Privacy Policy

1. General provisions

This Privacy Policy (the «Policy») defines the procedure for collecting, processing, storing, using and protecting the personal data of users of the website www.hrustata.com (the «Website»).

The Policy has been drawn up in accordance with:

• the Constitution of Ukraine;
• the Law of Ukraine «On Personal Data Protection» of 01.06.2010 No. 2297-VI;
• the Law of Ukraine «On Electronic Commerce» of 03.09.2015 No. 675-VIII;
• the Law of Ukraine «On Consumer Rights Protection» of 12.05.1991 No. 1023-XII;
• the Law of Ukraine «On Electronic Communications» of 16.12.2020 No. 1089-IX;
• the Law of Ukraine «On Information» of 02.10.1992 No. 2657-XII;
• the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No. 108+);
• the EU General Data Protection Regulation (GDPR — Regulation (EU) 2016/679) — where data of EU residents is processed.

By using the Website and/or placing an order, the user confirms that they have read the Policy and give their freely given, specific, informed and unambiguous consent to the processing of personal data on the terms set out below.

2. Controller of personal data

The controller of personal data (the controller, in GDPR terminology) is:

For all matters relating to the processing of personal data, exercising data subject rights or withdrawing consent, please use the contacts above.

3. Terms and definitions

Terms in this Policy are used in the meaning given in Art. 2 of Law No. 2297-VI and Art. 4 of the GDPR:

• Personal data — any information relating to an identified or identifiable natural person (data subject);
• Processing — any operation or set of operations performed on personal data (collection, storage, use, transfer, erasure, etc.);
• Consent — a freely given indication of the natural person’s wishes permitting the processing of their personal data;
• Controller — the entity determining the purposes and means of processing personal data;
• Processor — the entity to which the controller entrusts data processing (hosting, delivery service, etc.);
• Cookies — small text files stored in the user’s browser for the correct operation of the website.

4. What personal data we process

Only the data necessary for the operation of the Website and the fulfilment of an order is processed:

• Identification data: full name or first/last name — for placing and handing over the shipment;
• Contact data: phone number, email — for order confirmation and communication;
• Delivery data: city, delivery service branch or address — for handing over the shipment;
• Order data: cart contents, quantity, amount, date, fulfilment status, payment method;
• Technical data: IP address, browser type and version, operating system, device type, screen resolution, referral URLs, session duration, cookies, event logs;
• Behavioural data: pages viewed by the user, clicks, scrolls, heatmaps (via Microsoft Clarity — see section 8).

5. Legal grounds for processing

Personal data is processed on the grounds provided for in Art. 11 of Law No. 2297-VI and Art. 6 of the GDPR:

• Consent of the data subject — for marketing communication, cookie analytics, heatmaps;
• Performance of a contract — for placing and delivering an order, processing payment, warranty service;
• Compliance with legal obligations — for accounting and tax records, responses to requests from state authorities;
• Legitimate interest of the controller — for information security, fraud prevention and technical stability of the Website.

6. Purposes of processing personal data

• placing, confirming, processing and fulfilling orders;
• arranging delivery and interacting with delivery services;
• making settlements and processing payments;
• communicating with the customer about order status, returns and warranties;
• handling enquiries, complaints and requests from users;
• keeping tax and accounting records;
• ensuring information security and preventing fraud;
• analysing the operation of the Website and improving the service (based on anonymised data);
• complying with the requirements of the legislation of Ukraine.

7. Cookies

The Website uses cookies for correct operation, security and analytics. Cookie categories:

• Strictly necessary (essential) — ensure the operation of the cart, session, authorisation and security (e.g. PHPSESSID, CSRF tokens). Without them the Website does not function. No consent required.
• Functional — remember the user’s settings (language, currency). Set after consent.
• Analytical — Microsoft Clarity (heatmaps, session recordings), anonymised visit statistics. Set after consent.
• Marketing — for retargeting and personalised advertising (where applicable). Set exclusively after consent.

8. Microsoft Clarity and web analytics

We use the Microsoft Clarity service to understand how users interact with the Website. Clarity collects behavioural metrics, builds heatmaps and session recordings for the purpose of improving products, services and advertising.

Data is collected via first-party and third-party cookies and other tracking technologies. The information is used to optimise the Website, for security, fraud prevention and advertising.

