1.4. By accessing or using the Website, placing an Order, purchasing Goods, Digital Products or Services, submitting information through contact forms, or otherwise interacting with the Website, the User acknowledges that they have read and understood this Privacy Policy.
1.5. If the User does not agree with this Privacy Policy, they should discontinue using the Website.
2. PERSONAL DATA WE COLLECT
2.1. Depending on how the Website is used, the Seller may collect the following categories of personal data:
first and last name;
email address;
telephone number;
billing address;
shipping address;
country of residence;
payment-related information available to the Seller;
Order information;
purchase history;
communication with the Seller;
reviews submitted by the User;
information voluntarily provided by the User.
2.2. The Website may automatically collect certain technical information, including:
IP address;
browser type;
browser version;
operating system;
device type;
preferred language;
time zone;
pages visited;
date and time of access;
referring website;
browsing activity;
technical diagnostics necessary for Website operation.
2.3. The Seller does not collect, process, or store complete payment card numbers, CVV/CVC codes, or other confidential payment credentials. Payments are securely processed by independent payment providers in accordance with their own privacy policies and security standards.
3. PURPOSES OF PROCESSING PERSONAL DATA
3.1. Personal data may be processed for the following purposes:
processing Orders;
fulfilling contracts with Buyers;
manufacturing handmade products;
providing Digital Products;
providing consultations and other Services;
processing payments;
arranging shipment and delivery;
communicating with Users regarding Orders;
responding to inquiries and customer support requests;
managing customer accounts where applicable;
complying with legal obligations;
maintaining accounting and tax records;
preventing fraud;
protecting the security of the Website;
improving Website functionality;
analyzing Website performance;
administering the Website;
protecting the Seller’s legal rights.
3.2. Subject to the User’s separate consent where required by applicable law, personal data may also be processed for:
newsletters;
promotional emails;
special offers;
marketing communications;
customer satisfaction surveys;
personalized recommendations.
3.3. The User may withdraw consent to receive marketing communications at any time by using the unsubscribe link contained in such communications or by contacting the Seller directly.
4. LEGAL BASES FOR PROCESSING PERSONAL DATA
4.1. The Seller processes personal data only where there is a lawful basis for doing so under applicable law.
4.2. Depending on the circumstances, personal data may be processed on one or more of the following legal bases:
performance of a contract with the User;
taking steps prior to entering into a contract at the User’s request;
compliance with legal obligations;
the Seller’s legitimate interests, provided such interests do not override the User’s rights and freedoms;
the User’s consent;
establishment, exercise, or defense of legal claims.
4.3. Where processing is based on the User’s consent, the User may withdraw such consent at any time. Withdrawal of consent shall not affect the lawfulness of processing carried out before the consent was withdrawn.
5. DISCLOSURE OF PERSONAL DATA TO THIRD PARTIES
5.1. The Seller does not sell, rent, or otherwise commercially disclose personal data to third parties.
5.2. Personal data may be shared only to the extent necessary for operating the Website, fulfilling Orders, providing Services, complying with legal obligations, or protecting the Seller’s legitimate interests.
5.3. Personal data may be disclosed to the following categories of recipients:
payment service providers;
banks and financial institutions;
postal and courier services;
shipping companies;
hosting providers;
cloud service providers;
IT service providers;
software providers;
accounting and legal advisers;
analytics providers;
email service providers;
governmental authorities where disclosure is required by law.
5.4. Payments made through the Website may be processed by independent payment providers, including PayPal, as well as other payment services available on the Website. These providers process payment information independently in accordance with their own privacy policies and applicable legal requirements.
5.5. For the purpose of delivering Orders, the Seller may provide the Buyer’s name, shipping address, telephone number, and other information strictly necessary for successful delivery to postal operators and courier companies.
5.6. The Seller shares only the minimum amount of personal data reasonably necessary for each specific purpose.
5.7. Personal data may also be disclosed where required by law, court order, governmental authority, or other legally binding request.
6. INTERNATIONAL TRANSFERS OF PERSONAL DATA
6.1. Because the Website serves customers worldwide, personal data may be transferred to, stored, or processed outside the User’s country of residence.
6.2. Where personal data is transferred outside Ukraine or the European Economic Area (EEA), the Seller takes reasonable steps to ensure that such transfers are carried out in accordance with applicable data protection laws.
6.3. Where required by the GDPR, appropriate safeguards may include:
an adequacy decision issued by the European Commission;
Standard Contractual Clauses (SCCs);
legally approved transfer mechanisms;
other safeguards recognized under applicable law.
6.4. By placing an international Order, the User understands that certain personal data may be transferred to postal operators, customs authorities, courier companies, payment providers, and other service providers located in different countries solely for the purpose of fulfilling the Order.
6.5. The Seller does not transfer personal data internationally for purposes unrelated to the operation of the Website, the performance of contracts, compliance with legal obligations, or other lawful purposes described in this Privacy Policy.
