Personal Data Protection and Processing Policy

This is an English translation. In case of any discrepancy, the Ukrainian version prevails.

General Provisions

1.1. This Personal Data Protection and Processing Policy has been drawn up in accordance with the Law of Ukraine “On Personal Data Protection” and sets out the procedure for processing personal data and the measures for ensuring the security of personal data in the online store https://wild-cherry.shop/ (hereinafter the “Policy”).

1.2. The online store https://wild-cherry.shop/ (hereinafter the “Online Store”) sets as the most important goal and condition of its activities the observance of human and civil rights and freedoms in the processing of personal data, including the protection of the rights to privacy and to personal and family secrets.

1.3. The Policy sets out the Online Store’s requirements for processing personal data and the procedure for ensuring the protection of personal data of data subjects at all stages of processing, including through organisational and technical measures.

1.4. The Policy applies to an unlimited number of persons, namely data subjects who enter or may enter into any relationship with the Online Store.

Terms and Abbreviations

2.1. Personal Data Controller means the Online Store.

The Personal Data Controller determines the purpose of processing personal data, establishes the composition of such data and the procedures for processing them, unless otherwise provided by law.

2.2. Consent of the data subject means a voluntary expression of will by a natural person, provided that they are informed, to permit the processing of their personal data in accordance with the stated purpose of processing, expressed in writing or in a form that allows a conclusion that consent has been given. In the field of e-commerce, the data subject’s consent may be given during registration in the information and communication system of an e-commerce entity by ticking a box granting permission to process their personal data in accordance with the stated purpose, provided that such a system does not allow personal data to be processed before the box is ticked. In addition, consent to the processing of personal data may be given by:

the Client accepting the Public Offer Agreement for the sale of goods and provision of services by the Online Store, by registering on the Website or by confirming an order on the Website, including, but not limited to, by clicking the “Place order” or “Pay for order” button;
the Counterparty concluding a relevant transaction with the Online Store;
the User taking part in a relevant survey conducted by the Online Store or its partners;
the Employee signing a consent to the processing of personal data, such as a job application;
the User providing documents or information containing personal data when intending to conclude a relevant transaction or employment contract with the Online Store.

2.3. Personal data (hereinafter “PD”) means information or a set of information about a natural person who is identified or can be specifically identified.

2.4. Client means a data subject, that is, a natural person or a representative of such person, who is a consumer of goods or services provided by the Online Store and whose personal data are processed by the Online Store, as well as any visitor who has registered on the Online Store website https://wild-cherry.shop/ or has given the Consent of the data subject.

2.5. Counterparty means a data subject, that is, a natural person, individual entrepreneur, representative of a legal entity, or natural person without business entity status, acting in civil-law and commercial relations with the Online Store.

2.6. Users means Clients, Counterparties and Employees when referred to collectively in the text of the Policy.

2.7. Processing of personal data means any action or set of actions, such as collection, registration, accumulation, storage, adaptation, alteration, updating, use and dissemination (distribution, sale, transfer), depersonalisation and destruction of personal data, including with the use of information (automated) systems.

2.8. Employee means a natural person who directly performs a labour function by their own work under an employment contract concluded with the Online Store, or who intends to enter into employment relations by providing their personal data for the purpose of employment in response to the Online Store’s information about available vacancies.

2.9. Personal Data Processor means a natural or legal person granted the right to process such data on behalf of the controller by the personal data controller or by law.

2.10. Website means the website https://wild-cherry.shop/ located on the Internet.

2.11. Data subject means a natural person whose personal data are processed.

2.12 Third party means any person, other than the data subject, the personal data controller or processor and the Ukrainian Parliament Commissioner for Human Rights (hereinafter the “Commissioner”), to whom the Online Store or a personal data processor transfers personal data.

Main Part

3.1. Processing of personal data in the Online Store.

3.1.1 The Online Store is the controller of personal data and, in cases provided for by the current legislation of Ukraine and/or on the basis of concluded agreements, the Online Store is a processor of personal data.

3.1.2 The procedure for processing personal data in the Online Store is determined by this Policy on the basis of the current legislation of Ukraine.

3.1.3 The Online Store processes personal data, meaning any action or set of actions performed with personal data, including collection, systematisation, storage, alteration, use, depersonalisation, blocking, dissemination, provision and deletion of personal data.

3.1.4 The Online Store will take all necessary measures to ensure that Users’ personal data are processed securely and in accordance with this Policy and are not transferred to a third party until that party ensures adequate controls for the protection of personal data.

3.1.5 The primary sources of information about a natural person are documents issued in their name, documents signed by them, and information that the person provides about themselves.

3.1.6 Personal data processing is part of the Online Store’s business processes. Personal data processing may be automated or non-automated.

