Personal Data Protection and Processing Policy

1.1. This Personal Data Protection and Processing Policy is drawn up in accordance with the Law of Ukraine “On Personal Data Protection” and defines the procedure for processing personal data and the measures to ensure the security of personal data in the ArtmasterMops online store (hereinafter – the Policy).

1.2. The ArtmasterMops online store (hereinafter – the Online Store) considers respect for the rights and freedoms of every person and citizen during the processing of their personal data, including the protection of the rights to privacy and personal and family secrecy, to be the most important goal and condition of its activity.

1.3. The Policy defines the Online Store's requirements for the processing and protection of personal data of data subjects at all stages of processing, including by means of organisational and technical measures.

1.4. The Policy applies to an indefinite range of persons – data subjects who enter or may enter into any relations with the Online Store.

2.1. Personal data owner – the ArtmasterMops online store, individual entrepreneur Maryna Mateienko Leonidivna. The personal data owner determines the purpose of processing, the composition of the data and the procedures for its processing, unless otherwise established by law.

2.2. Consent of the data subject – a voluntary expression of will by an individual (provided they are informed) to grant permission to process their personal data in accordance with the stated purpose, expressed in writing or in a form that allows a conclusion to be made about the granting of consent. In e-commerce, consent may be given during registration in the information and communication system by ticking a box granting permission to process personal data, provided that such system does not allow processing before the box is ticked. Consent may also be given by:

• the Client joining the Public Offer Agreement on the sale of goods and provision of services of the Online Store, by registering on the Site or confirming an order on the Site (in particular, by clicking the “Place order” or “Pay for order” button);
• the Counterparty concluding the relevant transaction with the Online Store;
• the User taking part in a relevant survey conducted by the Online Store or its partners;
• the Employee signing consent to the processing of personal data (a job application, etc.);
• the User providing documents/information containing personal data when intending to conclude a relevant transaction/employment contract with the Online Store.

2.3. Personal data (hereinafter – PD) – information or a set of information about an individual who is identified or can be specifically identified.

2.4. Client – a data subject (an individual or their representative) who is a consumer of the goods/services of the Online Store and whose personal data is processed by the Online Store, as well as any visitor who has registered on the Online Store's site (artmastermops.net.ua) or has given the consent of a data subject.

2.5. Counterparty – a data subject (an individual, an individual entrepreneur, a representative of a legal entity, individuals without the status of a business entity) acting in civil-law and economic-law relations with the Online Store.

2.6. Users – Clients, Counterparties and Employees when referred to jointly in the text of the Policy.

2.7. Processing of personal data – any action or set of actions, such as collection, registration, accumulation, storage, adaptation, alteration, renewal, use and dissemination (distribution, sale, transfer), depersonalisation and destruction of personal data, including with the use of information (automated) systems.

2.8. Employee – an individual who personally performs a labour function under an employment contract concluded with the Online Store or who intends to enter into employment relations (provides personal data for employment purposes in response to information about available vacancies).

2.9. Personal data processor – an individual or legal entity authorised by the personal data owner or by law to process this data on behalf of the owner.

2.10. Site – the website of the Online Store (artmastermops.net.ua) located on the Internet.

2.11. Data subject – an individual whose personal data is processed.

2.12. Third party – any person, except the data subject, the owner or processor of personal data and the Ukrainian Parliament Commissioner for Human Rights, to whom the Online Store or processor transfers personal data.

3.1.1. The Online Store is the owner of personal data and, in cases provided for by the current legislation of Ukraine and/or on the basis of concluded agreements, acts as the processor of personal data.

3.1.2. The procedure for processing personal data in the Online Store is determined by this Policy on the basis of the current legislation of Ukraine.

3.1.3. The Online Store processes personal data – any action or set of actions carried out with personal data, including collection, systematisation, storage, alteration, use, depersonalisation, blocking, distribution, provision and deletion of personal data.

3.1.4. The Online Store takes all necessary measures to ensure that Users' personal data is processed securely and in accordance with this Policy and is not transferred to a third party until appropriate controls for the protection of personal data are ensured.