7. DATA RETENTION
7.1. Personal data is retained only for as long as necessary to fulfill the purposes described in this Privacy Policy, comply with legal obligations, resolve disputes, enforce agreements, or protect the Seller’s legitimate interests.
7.2. The retention period may depend on:
the duration of the contractual relationship;
accounting and tax requirements;
applicable statutory limitation periods;
legal obligations imposed by applicable law;
the need to establish, exercise, or defend legal claims.
7.3. When personal data is no longer required, it will be securely deleted, anonymized, or otherwise disposed of in accordance with applicable law.
8. YOUR RIGHTS
8.1. Subject to applicable law, the User has the right to:
obtain information regarding the processing of their personal data;
access their personal data;
request correction of inaccurate or incomplete personal data;
request the deletion of personal data (“right to be forgotten”);
request restriction of processing;
object to the processing of personal data;
withdraw consent where processing is based on consent;
receive personal data in a structured, commonly used, and machine-readable format where applicable (data portability);
lodge a complaint with the competent data protection authority.
8.2. The exercise of certain rights may be limited where the Seller is legally required or otherwise permitted by applicable law to retain or continue processing personal data.
8.3. Requests concerning personal data may be submitted using the contact details provided on the Website.
8.4. The Seller will respond to requests within the time limits established by applicable law.
9. SECURITY OF PERSONAL DATA
9.1. The Seller implements appropriate technical, organizational, and administrative measures designed to protect personal data against unauthorized access, accidental or unlawful destruction, loss, alteration, disclosure, or misuse.
9.2. Such security measures may include:
secure hosting environments;
encrypted data transmission (SSL/TLS);
restricted access to personal data;
authentication and access control procedures;
regular software updates;
security monitoring;
backup procedures;
other reasonable technical and organizational safeguards.
9.3. Despite the use of appropriate security measures, no method of transmission over the Internet or electronic storage is completely secure. Therefore, the Seller cannot guarantee absolute security of personal data.
9.4. In the event of a personal data breach, the Seller will take the actions required by applicable law, including notifying competent supervisory authorities and affected Users where legally required.
10. COOKIES AND TRACKING TECHNOLOGIES
10.1. The Website uses Cookies, web beacons, tracking pixels, browser local storage, and other similar technologies to ensure proper Website operation, improve functionality, analyze Website usage, enhance security, and provide a better user experience.
10.2. Cookies may be used for the following purposes:
ensuring proper Website functionality;
remembering User preferences;
maintaining user authentication;
operating the shopping cart;
processing Orders;
analyzing Website traffic;
improving Website performance;
detecting technical issues;
preventing fraud;
protecting Website security.
10.3. Subject to the User’s consent where required by applicable law, the Website may also use analytical, statistical, functional, marketing, and advertising Cookies.
10.4. Detailed information regarding the categories of Cookies used, their purposes, retention periods, legal bases for processing, methods of managing Cookie preferences, and procedures for granting or withdrawing consent is available in the separate Cookie Policy published on the Website.
10.5. The User may manage or withdraw Cookie preferences at any time through the Cookie Consent Banner (where available) or by changing their browser settings. Disabling certain categories of Cookies may affect the proper functioning of some Website features.
10.6. By using the Website, the User acknowledges that they have been informed about the use of Cookies and, where required by applicable law, may provide or decline consent through the Website’s Cookie management tools.
11. THIRD-PARTY WEBSITES
11.1. The Website may contain links to third-party websites, applications, or online services.
11.2. The Seller does not control and is not responsible for the privacy practices, content, security, or operation of any third-party websites or services.
11.3. Users are encouraged to review the privacy policies and terms of use of any third-party websites before providing personal information or using such websites.
12. CHILDREN’S PRIVACY
12.1. The Website is intended solely for individuals who are at least 18 years of age.
12.2. The Seller does not knowingly collect or process personal data from individuals under the age of 18.
12.3. If the Seller becomes aware that personal data of a person under the age of 18 has been collected without a valid legal basis, such data will be deleted without undue delay unless retention is required by applicable law.
13. CHANGES TO THIS PRIVACY POLICY
13.1. The Seller reserves the right to amend, update, or modify this Privacy Policy at any time.
13.2. The current version of this Privacy Policy will always be available on the Website.
13.3. Any revised version of this Privacy Policy becomes effective upon its publication on the Website unless a different effective date is expressly stated.
13.4. Continued use of the Website after the publication of an updated Privacy Policy constitutes the User’s acknowledgment of and agreement to the revised Policy to the extent permitted by applicable law.
13.5. If any provision of this Privacy Policy is held to be invalid, unlawful, or unenforceable, the remaining provisions shall remain in full force and effect.
13.6. Any matters not expressly governed by this Privacy Policy shall be governed by the Website’s Terms and Conditions, Cookie Policy, and the applicable laws of Ukraine
