PRIVACY RULES AND PERSONAL DATA PROCESSING POLICY

The rules set out below are based on the regulation adopted in the European Union, namely the General Data Protection Regulation, hereinafter referred to as the GDPR or the Rules, which entered into force on May 25, 2018. The Rules are mandatory for those who collect personal data of natural persons who are residents of the European Union. The Rules apply to persons engaged in the field of works or services involving a subject, namely a natural person residing in the EU.

The GDPR is the General Data Protection Regulation, which unifies the rules for the processing of personal data by private companies and public authorities throughout the European Union. The Rules also comply with the national legislation of Ukraine in the field of personal data processing and protection, in particular the Law of Ukraine “On Personal Data Protection,” the Law of Ukraine “On Electronic Commerce,” and the Law of Ukraine “On Consumer Rights Protection.”

These Rules are applied by Individual Entrepreneur Karachkova Olha Serhiivna, number and date of entry in the Unified State Register of Legal Entities, Individual Entrepreneurs and Public Associations regarding state registration: date of entry: 09.09.2015, entry number: 20650000000039645, registered address: Kyiv, 17 Kovpaka Street, Ukraine (hereinafter referred to as the Individual Entrepreneur or the Controller), to the website https://delavega.ua/ (hereinafter referred to as the Website), through which we collect personal data and which refers to these Rules. The Rules do not apply to websites of the Individual Entrepreneur that do not contain a reference to these Rules or that contain a reference to another document concerning the processing of personal data.

In these Rules, we openly describe all means of personal data processing when using the Website. We understand the importance of a proper approach to privacy and data security and adhere to the principle of comprehensive and complete protection of our users’ personal data. The Rules have been developed and are used together with the Consent to the Processing of Users’ Personal Data.

The Individual Entrepreneur takes the protection of your personal data seriously and therefore implements these data protection Rules, which constitute her privacy policy.

Definition of Terms

The following terms are used in these Data Protection Rules:

• User, or Personal Data Subject, means a natural person who visits the Website and/or orders goods or services through the Website, and whose data are processed by the Controller.
• Personal Data means any information relating to a directly or indirectly identified or identifiable natural person. For example, personal data include surname, first name, patronymic, gender, age, portrait photograph, email address, telephone number, and other similar information.
• Technical Information as Personal Data means that technical information is also treated as personal data if it can be associated with a natural person. For example, this includes an IP address, type of operating system, device type, such as a personal computer, mobile phone, or tablet, browser type, geographical location, the fact of completing a web form, and the provider, namely the Internet service provider. If we cannot in any way associate technical information with a natural person, we will not consider such information to be personal data.
• Personal Data Controller, or Operator, means that you understand that the Individual Entrepreneur is the controller, or operator, only of those personal data that we have received from you as a natural person through our Website. This document defines the rules and policy of the Individual Entrepreneur in the field of personal data processing and protection and is posted at https://delavega.ua/. The Individual Entrepreneur also provides unrestricted access to the Rules to any person who personally contacts the Individual Entrepreneur.
• Processing of Personal Data means any operation or set of operations performed on personal data or sets of personal data, whether by automated means or otherwise, including collection, recording, organization, structuring, systematization, accumulation, storage, adaptation, alteration, updating, electronic copying, retrieval, consultation, use, disclosure by transmission, including dissemination, provision, or access, distribution or any other form of making available, grouping or combination, depersonalization, restriction, blocking, erasure, or destruction.
• Consent of the Personal Data Subject means a voluntary, specific, informed, and unambiguous expression of will by which the User, by performing an active action, for example, ticking a checkbox, clicking the “Place Order” button or the “Send” button, permits the processing of their personal data in accordance with the stated purpose.
• Cross-Border Data Transfer means the transfer of personal data by the Controller to foreign entities involved in relations related to personal data, for example, cloud servers or Google analytics systems located outside Ukraine/the EU.
• Restriction of Processing means the marking of stored personal data for the purpose of limiting their processing in the future.

