Privacy Policy of the Ornament Online Store

Version dated 12 July 2026

At Ornament, we respect your privacy. This document explains in plain language what personal data we collect, why, who we share it with, how long we keep it, and what rights you have. This Policy is drafted in accordance with the Law of Ukraine "On Personal Data Protection" and the EU General Data Protection Regulation (GDPR), which applies when we serve customers from the European Union.

You can browse our website without providing any personal data. We only need your data when you place an order, create an account, leave a review, request a callback, or subscribe to our newsletter.

---

1. Who is responsible for your data (owner / controller)

Individual Entrepreneur (FOP) Alla Yuriivna Vasylenko Taxpayer ID (RNOKPP): 3310012808 Address: 26-B Chervonoi Kalyny Avenue, apt. 75, Kyiv, 02221, Ukraine E-mail for personal data matters: brandpolicy@ornament.in.ua Phone: +38 095 908 00 00

For any questions related to your personal data, please write to this e-mail address - we respond within 30 days, usually sooner.

2. What data we collect and where it comes from

We receive data directly from you when you:

• place an order through the website cart;

• place an order by phone, by e-mail, or via messengers (Instagram / Facebook Direct, Viber, Telegram, WhatsApp);

• create an account (registration is optional - you can order without one);

• leave a product review;

• request a callback;

• subscribe to our e-mail newsletter.

Categories of data we process:

• first name, last name, patronymic;

• phone number and e-mail;

• delivery address or post office branch number;

• date of birth - optional, only if you want to receive birthday greetings and discounts;

• Instagram or messenger nickname - if you contact us through these channels;

• your order history and cart contents;

• custom order details: measurements, product preferences, engraving text;

• the content of your review and the name under which you publish it;

• in case of a refund - transfer details (card number or IBAN); if you paid by card online, the money is refunded to the same card via the payment provider and no additional data is needed;

• technical data about your visits to the website (cookies, IP address, device type) - see our separate Cookie Policy for details.

What we do not collect. We do not store your bank card data - payments are processed by payment providers (section 4). We do not collect sensitive (special) categories of data and do not knowingly collect data of persons under 18.

If you provide another person's data - for example, a name for engraving or a gift recipient's address - you confirm that you are entitled to share this data with us. We use it solely to fulfil your order.

3. Why we process data and on what legal basis

Purpose	Data	Legal basis
Placing, confirming, and fulfilling your order; communication about it	Full name, phone, e-mail, address, order contents, measurements, engraving text	Performance of a contract (sale)
Delivery of your order	Full name, phone, address / branch	Performance of a contract
Accepting payment	Full name, payment data (no card details)	Performance of a contract; legal obligation
Returns and refunds	Full name, return request, transfer details (card number / IBAN) - or refund to the same card via the payment provider without additional data	Performance of a contract; legal obligation (consumer protection)
Accounting and reporting	Primary order documents	Legal obligation (tax law)
Website account	Login, e-mail, order history	Performance of a contract; your consent
E-mail newsletters about new arrivals, promotions, loyalty programme	E-mail, name, purchase history, date of birth	Your separate consent - you may withdraw it at any time
Personalised discounts and bonuses in the loyalty programme	Purchase history	Your consent when joining the programme
Showing our ads to our customers on Meta and Google (remarketing audiences)	E-mail and/or phone in protected (hashed) form	Your consent
Publishing product reviews	Name, review text	Your consent (you publish the review yourself)
Callback	Phone number	Your request (consent)
Fraud prevention, dispute resolution	Order data and correspondence	Legitimate interest

We do not use your data for purposes other than those it was collected for, and we do not sell your data.

Personalisation of discounts in the loyalty programme is simple profiling based on purchase history. We do not make automated decisions about you that produce legal effects. You may object to such personalisation at any time by writing to us.

4. Who we share data with

We share data only with those who help us fulfil your order or run the store - and only to the extent necessary for their function:

Delivery and fulfilment:

• Nova Poshta LLC - delivery within Ukraine and internationally (full name, phone, address, order contents, shipment value);

• SkladUSA, FedEx, DHL - international delivery and fulfilment (full name, phone, address, order contents, shipment value);

• individual suppliers in Ukraine - when goods are shipped directly from the supplier (full name, phone, address, order contents, shipment value).