3.1.5. The primary sources of information about an individual are: documents issued in their name, documents signed by them, and information the person provides about themselves.

3.1.6. Personal data processing is part of the Online Store's business processes and may be automated or non-automated.

3.1.7. The Online Store may entrust the processing of personal data to a processor under a written agreement. The processor may process personal data only for the purpose and to the extent specified in the agreement.

3.1.8. The Online Store does not process personal data concerning racial or ethnic origin, political, religious or ideological beliefs, membership in political parties and trade unions, criminal convictions, or data relating to sexual life, biometric or genetic data.

3.1.9. Users' data is collected and processed exclusively on the territory of Ukraine and in accordance with the current legislation of Ukraine.

3.1.10. The term of personal data processing is set by the Online Store depending on the category of data subjects and the purpose of processing, and is determined by the current legislation of Ukraine.

3.1.11. The grounds for processing personal data are:

• the data subject's consent to the processing of their personal data;
• permission to process personal data granted to the owner under the law solely for the exercise of their powers;
• the conclusion and performance of a transaction to which the data subject is a party or which is concluded for their benefit, or for taking measures preceding the conclusion of a transaction at the data subject's request;
• the protection of the vital interests of the data subject;
• the need to fulfil an obligation of the data owner provided for by law;
• the need to protect the legitimate interests of the owner or a third party to whom the data is transferred, except where the data subject's fundamental rights and freedoms outweigh such interests.

3.1.12. The Online Store notifies the data subject of the transfer of personal data to a third party within ten working days, except in the following cases:

• transfer upon request when carrying out operational-search or counterintelligence activities or counter-terrorism tasks;
• the exercise by state and local self-government bodies of their powers provided for by law;
• processing of personal data for historical, statistical or scientific purposes;
• applying to a court to protect one's rights;
• where the possibility of transfer to third parties is provided for by the terms of a concluded transaction;
• transfer of personal data in other cases defined in clause 3.4 of this Policy.

3.1.13. Personal data being processed is subject to destruction or depersonalisation after the purposes of processing have been achieved or if the need to achieve these purposes is lost, unless otherwise provided for by the current legislation of Ukraine.

3.2.1. To carry out its activities and fulfil its obligations, the Online Store processes the personal data of the data subject provided during registration on the Site or provided in another way.

3.2.2. Users' personal data may include, but is not limited to:

• surname, first name, patronymic (if any);
• date of birth and/or age;
• gender; marital status;
• passport data and taxpayer registration number;
• email address; phone number; place of residence (delivery address);
• information necessary for communication between Users and the Online Store;
• data obtained from surveys aimed at improving the effectiveness of communication;
• information obtained through marketing activities or lawfully from partners and/or third parties;
• other information whose processing purpose coincides with the purpose of processing personal data and which is provided by the User or obtained by the Online Store in the course of its activities.

3.2.2.1. Additionally, the Online Store processes the following personal data of the “Clients” category:

• the list and status of orders from the profile on the Site;
• information (including photos) posted in the profile and in reviews/comments, requests to customer support, complaints, claims and other appeals;
• cookie files and data on the use of the Site;
• data for settlements; numbers of delivery branches;
• processing data (login as a phone number or email address and password in encrypted form);
• information posted or provided by the Client when participating in bonus programmes, quizzes, promotions and special offers organised by the Online Store.

3.2.2.2. Additionally, the Online Store processes the following personal data of the “Employees” category:

• data received from job candidates;
• taxpayer registration number or data on refusal to obtain it;
• data of an identity document, including copies of documents;
• place of registration, permanent residence or temporary stay;
• family composition and number of dependants and their data;
• profession, specialisation, qualification class, education, language proficiency;
• work experience and places of work; attitude to military duty;
• driving licences and driving experience; positions held;
• images (photo, video) and audio recordings made by the employer during the performance of work duties; the address of the workplace;
• the amount of basic and additional salary, bonuses and other income; a sample personal signature; bank account details.

