UAEN
0
Menu
HomePerfumeryJewelryAboutSign inCart
UAEN

Personal Data Protection and Processing Policy

PERSONAL DATA PROTECTION AND PROCESSING POLICY

1. General provisions

1.1. This Personal Data Protection and Processing Policy has been prepared in accordance with the Law “On Personal Data Protection” and establishes the procedure for processing personal data and measures for ensuring its security in the gparfums.com Online Store, hereinafter the “Policy”.

1.2. The gparfums.com Online Store, hereinafter the “Online Store”, regards respect for human and civil rights and freedoms when processing personal data, including the protection of privacy and personal and family confidentiality, as a principal objective and condition of its activities.

1.3. The Policy establishes the Online Store’s requirements for processing and protecting data subjects’ personal data at every stage, including through organisational and technical measures.

1.4. The Policy applies to an indefinite group of individuals, data subjects, who enter or may enter into any relationship with the Online Store.

Terms and abbreviations

2.1. Personal data controller: the gparfums.com Online Store, Individual Entrepreneur Грабчук Олег Іванович, actual address: Ukraine, 09119, Kyiv Region, Bila Tserkva District, Bila Tserkva, Fastivska Street, building 21б, apartment 37. The controller determines the purpose of processing personal data, the composition of that data and its processing procedures, unless otherwise prescribed by law.

2.2. Data subject’s consent: an informed individual’s voluntary expression of permission to process their personal data for a stated purpose, expressed in writing or in a form allowing consent to be established. In electronic commerce, consent may be given when registering in an electronic commerce entity’s information and communications system by marking permission to process personal data for the stated purpose, provided that the system does not permit processing before that mark is made. Consent may also be given by:

  • a Customer accepting the Online Store’s public offer agreement for the sale of goods and provision of services, registering on the Website, or confirming an order on the Website, including, without limitation, clicking “Place order” or “Pay for order”;
  • a Counterparty entering into a relevant transaction with the Online Store;
  • a User taking part in a relevant survey conducted by the Online Store or its partners;
  • an Employee signing consent to personal data processing, an employment application or similar document;
  • a User providing documents or information containing personal data when intending to enter into a relevant transaction or employment contract with the Online Store.

2.3. Personal data, hereinafter “PD”: information or a set of information about an individual who is identified or can be specifically identified.

2.4. Customer: a data subject, an individual or their representative, who consumes goods or services provided by the Online Store and whose personal data it processes, as well as any visitor who has registered on gparfums.com or has given data subject consent.

2.5. Counterparty: a data subject, including an individual, individual entrepreneur, representative of a legal entity, or individual without business entity status, acting in civil or commercial legal relations with the Online Store.

2.6. Users: Customers, Counterparties and Employees when referred to collectively in this Policy.

2.7. Personal data processing: any action or set of actions, such as collection, registration, accumulation, storage, adaptation, alteration, updating, use, dissemination, distribution, sale, transfer, depersonalisation or destruction of personal data, including through information or automated systems.

2.8. Employee: an individual personally performing work under an employment agreement or contract with the Online Store, or intending to enter employment relations by providing personal data for recruitment in response to the Online Store’s vacancy information.

2.9. Personal data processor: an individual or legal entity authorised by the controller or by law to process personal data on the controller’s behalf.

2.10. Website: the gparfums.com website on the Internet.

2.11. Data subject: an individual whose personal data is processed.

2.12. Third party: any person other than the data subject, controller, processor or Ukrainian Parliament Commissioner for Human Rights, hereinafter the “Commissioner”, to whom personal data is transferred by the Online Store or processor.

3. Main provisions

3.1. Personal data processing in the Online Store

3.1.1. The Online Store is a personal data controller and, in cases provided for by applicable Ukrainian law or under concluded agreements, a personal data processor.

3.1.2. Its personal data processing procedure is determined by this Policy on the basis of applicable Ukrainian law.

3.1.3. The Online Store processes personal data through any action or set of actions, including collection, systematisation, storage, alteration, use, depersonalisation, blocking, dissemination, provision and deletion.

3.1.4. The Online Store will take all necessary measures to ensure that Users’ personal data is processed securely and in accordance with this Policy and is not transferred to a third party until that party ensures appropriate controls for personal data protection.

3.1.5. Primary sources of information about an individual are documents issued in their name, documents signed by them, and information they provide about themselves.

