Privacy policy

Draft — must be checked by a lawyer before launch. Two points in particular need professional confirmation: whether an EU representative under Article 27 GDPR must be appointed, and on what basis personal data may be transferred to Ukraine, which does not hold an EU adequacy decision. Both are marked in the text.

1. Who is responsible

The controller of your personal data is:

Фізична особа-підприємець Лореш Ольга Юріївна (individual entrepreneur Olha Yuriivna Loresh), проспект Лесі Українки, 71, кв. 41, м. Кременчук, Полтавська обл., 39600, Ukraine. Registration № 2 585 000 0000 028268 of 20 April 2018. Telephone +380 98 282 60 66. Email: olga.loresh@gmail.com.

[Article 27 GDPR requires a controller established outside the EU that offers goods to people in the EU to designate a representative inside the EU in writing, unless an exemption applies. Confirm with a lawyer whether one is needed here and, if so, publish the representative's name and address in this section.]

2. What we collect, and why

When you send an enquiry

The form asks for your name, email address, country or city, the subject of your enquiry and your message. We use them for one purpose: to answer you and, if it goes further, to agree the terms of a purchase.

• Legal basis: your consent, which you give by ticking the box on the form (Article 6(1)(a) GDPR), and — once we are discussing an actual order — the steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).
• Retention: enquiries that do not lead to a purchase are deleted within 24 months. Where a purchase follows, the correspondence is kept for as long as tax and accounting law requires.
• Consequence of not providing it: we cannot reply. Nothing else depends on it.

When you buy a set

To fulfil an order we process your name, delivery address, contact details, the language your set is printed in, and payment reference data.

• Legal basis: performance of a contract (Article 6(1)(b) GDPR) and compliance with legal obligations such as tax record-keeping (Article 6(1)(c) GDPR).
• Retention: for the statutory retention period applicable to commercial and tax records.

When you simply visit the site

The hosting provider records the usual server log data — IP address, date and time, the page requested, the referring page, browser and operating system — for the security and technical operation of the site.

• Legal basis: our legitimate interest in operating the site securely (Article 6(1)(f) GDPR).
• Retention: [confirm the log retention period with hostpro.ua and Cloudflare, then state it here].

3. Cookies and measurement

This site sets one cookie of its own: it records whether you accepted or declined optional measurement, so you are not asked again on every page. It contains no identifier and expires after six months. It is strictly necessary in the sense of the ePrivacy rules and cannot be switched off.

No analytics or advertising cookies are set unless you accept them in the banner. If you decline, nothing is loaded and no measurement takes place. You can change your mind at any time by clearing the site's cookies in your browser, which brings the banner back.

[Once Google Analytics 4 is added, name it here: the provider, what it measures, the retention period, that it is loaded only after consent, and how data reaches Google. If a different tool is chosen — one that measures without cookies, for example — this section is simpler and the banner may not be required at all.]

4. Who else sees your data

Your data is not sold, rented or passed to anyone for their own purposes. It is handled by:

• The hosting provider that runs this website and stores its files and server logs. [Name hostpro.ua and the location of its servers, and confirm a data processing agreement is in place.]
• Cloudflare, which sits in front of the site to serve it quickly and filter malicious traffic, and therefore processes connection data. [Confirm before launch and add the processing agreement reference.]
• The printing and fulfilment partner in Hamburg, which receives the delivery address and the language of the set in order to produce and post your order. [Name the partner and confirm a processor agreement is in place.]
• Google Fonts, which currently serves the two typefaces used on this site. Because the fonts are requested from Google's servers, your IP address reaches Google when a page loads. [Recommended: host the two font files on our own server. It removes this transfer entirely, is faster, and settles a point German courts have already ruled on.]

5. Transfers outside the EU

The controller is established in Ukraine, which the European Commission has not recognised as offering an adequate level of data protection. When you write to us, your message is read and answered from Ukraine.

[This transfer needs a stated legal basis: either appropriate safeguards under Article 46 GDPR, or a derogation under Article 49 — most plausibly Article 49(1)(b), transfer necessary for the performance of a contract concluded at the data subject's request, since enquiries are sent to us voluntarily. A lawyer should confirm which applies and this paragraph should then say so plainly.]

6. Your rights

Under the GDPR you may ask us to:

• confirm what data about you we hold, and give you a copy of it (Article 15);
• correct anything inaccurate (Article 16);
• delete it (Article 17), unless we are legally required to keep it;
• restrict how we use it (Article 18);
• hand it over in a portable format (Article 20);
• stop processing carried out on the basis of legitimate interest (Article 21).

Where processing is based on consent, you can withdraw it at any time. Withdrawal does not affect what was lawfully done before it. Write to the contact above and you will receive an answer within one month.

You also have the right to complain to a supervisory authority — in the EU, the data protection authority of the country where you live or work.

7. What we deliberately do not do

• No newsletter is sent unless you separately ask for one.
• No advertising or profiling cookies, and no automated decision-making.
• No sessions are recorded or photographed, and no participant is named in anything we publish. Stories from games are published only when the participant has given written permission, and details are changed.
• Nothing you write in an enquiry is used as marketing material.

8. Changes

If this policy changes, the new version appears on this page with a new date below.

Last updated: 29 July 2026