3.1.7 The Online Store may entrust the processing of personal data to a personal data processor under a written agreement. The personal data processor may process personal data only for the purpose and to the extent specified in the agreement.

3.1.8 The Online Store does not process personal data on racial or ethnic origin, political, religious or philosophical beliefs, membership in political parties and trade unions, criminal convictions, or data concerning sex life, biometric or genetic data.

3.1.9 Users’ data are collected and processed exclusively in the territory of Ukraine and in accordance with the current legislation of Ukraine.

3.1.10 The period of personal data processing is set by the Online Store depending on the category of data subjects and the purpose of processing, and is determined by the current legislation of Ukraine.

3.1.11 The grounds for processing personal data are:

the data subject’s consent to the processing of their personal data;
permission to process personal data granted to the personal data controller in accordance with the law solely for the exercise of its powers;
the conclusion and performance of a transaction to which the data subject is a party, or which is concluded in favour of the data subject, or for taking steps prior to concluding a transaction at the request of the data subject;
protection of the vital interests of the data subject;
the need to fulfil an obligation of the personal data controller provided for by law;
the need to protect the legitimate interests of the personal data controller or a third party to whom personal data are transferred, except where the need to protect the fundamental rights and freedoms of the data subject in connection with the processing of their data overrides such interests.

3.1.12 The Online Store notifies the data subject of the transfer of personal data to a third party within ten working days, except in the following cases:

transfer of personal data upon requests made in the course of operational and investigative or counterintelligence activities or combating terrorism;
exercise by state authorities and local self-government bodies of their powers provided for by law;
processing of personal data for historical, statistical or scientific purposes;
applying to a court for the protection of their rights;
where the possibility of transferring personal data to third parties is provided for by the terms of a transaction concluded between the Online Store and the data subject;
transfer of personal data in other cases specified in clause 3.4 of this Policy.

3.1.13 Personal data being processed shall be destroyed or depersonalised once the purposes of processing have been achieved or when those purposes are no longer necessary, unless otherwise provided by the legislation in force in Ukraine.

3.2 Users’ personal data received and processed by the Online Store.

3.2.1 To carry out its activities and fulfil its obligations, the Online Store processes the personal data of the data subject provided by them when registering on the Online Store website or provided in another way.

3.2.2 Users’ personal data may include, without limitation:

surname, first name and patronymic, if any;
date of birth and/or age;
gender;
marital status;
passport details and taxpayer registration number;
e-mail address;
phone number;
residential or delivery address;
date of birth;
information necessary for communication between Users and the Online Store;
data obtained as a result of various surveys conducted by the Online Store and/or third parties authorised by it, in order to improve the effectiveness of the Online Store’s communication with Users;
information obtained by the Online Store as a result of marketing activities;
information lawfully obtained by the Online Store from partners and/or third parties;
other information whose processing purpose coincides with the purpose of processing personal data and which is provided by the User or obtained by the Online Store in the course of its activities.

3.2.2.1 In addition to clause 3.2.2 of the Policy, the Online Store processes the following Personal data of the “Clients” category:

list and status of orders from the profile on the Website;
information, including photos, posted in the profile and in reviews or comments on the Website, requests to customer support, complaints, claims and other requests;
cookies and data on the use of the Website;
payment data;
delivery branch numbers;
processing data, namely a login in the form of a phone number or e-mail address and an encrypted password;
information posted or provided by the Client while taking part in bonus programmes, quizzes, promotions and special offers held on the Website and organised by the Online Store.

3.2.2.2 In addition to clause 3.2.2 of the Policy, the Online Store processes the following Personal data of the “Employees” category:

data received by the Online Store from job candidates;
taxpayer registration number or information on refusal to obtain such a number;
details of an identity document, including copies of documents in paper and/or electronic form;
place of registration, place of permanent residence or temporary stay;
family composition and number of dependants, their surnames, first names and patronymics, gender, age, place of registration and residence, and contact details;
profession, specialisation and qualification grade;
length of service and places of work;
military service status;
education, including academic titles and advanced training courses, and language skills;
driving licence and driving experience;
positions held;
images, such as photos and videos, and audio recordings made by the employer in the course of work duties;
workplace address;
amount of basic and additional salary, bonuses, incentives and other income;
specimen signature;
bank account details.

3.2.2.3 In addition to clause 3.2.2 of the Policy, the Online Store processes the following Personal data of the “Counterparties” category:

data received by the Online Store from potential counterparties intending to conclude civil-law and commercial contracts with the Online Store;
taxpayer registration number or information on refusal to obtain such a number;
place of registration, place of permanent residence or temporary stay;
details of an identity document, including copies of documents in paper and/or electronic form;
specimen signature;
information on the registration of the person as an individual entrepreneur;
contact persons for communication in the course of performing concluded transactions, including their surnames, first names and patronymics, phone numbers and e-mail addresses;
bank details.