3.1.6. Personal data processing is part of the Online Store’s business processes. It may be automated or non-automated.

3.1.7. The Online Store may entrust processing to a personal data processor under a written agreement. The processor may process data only for the purpose and to the extent specified in that agreement.

3.1.8. The Online Store does not process personal data concerning racial or ethnic origin, political, religious or philosophical beliefs, membership of political parties or trade unions, criminal convictions, sex life, biometric data or genetic data.

3.1.9. Users’ data is collected and processed exclusively within Ukraine and in accordance with applicable Ukrainian law.

3.1.10. Processing periods are set by the Online Store according to the category of data subject and processing purpose and are determined by applicable Ukrainian law.

3.1.11. The grounds for processing are:

  • the data subject’s consent;
  • permission granted to the controller by law solely to exercise its powers;
  • conclusion and performance of a transaction to which the data subject is a party, which benefits the data subject, or measures preceding a transaction at the data subject’s request;
  • protection of the data subject’s vital interests;
  • the need to fulfil a controller’s obligation prescribed by law;
  • the need to protect the legitimate interests of the controller or a recipient third party, except where the protection of the data subject’s fundamental rights and freedoms in relation to processing overrides those interests.

3.1.12. The Online Store notifies the data subject within ten working days of transferring personal data to a third party, except where:

  • data is transferred in response to requests for operational investigation, counterintelligence or counterterrorism activities;
  • state authorities or local government bodies exercise powers prescribed by law;
  • data is processed for historical, statistical or scientific purposes;
  • court proceedings are brought to protect rights;
  • transfer to third parties is provided for by the transaction between the Online Store and the data subject;
  • data is transferred in other cases specified in section 3.4 of this Policy.

3.1.13. Personal data being processed must be destroyed or depersonalised once the processing purposes are achieved or are no longer necessary, unless otherwise prescribed by applicable Ukrainian law.

3.2. Users’ personal data received and processed by the Online Store

3.2.1. To conduct its activities and fulfil its obligations, the Online Store processes personal data provided by the data subject during registration on its website or Internet resource, or by other means.

3.2.2. Users’ personal data may include, without limitation:

  • surname, first name and patronymic, where applicable;
  • date of birth or age;
  • sex;
  • marital status;
  • passport details and taxpayer registration number;
  • email address;
  • telephone number;
  • residential or delivery address;
  • date of birth;
  • information necessary for communication between Users and the Online Store;
  • data obtained from surveys conducted by the Online Store or authorised third parties to improve communication with Users;
  • information obtained through marketing activities;
  • information lawfully obtained from partners or third parties;
  • other information voluntarily provided by the User or obtained during the Online Store’s activities, whose processing purpose corresponds to the purposes of personal data processing.

3.2.2.1. In addition to section 3.2.2, the Online Store processes the following personal data in the “Customers” category:

  • the list and status of orders in the Website profile;
  • information, including photographs, posted in profiles, reviews or comments, and customer support enquiries, complaints, claims and other requests;
  • cookies and Website usage data;
  • payment settlement data;
  • delivery branch numbers;
  • processing data: a telephone number or email address used as a login and an encrypted password;
  • information posted or provided during participation in bonus programmes, quizzes, promotions and special offers organised by the Online Store on the Website.

3.2.2.2. In addition to section 3.2.2, the Online Store processes the following personal data in the “Employees” category:

  • data received from job applicants;
  • taxpayer registration number or information about refusal to obtain one;
  • identity document details, including paper or electronic copies;
  • registered address, permanent residence or temporary place of stay;
  • family composition and number of dependants, their surnames, first names and patronymics, sex, age, registered and residential addresses and contact details;
  • occupation, specialisation and qualification class;
  • employment history and workplaces;
  • military service status;
  • education, including academic titles and professional development courses, and language proficiency;
  • driving entitlements and driving experience;
  • positions held;
  • photographs, video and audio recordings made by the employer during the performance of employment duties;
  • workplace address;
  • basic and additional salary, bonuses and other income;
  • specimen signature;
  • bank account details.