    1. Legal Grounds, Purpose, and Objectives of Processing

The legal grounds for the processing of personal data are: the User’s consent; conclusion and performance of a contract, including purchase and sale, delivery, and warranty service; the need to fulfill the Controller’s obligations provided for by the legislation of Ukraine.
The main purpose of the Individual Entrepreneur is to ensure the protection of human and civil rights and freedoms when processing personal data, including the protection of the rights to privacy, personal and family secrecy, and strict and consistent compliance with the requirements of legislation.
The Individual Entrepreneur processes personal data for the following purposes:

• When accessing the Website and ordering goods: for the purpose of properly fulfilling the obligations of the Individual Entrepreneur to you, in particular processing orders, concluding purchase and sale agreements, organizing delivery of goods, providing access to services, and registering on the Website.
• When communicating with you: using the email address or telephone number provided by you for the purpose of providing information about the status of an order, providing consultations, and sending promotional offers or news about promotions, exclusively with your consent.
• When receiving feedback from you: for the purpose of obtaining information about loyalty and satisfaction with the brand’s goods/services, analyzing ways to improve the quality of the Website, and conducting statistical research.
• When ensuring security: to confirm actions performed by you, prevent cases of fraud, cyberattacks, and other abuses, as well as to investigate such cases and assist law enforcement agencies.

    2. Use of the Website and Automatic Data Collection

When using the Website, the system automatically collects the following technical data:

1. IP address and/or host name of your computer;
2. name, language, and version of your browser;
3. operating system used for access;
4. URL of the referral source, namely the previously visited page;
5. date and time of your visit;
6. time zone difference in relation to Greenwich Mean Time (GMT);
7. content of the request, namely the specific page;
8. amount of data transferred; access status and HTTPS status code.

We do not use these data to personally identify you. They are needed to obtain aggregated and anonymous website usage statistics, to optimize the Website and advertising, and to maintain the Website’s functions in working order. The Website’s log files are stored separately from other personal data.

    3. Cookies

Our Website uses cookies. A cookie contains small amounts of data, for example, a “cookie identifier.” This is a unique string of characters that allows websites to associate page views with a specific browser. A browser can be identified using a cookie identifier.
We use cookies to improve the usability of the Website, save your preferences, for example, the website language, display banners, authorize you, and obtain data about user sessions.
You may delete or block cookies at any time in the settings of your Internet browser. By doing so, you express your disagreement with the use of cookies. If you disable the storage of cookies, you will not be able to fully use all functions of the Website.

    4. Contact by Email or Through Feedback Forms

If you contact us by email or through one of our feedback forms, certain personal data will be received and stored by us.

• Contact through a feedback form: the type of personal data received can be found in the input fields of the specific form. In addition to visible entries, your IP address, date, and time of access are also automatically collected and stored. These additional data are necessary to track possible abuse of an email address and for our legal protection.
• Contact by email: if you contact us by email, the personal data collected and stored by us will include the full email message sent to us, including all email headers and correspondence history.

    5. Principles of Personal Data Processing

Adequacy is the main principle that we strictly follow. Your personal data will not be processed unless it is truly necessary. We also process data in accordance with the following principles:

1. lawfulness and fairness of personal data processing;
2. processing of personal data in accordance with specific, predetermined, and lawful purposes;
3. prevention of the merging of databases containing personal data where processing is carried out for mutually incompatible purposes;
4. processing only those personal data that correspond to the purposes of their processing;
5. compliance of the content and scope of personal data with the declared purposes of processing;
6. accuracy, adequacy, relevance, and reliability of personal data;
7. lawfulness of technical measures aimed at processing personal data;
8. reasonableness and appropriateness of processing;
9. storage of personal data in a form that allows identification of a natural person and for no longer than required by the purposes of their processing, or during the term of the natural person’s consent.

The Individual Entrepreneur does not verify the accuracy of the personal data provided or the legal capacity of the person who provided them. You guarantee that all data are accurate, up to date, and do not violate legislation.

    6. Methods of Processing, Storage, and Transfer of Data to Third Parties

• The collection of personal data is carried out by: your provision of data when filling out forms or placing an order on the Website; automatic collection using technologies, including web protocols and cookies; provision of data in written form or during a telephone conversation.
• Storage and use: personal data are stored exclusively on properly protected media, including electronic media. The Individual Entrepreneur ensures the use of databases located in Ukraine; however, in the course of cross-border transfer, technical data may be processed on servers outside Ukraine in compliance with security standards.
• Transfer to third parties: the User agrees that the Individual Entrepreneur may transfer personal data to third parties for the purpose of fulfilling orders and analytics. Such third parties include: delivery services and logistics companies, for example, Nova Poshta LLC and others, for the delivery of goods; third-party analytics and marketing services, including Google Analytics and Meta Pixel/Facebook, for analyzing interaction with the Website. In other cases, data are transferred exclusively with your consent or to comply with the requirements of Ukrainian legislation.
• Destruction and anonymization: processed data are subject to destruction or depersonalization immediately after the purposes of processing have been achieved, in the event of receiving a lawful request from the User, upon expiry of the consent period, or in the event of a threat to the security of the Website.