Cross-border transfer: data is transferred to Microsoft Corporation (USA). Microsoft ensures data protection in accordance with the Data Privacy Framework (EU-US DPF) and its own standards. Details — Microsoft Privacy Statement.

By continuing to use the Website, the user agrees that the owner of the Website and Microsoft may collect and use this data for the stated purposes.

9. Transfer of personal data to third parties

We do not sell customer databases and do not transfer personal data to third parties without a legal basis. Transfer is possible solely to the extent necessary to achieve the purposes of processing:

• Delivery services (Nova Poshta, Ukrposhta, Meest, Justin, etc.) — full name, phone, delivery address;
• Technical contractors (hosting provider, website administrator) — within the access necessary to maintain operation;
• Analytics services (Microsoft Clarity) — anonymised or pseudonymised data;
• State authorities — solely on the basis of an official request in accordance with the legislation of Ukraine.

10. Cross-border data transfer

Certain categories of technical data may be transferred outside Ukraine — to the USA (Microsoft Clarity) and to EU countries (hosting, CDN services).

The transfer is carried out on the basis of:

• the data subject’s consent (Art. 29 of Law No. 2297-VI);
• Standard Contractual Clauses (SCC) — for EU/US countries;
• Data Privacy Framework certifications — for recipients in the USA.

11. Personal data retention periods

Personal data is stored for the periods necessary to achieve the purposes of processing:

• Order data — 3 years from the last transaction (for warranty and returns);
• Accounting/tax source documents — 3 years under clause 44.3 of the Tax Code of Ukraine;
• Contact data for marketing — until consent is withdrawn;
• Cookies — from one session up to 13 months depending on the type;
• Security logs — up to 12 months.

After the periods expire, the data is deleted or anonymised.

12. Protection of personal data

The controller applies organisational and technical data protection measures in accordance with Art. 24 of Law No. 2297-VI and Art. 32 of the GDPR:

• SSL/TLS encryption of traffic between the user’s browser and the Website;
• restriction of access to data on a least-privilege basis;
• regular updates of the CMS, plugins and server software;
• data backups;
• logging of actions with personal data;
• protection against brute-force attacks, SQL injection and XSS;
• signing NDAs with technical contractors.

13. Rights of the personal data subject

In accordance with Art. 8 of Law No. 2297-VI and Art. 15–22 of the GDPR, the user has the right to:

• know the sources of collection, the location of their data and the purpose of processing;
• receive information about the conditions for granting access to their data;
• access their data;
• request rectification of inaccurate or outdated data;
• request erasure of data processed unlawfully or no longer needed (right to be forgotten);
• restrict processing in the cases provided for by law;
• object to processing (including direct marketing);
• data portability to another controller in a structured format;
• withdraw consent at any time (without affecting the lawfulness of prior processing);
• lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights or with a court.

14. Data of minors

The Website and its services are intended for persons who have reached 18 years of age. The controller does not knowingly collect or process personal data of persons under 18 without the consent of their parents or legal representatives.

If such data is found to have been collected, it will be deleted without delay. If you become aware of such a case, please notify us at k.maltsev@lnz.com.ua.

15. Automated decision-making and profiling

The Website does not take decisions producing legal effects for the user based solely on automated processing (including profiling), in accordance with Art. 22 of the GDPR.

Analytics tools (Microsoft Clarity) are used to improve the Website and do not affect pricing, refusal of service or other legally significant actions.

16. Technical support (IT)

For technical matters concerning the operation of the Website and the exercise of data subject rights:

• Phone / Messengers (Telegram, WhatsApp, Signal, Viber): +380 67 474 09 73
• Email: k.maltsev@lnz.com.ua

17. Supervisory authorities and complaints

If you believe your rights have been violated, you may contact the supervisory authorities:

• Ukrainian Parliament Commissioner for Human Rights — ombudsman.gov.ua;
• Court — at the place of registration of the controller or the place of residence of the data subject;
• Supervisory authorities of EU countries — for EU residents (under the GDPR).

Before contacting the supervisory authorities, we recommend contacting the controller directly first — most issues are resolved within 30 days.

18. Changes to the Policy

The controller reserves the right to amend this Policy. The current version is always published on the Website at www.hrustata.com.

The date of the latest revision is stated at the end of the document. Continued use of the Website after amendments means acceptance of the updated version.