3.2.2.4 Data automatically transmitted to the Online Store while using it through software installed on the device, including information from cookies and information about the User’s device:

the Internet Protocol address of the User’s computer, such as the IP address;
browser type and version;
service pages visited, time of the User’s visit and time spent on those pages;
unique device identifiers and other diagnostic data, mobile device type, mobile device IP address, mobile operating system and mobile browser type;
cookies and other data from these files.

The information collected by the Online Store includes, for example, data on the number of Users who visited the Website, the pages visited, and whether the User has previously visited the Online Store’s services, and helps the Online Store determine the services in which the User is most interested. These data also enable the Online Store to improve and expand the User experience. The Online Store uses cookies and similar tracking technologies to track activity and store information. Cookies are small amounts of data that may include an anonymous unique identifier. Cookies are sent to the browser from a website and stored on the User’s device. Other tracking technologies used include beacons, tags and scripts for collecting and tracking information and for improving services. The User may refuse all cookies by changing browser settings. By refusing cookies, the User agrees that some parts or functions of the services may be unavailable to them.

3.3 Purpose and legal grounds for collecting and processing Personal data

3.3.1 Depending on how Users interact with the Online Store, the scope, method, purpose and legal grounds for the collection and processing of Personal data by the Online Store may vary.

3.3.2 The Online Store collects and processes the following categories of Users’ Personal data:

Clients, meaning natural persons and their representatives;
Counterparties, meaning persons in civil-law and commercial relations with the Online Store: representatives of legal entities, individual entrepreneurs, natural persons without business entity status, and their representatives;
Employees.

3.3.3 The Online Store processes the User’s personal data, including collection, receipt, recording, systematisation, accumulation, storage, clarification (updating, alteration), extraction, use, transfer (provision, access), blocking, deletion and destruction, both with and without the use of automation, as well as by mixed processing, for the following purposes:

registration of the Client on the Website;
identification of the User when registering for services or authentication of a registered User;
ensuring the operation of the Website or its individual components;
processing orders placed by the Client on the Website and transferring data to the relevant sellers, contractors, partners, companies and services that carry out delivery, ensure payment and so on, including foreign parties to relations related to personal data, for proper fulfilment of the order;
providing the User with access to personalised resources;
establishing feedback with the User, including sending notifications and requests regarding the use of services, and processing requests and applications from the User;
confirming the accuracy and completeness of personal data provided by the User;
providing the User with effective customer and technical support;
monitoring the use of the services of the Online Store and its partners;
sending advertising messages to the User, providing the User with personal offers and additional opportunities to use the service;
improving the user experience, quality of service, operation and convenience of services, and developing new services;
carrying out marketing activities, research and campaigns, and analysis of consumer sentiment;
analysing user data and conducting statistical and other research on the User’s interaction with the Online Store and third parties;
enabling the exchange of comments and impressions of purchases made;
conducting surveys related to the activities of the Online Store and its partners;
carrying out the business activities of the Online Store;
preparing statistical, administrative and other reporting information on the Online Store’s activities in accordance with the law and the Online Store’s internal documents;
ensuring communication with Counterparties and their representatives;
keeping accounting, financial, tax and management records;
conducting business correspondence, including responding to requests from state authorities;
implementing employment relations, recruitment and internships;
implementing administrative and legal relations;
implementing relations in the field of human resources management, in particular personnel potential;
ensuring the rights and legitimate interests of the Online Store and interested persons;
compliance with the legislation of Ukraine;
implementing other relations that require the processing of personal data and are aimed at generating income and implementing the provisions of the legislation of Ukraine, the Charter of the Online Store and its internal regulations and policies.

3.4 Conditions for processing Users’ personal data and transferring them to third parties

3.4.1 Users’ personal data are processed in accordance with the Law of Ukraine “On Personal Data Protection”.

3.4.2 Confidentiality and security are maintained for all of the User’s personal data.

3.4.3 The Online Store may transfer the User’s personal data and/or entrust their processing to third parties in the following cases:

fulfilment of legal obligations, including processing and fulfilment of the Client’s Order;
prevention or investigation of possible offences;
to ensure the protection of the rights and legitimate interests of the Online Store and its partners;
providing information to law enforcement and other competent state authorities upon their request in accordance with the current legislation of Ukraine;
protecting the personal safety of Users or third parties.