    7. Age Restrictions, Protection of Children’s Data

The Website is not intended for use by persons under the age of 18. The Individual Entrepreneur does not intentionally collect, use, or process personal data of minors. If you are a parent or legal representative and become aware that your child has provided personal data on the Website without your consent, please contact us at info@delavega.ua for the immediate deletion of such information.

    8. Rights of the User, or Data Subject

In accordance with the legislation of Ukraine and the requirements of the GDPR, you have the right to:

• know about the sources of collection, location of your personal data, purpose of their processing, and location of the Controller;
• receive information about the conditions for granting access to personal data, in particular information about third parties to whom your data are transferred;
• require the Individual Entrepreneur to amend, update, or delete your personal data if they are incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated purpose of processing;
• object to the processing of your personal data or request restriction of their processing;
• withdraw your consent to the processing of personal data at any time without explaining the reasons.

    9. Obligations of the Individual Entrepreneur

The Individual Entrepreneur is obliged to:

1. provide, at your request, information about the processing of your personal data or a justified refusal to provide such information;
2. take measures necessary and sufficient to ensure the fulfillment of obligations provided for by legislation;
3. at your request, update or delete personal data if they are incomplete or inaccurate;
4. in the event of detection of unlawful processing that cannot be remedied, destroy such data within a period not exceeding 10 business days;
5. in the event of withdrawal of your consent, stop processing the data and destroy them within a period not exceeding 30 business days from the date of receipt of the withdrawal, except where processing is mandatory by law, for example, for accounting purposes.

    10. Measures to Protect Personal Data

The protection of personal data is ensured through the implementation of legal, organizational, and technical measures necessary to comply with the requirements of Ukrainian legislation. The Individual Entrepreneur implements the following measures:

• Legal support: development of local acts of the Individual Entrepreneur, including these Rules, and their publication in open access on the Website; refusal to use any methods of data processing that do not correspond to predetermined purposes.
• Organizational support: appointment of a person responsible for organizing the processing of personal data, contact email: info@delavega.ua; restriction of the number of employees of the Individual Entrepreneur who have access to data; periodic assessment of security risks; conducting internal investigations to detect cases of unauthorized access; familiarization of employees with legislative requirements and conducting training.
• Technical support: application of encryption methods and secure data transmission protocols, including HTTPS; monitoring and analysis of the security of the Website’s network infrastructure; organization of a security regime for premises and servers that prevents uncontrolled access by unauthorized persons.

    11. Limitation of the Scope of the Rules

You must take a reasonable and responsible approach to placing your own personal data in public access, including on the Website when leaving public reviews and comments. The Individual Entrepreneur is not responsible for the actions of third parties who have gained access to your personal data through your own fault.
The Individual Entrepreneur has the right to amend the Rules if necessary. A mandatory review of the Rules is carried out in the event of significant changes in international or national legislation. In the event of a significant change in the terms of processing, we undertake to notify you thereof at your email address.

    12. Procedure for Requests and Withdrawal of Consent

The User has the right to send requests and withdrawals of consent to the Individual Entrepreneur:

• In electronic form to the email address: info@delavega.ua. An electronic request must be sent from the same email address that you indicated during registration, ordering goods, or filling out forms on the Website, which is a sufficient method of identifying the User.
• In written form to the postal address: 03150, Kyiv, P.O. Box No. 265, Ukraine. A written request must contain your full name, signature, and details of the identity document, including series, number, and date of issue, in order to prevent unauthorized access to your data by third parties.

The Individual Entrepreneur undertakes to consider the request and send a response within 30 calendar days from the date of its receipt. All correspondence received by the Individual Entrepreneur is treated as restricted-access information and is not disclosed without your written consent.