3.2.2.3. In addition to section 3.2.2, the Online Store processes the following personal data in the “Counterparties” category:

  • data received from prospective counterparties intending to enter civil or commercial contracts with the Online Store;
  • taxpayer registration number or information about refusal to obtain one;
  • registered address, permanent residence or temporary place of stay;
  • identity document details, including paper or electronic copies;
  • specimen signature;
  • individual entrepreneur registration details;
  • contact persons for communications relating to concluded transactions, including surnames, first names, patronymics, telephone numbers and email addresses;
  • bank details.

3.2.2.4. Data transmitted automatically to the Online Store during use through software installed on a device, including cookie information and information about the User’s device, includes:

  • the Internet protocol address of the User’s computer, such as an IP address;
  • browser type and version;
  • service pages visited, visit times and time spent on those pages;
  • unique device identifiers and other diagnostic data, mobile device type, mobile IP address, operating system and mobile browser type;
  • cookies and other data in those files.

The information collected includes, for example, the number of Website visitors, pages visited and whether a User has previously used the Online Store’s services. It helps identify the services of greatest interest to the User and improve and expand their experience. The Online Store uses cookies and similar tracking technologies to monitor activity and store information. Cookies are small amounts of data that may contain an anonymous unique identifier. They are sent from a website to a browser and stored on the User’s device. Tracking technologies also include beacons, tags and scripts for collecting and tracking information and improving services. The User may reject all cookies by changing browser settings. By rejecting cookies, the User accepts that some parts or functions of the services may be unavailable.

3.3. Purposes and legal grounds for collecting and processing personal data

3.3.1. The scope, methods, purposes and legal grounds for collection and processing may vary depending on how Users interact with the Online Store.

3.3.2. The Online Store collects and processes data concerning these User categories:

  • Customers: individuals and their representatives;
  • Counterparties: parties in civil or commercial relations with the Online Store, including representatives of legal entities, individual entrepreneurs, individuals without business entity status and their representatives;
  • Employees.

3.3.3. The Online Store processes Users’ personal data, including collection, receipt, recording, systematisation, accumulation, storage, clarification, updating, alteration, retrieval, use, transfer, provision, access, blocking, deletion and destruction, by automated, non-automated or mixed methods, for the following purposes:

  • registering Customers on the Website;
  • identifying Users when registering for services or authenticating registered Users;
  • operating the Website or its components;
  • processing Customers’ Website orders and transferring data to relevant sellers, service providers, partners, businesses, delivery and payment services, including foreign parties in personal data relations, to fulfil orders properly;
  • providing access to personalised resources;
  • communicating with Users, including sending notices and requests concerning services and processing Users’ enquiries and applications;
  • confirming the accuracy and completeness of data provided by Users;
  • providing effective customer and technical support;
  • monitoring use of the Online Store’s and its partners’ services;
  • sending advertising messages and providing personalised offers and additional opportunities to use services;
  • improving user experience, service quality and convenience, and developing new services;
  • conducting marketing activities, research and campaigns, and analysing consumer sentiment;
  • analysing user data and conducting statistical and other research into interactions with the Online Store and third parties;
  • enabling comments and feedback about purchases;
  • conducting surveys relating to the Online Store and its partners;
  • conducting the Online Store’s business activities;
  • preparing statistical, administrative and other reporting information on the Online Store’s activities in accordance with legislation and internal documentation;
  • communicating with Counterparties and their representatives;
  • maintaining accounting, financial, tax and management records;
  • conducting business correspondence, including responding to requests from public authorities;
  • managing employment relations, recruitment and internships;
  • implementing administrative legal relations;
  • managing human resources, including workforce capacity;
  • protecting the rights and legitimate interests of the Online Store and interested parties;
  • complying with Ukrainian legislation;
  • implementing other relations requiring personal data processing for income generation and implementation of Ukrainian legislation, the Online Store’s charter and internal provisions and policies.

3.4. Conditions for processing Users’ personal data and transferring it to third parties

3.4.1. Users’ personal data is processed in accordance with the Law of Ukraine “On Personal Data Protection”.

3.4.2. All Users’ personal data is kept confidential and secure.

3.4.3. The Online Store may transfer Users’ personal data or entrust processing to third parties in these cases:

  • fulfilling legal obligations, including processing and fulfilling a Customer’s Order;
  • preventing or investigating possible offences;
  • enabling protection of the rights and legitimate interests of the Online Store and its partners;
  • providing information to law enforcement and other competent public authorities in response to requests complying with applicable Ukrainian law;
  • protecting the personal safety of Users or third parties.