Payments:

• WayForPay, Hutko, Apple Pay, Google Pay - online payment processing;

• monobank, PrivatBank - payment in instalments;

• Nova Poshta - cash on delivery. Payment data (card number, etc.) is processed by the providers under the PCI DSS security standard and never reaches us.

Technical services:

• Shopify Inc. - the platform our store runs on and where the order database is stored;

• an e-mail marketing service - delivers our newsletters to subscribers;

• Google (Analytics, Ads) and Meta (Facebook/Instagram Pixel) - analytics and advertising, detailed in the Cookie Policy.

Contractors with access to data: accountant, marketing agency, website developers and support, sales managers. All of them access data only within the scope of their tasks and are bound by confidentiality obligations.

In addition, we may disclose data where required by law - upon a lawful request from a state authority or court.

5. International data transfers

Some of our service providers are located outside Ukraine: fulfilment partners in Poland (EU); Shopify, Google, Meta, FedEx - in the USA and other countries. When transferring data to such partners, we rely on recognised safeguards: Standard Contractual Clauses (SCC), certification under the EU-U.S. Data Privacy Framework (for US companies that hold it), or adequacy decisions. You may request more detailed information about the specific safeguard used for a specific partner.

6. How long we keep data

• Order data and primary documents (including return requests and refund transfer details) - 5 years from the fulfilment of the order (a tax law requirement).

• Account - for as long as you use it; you may delete it at any time by writing to us.

• Newsletter data - until you unsubscribe or withdraw consent.

• Reviews - while the product is listed on the website or until you ask us to delete the review.

• Phone number from the callback form - up to 6 months after the enquiry.

• Messenger correspondence - up to 3 years after the last enquiry, so that we can assist with warranty matters.

After the retention period expires, data is deleted or anonymised.

7. Your rights

You have the right to:

• know what data of yours we process and receive a copy of it;

• rectify inaccurate or outdated data;

• erase your data ("right to be forgotten") - except data we are legally required to keep (e.g., order documents for 5 years);

• restrict processing while your request is being reviewed;

• object to processing, including direct marketing and personalisation - we will stop marketing immediately;

• receive your data in a machine-readable format and transfer it to another service (portability);

• withdraw consent at any time - this does not affect the lawfulness of processing before withdrawal;

• lodge a complaint: in Ukraine - with the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua); if you are in the EU - with the data protection supervisory authority of your country.

To exercise any of these rights, write to brandpolicy@ornament.in.ua. We will respond within 30 days. The simplest actions are available without contacting us: you can change your data in the "My Details" section of your account, and unsubscribe from the newsletter via the link in any of our e-mails.

8. Newsletters and advertising

We send e-mail newsletters about new arrivals, promotions, and the loyalty programme only with your separate consent - placing an order does not in itself subscribe you to the newsletter. You can unsubscribe in one click via the link in any e-mail or by writing to brandpolicy@ornament.in.ua.

With your consent, we may also use your e-mail or phone number in protected (hashed) form to show you our ads on Facebook, Instagram, and Google. If you do not want this - let us know and we will exclude your contacts from advertising audiences.

9. How we protect data

We apply organisational and technical security measures: the connection to the website is encrypted (HTTPS), access to the order database is limited to those who need it for their work, payments are processed by certified providers, and your account is password-protected.

We recommend using a strong password and never sharing it. You can change your password in the "My Details" section.

If a data security breach occurs that creates a high risk to your rights, we will notify you and the competent authority in the manner and within the time limits provided by law.

10. Children

Our store is not intended for persons under 18, and we do not knowingly collect their personal data. If you believe a child has provided us with their data, write to us - we will delete it.

11. Cookies

We use cookies and similar technologies for website operation, analytics, and advertising. Detailed information - which cookies, why, and how to manage them - is provided in the separate Cookie Policy on our website. We enable analytics and marketing cookies only after your consent in the cookie banner.

12. Changes to this Policy

We may update this Policy - for example, when legislation changes (including after the adoption of the new version of the Law of Ukraine "On Personal Data Protection") or our processes change. The current version is always available on this page with the version date indicated. We will notify you of significant changes on the website or by e-mail.

13. Questions and contact

Please send suggestions or questions about this Policy to brandpolicy@ornament.in.ua or call +38 095 908 00 00.