3.2.2.3. Additionally, the Online Store processes the following personal data of the “Counterparties” category:

• data received from potential counterparties intending to conclude civil-law and economic agreements;
• taxpayer registration number or data on refusal to obtain it;
• place of registration, permanent residence or temporary stay; data of an identity document;
• a sample personal signature; data on registration of the entity as an individual entrepreneur;
• contact persons for communications under the transactions (full name, phone numbers, email); bank details.

3.2.2.4. Data automatically transmitted to the Online Store while using the Site by means of software installed on the device, including from cookies, and information about the User's device:

• the IP address of the User's computer;
• browser type and version;
• service pages, visit time and time spent on these pages;
• unique device identifiers and other diagnostic data, mobile device type, IP address, mobile operating system, mobile browser type;
• cookie files and other data of these files.

The information the Online Store collects includes data on the number of Users who visited the Site, the pages visited, and whether the User has visited the services before, which helps determine the services the User is most interested in and improve the User's experience. Cookie files and similar tracking technologies (beacons, tags, scripts) are used to track activity and store information. A cookie is a small amount of data that may include an anonymous unique identifier; it is sent to the browser from the website and stored on the User's device. The User may refuse all cookies in the browser settings; in this case, some parts (functions) of the services may be unavailable.

3.3.1. Depending on how Users interact with the Online Store, the scope, method, purpose and legal grounds for collecting and processing personal data may vary.

3.3.2. The Online Store collects and processes the following categories of Users' personal data:

• Clients (individuals and their representatives);
• Counterparties (entities in civil-law and economic-law relations – representatives of a legal entity, individual entrepreneurs, individuals without the status of a business entity and their representatives);
• Employees.

3.3.3. The Online Store processes the User's personal data (collection, receipt, recording, systematisation, accumulation, storage, clarification, extraction, use, transfer, blocking, deletion, destruction) both with and without the use of automation, for the following purposes:

• registration of the Client on the Site; identification and authentication of the User;
• ensuring the operation of the Site or its individual components;
• processing orders placed on the Site and transferring data to the relevant sellers, contractors, partners and delivery and payment services for proper order fulfilment;
• providing the User with access to personalised resources;
• establishing feedback, processing requests and applications;
• confirming the accuracy and completeness of the personal data provided;
• providing effective customer and technical support;
• monitoring the use of the services of the Online Store and its partners;
• sending advertising messages and personal offers, and providing additional options for using the service;
• improving the user experience, service quality and operation of the services, and developing new services;
• conducting marketing activities, research, consumer sentiment analysis and statistical studies;
• enabling the exchange of comments/impressions about purchases; conducting surveys;
• carrying out business activities and keeping accounting, financial, tax and management records;
• preparing statistical, administrative and other reporting information in accordance with legal requirements;
• ensuring communications with Counterparties and their representatives; conducting business correspondence and responding to requests from state authorities;
• implementing labour and administrative-legal relations, employment and internships, and human resource management;
• ensuring the rights and legitimate interests of the Online Store and interested parties and complying with the requirements of the legislation of Ukraine.

3.4.1. The processing of users' personal data is carried out in accordance with the Law of Ukraine “On Personal Data Protection”.

3.4.2. The confidentiality and security of all of the User's personal data is maintained.

3.4.3. The Online Store has the right to transfer the User's personal data and/or entrust its processing to third parties in the following cases:

• fulfilment of legal obligations (including processing and fulfilling the Client's order);
• prevention or investigation of possible offences;
• ensuring the ability to protect the rights and legitimate interests of the Online Store and its partners;
• providing information to law enforcement and other competent state authorities at their request in accordance with the legislation of Ukraine;
• protecting the personal safety of Users or third parties.