3.4.4. Recipients may include, without limitation:

  • processors, including enterprises, institutions and organisations of all ownership types, state authorities, local government bodies and individual entrepreneurs authorised, or to be authorised, by the Online Store or applicable law to process personal data;
  • third parties engaged by the Online Store or involved in money transfer services, banks and non-bank financial institutions;
  • third parties engaged to fulfil Website orders, including carriers, contractors, businesses handing over orders, owners of ordered goods or services, and parties arranging delivery and payment;
  • archival institutions and other providers of information and document storage and related services;
  • the Online Store’s participants, affiliates, persons with significant interests in it or persons exercising control over it;
  • other individuals and organisations performing functions or providing services under transactions with the Online Store, who may process and use personal data for the purposes specified in section 3.3.3.

3.5. Measures to protect Users’ personal data

3.5.1. Processing and protection are based on a risk-oriented approach to prevent, detect and eliminate threats of unauthorised access or unlawful processing.

3.5.2. The Online Store takes necessary legal, organisational and technical measures to protect personal information against unlawful or accidental access, destruction, distortion, blocking, copying, provision, dissemination and other unlawful actions concerning Users’ personal information in relation to its processing and personal data legislation.

3.5.3. Designated employees process Users’ personal data on equipment located in restricted-access premises, solely in accordance with their professional or employment duties. They must not disclose this data even after employment ends.

Final provisions

5.1. The Online Store takes measures to protect personal data at every processing stage.

5.2. It independently determines the list and composition of processing security measures, taking into account legislation on personal data protection and information security.

5.3. Personal data protection includes measures to prevent accidental loss or destruction and unlawful processing, including unlawful destruction or access.

5.4. The Website may link to other websites owned and administered by parties unconnected with the Online Store. Following such links takes Users to third-party websites. The Online Store strongly recommends reading each website’s privacy policy before proceeding. It does not control and accepts no responsibility for the content or privacy policies of third-party websites or services.

5.5. Users may request clarification about personal data processing by emailing gparfums.order@gmail.com.

5.6. Users accept responsibility for possible adverse consequences of providing incomplete, inaccurate or outdated personal data, or third parties’ personal data, to the Online Store.

5.7. User requests imposing additional restrictions on processing, prohibiting processing or requiring destruction may make it impossible for the Online Store to fulfil obligations to the User under the public agreement. In such cases, the Online Store is not liable for failure to perform or improper performance of its obligations.

5.8. Changes to the Online Store’s personal data processing policy will be reflected in this document. The Policy remains effective indefinitely until replaced by a new version.

5.9. The Policy is published on the Online Store’s official website, https://gparfums.com/, to inform data subjects whose data is processed during its statutory activities.

5.10. Matters not governed by this Policy are governed by applicable Ukrainian law.

Notice of data subject rights

4.1. The Online Store informs data subjects of their rights under Article 8 of the Law of Ukraine “On Personal Data Protection”, including the right to:

  • know the sources and location of their personal data, processing purposes and the controller’s or processor’s location, residence or place of stay, or authorise representatives to obtain this information, except as prescribed by law;
  • receive information on access conditions, including third parties receiving their personal data;
  • access their personal data;
  • receive a response within thirty calendar days of a request, except as prescribed by law, confirming whether their data is processed and providing its content;
  • submit a reasoned request to any controller or processor to alter or destroy data processed unlawfully or inaccurately;
  • protection against unlawful processing and accidental loss, destruction or damage caused by deliberate concealment, failure to provide data or delayed provision, and against inaccurate information or information damaging an individual’s honour, dignity or business reputation;
  • complain about processing in accordance with applicable law;
  • seek legal remedies for violations of personal data protection legislation;
  • stipulate restrictions on processing rights when giving consent;
  • withdraw consent;
  • know the mechanism of automated processing;
  • protection against automated decisions producing legal consequences for them.

4.2. A data subject may obtain information about themselves from any party in personal data relations without stating the purpose of the request, except as prescribed by law.

4.3. Access to one’s own data is free of charge. The data subject submits an access request to the Online Store.

4.4. Requests are fulfilled within thirty calendar days of receipt unless otherwise prescribed by law. Requested information is provided in writing by sending a letter.

4.5. References to this Policy in any documents or agreements constitute proper notification of data subjects about their rights.