3.4.4 The Online Store may transfer Users’ personal data to the following third parties, including, but not limited to:

processors, namely enterprises, institutions and organisations of all forms of ownership, state authorities or local self-government bodies, and individual entrepreneurs who have been or will be granted the right to process personal data by the Online Store or by law;
third parties engaged by the Online Store and/or involved in the provision of money transfer services by the Online Store, banks and non-bank financial institutions;
third parties engaged by the Online Store to fulfil orders placed on the Website, such as carriers, contractors, businesses that hand over orders, or businesses that own the goods or services ordered on the Website and/or arrange delivery and payment for such orders;
archival institutions and other persons providing the Online Store with information and document storage services and related services;
members and affiliates of the Online Store, and persons holding a significant interest in the Online Store and/or exercising control over it;
other private persons and organisations to enable them to perform their functions or provide services to the Online Store under transactions concluded between such persons or organisations and the Online Store, who may process and use personal data for the purpose specified in clause 3.3.3 of this Policy.

3.5 Measures applied to protect the User’s personal data

3.5.1 The processing and protection of personal data in the Online Store are based on a risk-based approach to preventing, detecting and eliminating threats of unauthorised access to personal data and/or their unlawful processing.

3.5.2 When processing personal data, the Online Store takes the necessary legal, organisational and technical measures to protect personal information against unlawful or accidental access, destruction, distortion, blocking, copying, provision or dissemination, as well as against other unlawful actions with respect to the User’s personal information, in line with the Online Store’s personal data processing and the requirements of personal data legislation.

3.5.3 Users’ personal data are processed on equipment located in premises with restricted access by designated employees of the Online Store and only in accordance with their professional or employment duties. Such persons are prohibited from disclosing these data even after termination of their employment with the Online Store.

Notice of the Rights of the Data Subject

4.1 The Online Store informs data subjects of their rights as data subjects set out in Article 8 of the Law of Ukraine “On Personal Data Protection”, including that the data subject has the right:

to know the sources of collection and the location of their personal data, the purpose of processing, and the location or place of residence of the personal data controller or processor, or to instruct authorised persons to obtain this information, except in cases established by law;
to receive information on the conditions for granting access to personal data, in particular information about third parties to whom their personal data are transferred;
to access their personal data;
to receive, no later than thirty calendar days from the date of the request, except in cases provided for by law, a response as to whether their personal data are processed, as well as the content of such personal data;
to submit a reasoned demand to any personal data controller or processor to change or destroy their personal data if such data are processed unlawfully or are inaccurate;
to the protection of their personal data against unlawful processing and accidental loss, destruction or damage due to intentional concealment, failure to provide or late provision, as well as protection against the provision of information that is inaccurate or discredits the honour, dignity and business reputation of a natural person;
to file complaints about the processing of their personal data in accordance with the procedure established by current legislation;
to use legal remedies in the event of a breach of personal data protection legislation;
to make reservations restricting the right to process their personal data when giving consent;
to withdraw consent to the processing of personal data;
to know the mechanism of automated processing of their personal data;
to protection against an automated decision that has legal consequences for them.

4.2 The data subject has the right to obtain any information about themselves from any party to relations related to personal data without stating the purpose of the request, except in cases established by law.

4.3 The data subject’s access to data about themselves is free of charge. The data subject submits a request for access to their personal data to the Online Store.

4.4 The request is fulfilled within thirty calendar days of its receipt, unless otherwise provided by law. The requested information is provided to the data subject in writing by letter.

4.5 A reference to this Policy in any documents or agreements constitutes proper notice to the data subject of their rights.

Final Provisions

5.1 The Online Store takes measures to ensure the protection of personal data at all stages of processing.

5.2 The Online Store independently determines the list and composition of measures aimed at the security of personal data processing, taking into account the requirements of legislation on personal data protection and information security.

5.3 Personal data protection includes measures aimed at preventing accidental loss or destruction and unlawful processing, including unlawful destruction of or access to personal data.

5.4 The Website may contain links to other websites that have other owners and administrators and are not affiliated with the Online Store. If the User follows such a link, they will be redirected to a third-party website. The Online Store strongly recommends that Users read the privacy policy of each website before visiting it. The Online Store does not control and assumes no responsibility for the content or privacy policies of any third-party websites or services.

5.5 The User may obtain any clarification on matters related to the processing of their personal data by contacting the Online Store by e-mail at wild-cherry@ukr.net

5.6 The User assumes responsibility for any possible negative consequences of their actions aimed at providing the Online Store with incomplete, inaccurate or outdated personal data and/or personal data of third parties.

5.7 Any User demands related to establishing additional restrictions on the processing of Personal data and/or prohibiting their processing and/or destroying personal data may make it impossible for the Online Store to fulfil its obligations to the User when providing services under the public agreement. In this case, the Online Store is not liable for non-performance or improper performance of its obligations.

5.8 Any changes to the Online Store’s personal data processing policy will be reflected in this document. The Policy is valid indefinitely until replaced by a new version.

5.9 The Policy is published on the official website of the Online Store, https://wild-cherry.shop/, so that data subjects whose data are processed by the Online Store in the course of its statutory activities can read it.

5.10 In all cases not regulated by this Policy, the current legislation of Ukraine shall apply.