3.4.4. The Online Store may transfer Users' personal data to the following third parties (including but not limited to):

• processors (enterprises, institutions and organisations of all forms of ownership, state or local self-government bodies, individual entrepreneurs authorised to process personal data);
• third parties involved in providing money transfer services, banks and non-bank financial institutions;
• third parties involved in fulfilling orders (carriers, contractors, business entities issuing orders, owners of the goods/services or those organising their delivery and payment);
• archival institutions and other persons providing information and document storage services;
• participants and affiliated persons of the Online Store and persons exercising control over it;
• other private persons and organisations to perform their functions or provide services to the Online Store under concluded transactions, for the purpose specified in clause 3.3.3 of this Policy.

3.5.1. The processing and protection of personal data is based on a risk-oriented approach to prevent, detect and eliminate threats of unauthorised access to personal data and/or its unlawful processing.

3.5.2. When processing personal data, the Online Store takes the necessary legal, organisational and technical measures to protect personal information from unlawful or accidental access, destruction, distortion, blocking, copying, provision, dissemination and other unlawful actions.

3.5.3. Personal data is processed on equipment located in restricted-access premises by designated employees of the Online Store and only in accordance with their professional or labour duties. Such persons are prohibited from disclosing this data even after the termination of their employment relations with the Online Store.

4.1. The Online Store informs data subjects of their rights under Article 8 of the Law of Ukraine “On Personal Data Protection”, including that the data subject has the right to:

• know the sources of collection and location of their personal data, the purpose of its processing and the location or place of residence of the owner or processor, except in cases established by law;
• receive information about the conditions for granting access to personal data, in particular about third parties to whom their data is transferred;
• access their personal data;
• receive, no later than thirty calendar days from the date of the request, an answer as to whether their personal data is processed and the content of such data;
• submit a reasoned demand to change or destroy their personal data if it is processed unlawfully or is inaccurate;
• protect their personal data against unlawful processing and accidental loss, destruction or damage, as well as against the provision of information that is inaccurate or that discredits their honour, dignity and business reputation;
• lodge complaints about the processing of their personal data and apply legal remedies in the event of a breach of the legislation;
• make reservations regarding the limitation of the right to process their personal data when giving consent; withdraw consent to processing;
• know the mechanism of automatic processing of their personal data and be protected from an automated decision that has legal consequences for them.

4.2. The data subject has the right to obtain any information about themselves from any entity involved in relations connected with personal data, without indicating the purpose of the request, except in cases established by law.

4.3. The data subject's access to data about themselves is free of charge. The data subject submits a request to the Online Store for access to their personal data.

4.4. The request is satisfied within thirty calendar days from the date of its receipt, unless otherwise provided by law. The requested information is provided to the data subject in writing.

4.5. A reference to this Policy in any documents (agreements) constitutes proper notice to the data subject of their rights.

5.1. The Online Store takes measures to ensure the protection of personal data at all stages of its processing.

5.2. The Online Store independently determines the list and composition of measures aimed at the security of personal data processing, taking into account the requirements of legislation on personal data protection and information security.

5.3. The protection of personal data includes measures aimed at preventing its accidental loss or destruction and unlawful processing, including the unlawful destruction of or access to personal data.

5.4. The Site may contain links to other sites that have other owners and administrators and are not related to the Online Store. The Online Store recommends reviewing the privacy policy of each site before proceeding and is not responsible for the content and privacy policy of third-party sites or services.

5.5. The User may obtain any clarifications regarding the processing of their personal data by contacting the Online Store at info@artmastermops.net.ua.

5.6. The User assumes responsibility for the possible negative consequences of their actions aimed at providing the Online Store with incomplete and/or inaccurate and/or outdated personal data and/or the personal data of third parties.

5.7. Any User requests to establish additional restrictions on the processing of personal data and/or to prohibit its processing and/or to destroy it may result in the Online Store being unable to fulfil its obligations when providing services under the terms of the public agreement. In this case, the Online Store is not liable for the non-performance or improper performance of its obligations.

5.8. This document reflects any changes to the personal data processing policy. The Policy is valid indefinitely until replaced by a new version.

5.9. The Policy is published on the official website of the Online Store (artmastermops.net.ua) to inform data subjects whose data is processed by the Online Store in the course of its statutory activities.

5.10. In all cases not regulated by this Policy, the current legislation of Ukraine shall apply.