Catelier Privacy Policy
Revision date: 30 October 2026.
This Policy explains how the Catelier online shelf store processes personal data on its website when orders are placed and enquiries are submitted. The store sells and delivers goods within Ukraine.
1. Personal data controller
The personal data controller is individual entrepreneur Предводителева Ніколь (Nikol Predvodyteleva), taxpayer registration number (РНОКПП) 3506103807.
Registered address: Ukraine, 61153, Kharkiv region, Kharkiv, Yuvileinyi Avenue, building 32 A, apartment 127.
For personal data enquiries: info@catelier.com.ua.
2. Data we receive
When an order is placed, we receive:
- the recipient's surname, first name and telephone number;
- patronymic and email address, if provided;
- the city and branch of the selected carrier;
- details of the ordered goods, payment method, order fulfilment status and the buyer's comment.
When an enquiry is submitted through the contact form, we receive the name, email, telephone number if provided, and message content. Correspondence may contain additional information needed to resolve the enquiry.
When the website is visited, the server automatically receives and stores IP addresses and access logs. This technical data is processed to operate and secure the website and to identify technical errors and misuse.
The website does not provide customer accounts. Do not include passport details, payment card details or other information that is not needed for an order or enquiry in comments or messages.
3. Purposes and legal grounds for processing
We use data to accept and fulfil orders, contact buyers, arrange delivery and cash on delivery, confirm payment, and handle enquiries, returns and product quality claims.
IP addresses and access logs are used to maintain the website's operation and security on the basis of the store's legitimate interest, provided that the visitor's rights and freedoms do not override that interest.
The legal grounds are entering into and performing a contract, taking steps at the buyer's request before entering into it, meeting statutory obligations, including record keeping, and, where necessary, protecting legitimate interests while respecting human rights. Where particular processing requires consent, we obtain it separately.
Reading this Policy does not in itself constitute consent to any processing. As of this revision date, the store does not send advertising mailings.
Fields marked with an asterisk are required for an order or enquiry. Without the necessary contact and delivery details, it may be impossible to fulfil an order.
If you specify another recipient, inform them of the transfer of their data to the store and of this Policy, and ensure that you have lawful grounds to provide their data.
The store also ensures that recipients are informed about the processing of their data: at the first contact, it provides a link to this Policy or an appropriate notice.
Where a buyer provides data about another person, that person is informed no later than thirty working days after the data is received, except where the law provides otherwise. Asking the buyer to inform the recipient does not remove this obligation from the store.
Recipients may contact info@catelier.com.ua directly about their personal data.
4. Storage and recipients of data
Order data is stored in the store's information system on hosting in Ukraine. The hosting provider may process it as part of the technical operation and data storage of the website. Information about the provider's name and conditions of access to data is available on request at info@catelier.com.ua.
Information required for delivery is shared with the carrier chosen by the buyer: Nova Poshta or Ukrposhta. Data needed to arrange cash on delivery through NovaPay is shared with NovaPay LLC (ТОВ «НоваПей»). Banks and payment institutions also process payment information when funds are transferred.
As of this revision date, online card payment directly on the website is not connected.
The amount of data shared with a recipient is limited to the relevant purpose. Carriers and financial institutions also process data under their own rules and statutory obligations. Data may be provided to authorised public authorities where required by law.
We do not sell buyers' personal data. Information about possible transfers to foreign entities is available on request. Such transfers are permitted only where the legal grounds and data protection conditions required by legislation are met.
5. Retention periods
Personal data is kept no longer than necessary to fulfil orders, resolve related enquiries, meet statutory obligations and reasonably protect rights.
Documents and information required for tax and other mandatory records are retained for the periods established by Ukrainian legislation, including its rules for calculating and extending those periods.
Where data is needed for an unresolved dispute or another lawful procedure, it may be kept until that procedure is completed and the relevant mandatory periods have expired.
IP addresses and access logs are retained for the period needed for the technical operation, diagnosis and protection of the website. Where individual records are needed to investigate an incident or protect rights, they may be kept until the relevant procedure is completed and statutory requirements are met.
To request deletion of your personal data, email info@catelier.com.ua. After verifying the applicant's identity and considering the request, we delete data for which there is no lawful retention ground. If certain information must be retained by law, we explain which data remains and why.
Data is also deleted or anonymised in other circumstances provided for by legislation.
6. Cookies
The website may use technical cookies to maintain sessions, operate the basket and save settings. Cookies are small files stored by the browser on the user's device.
Under the store's settings as of this revision date, analytics and advertising tools are not connected. You can manage cookies in your browser, including deleting or blocking them. Restricting technical cookies may affect some website functions.
7. Data protection
Personal data protection is organised on the principle of restricted access. Access is granted only to the controller and persons who need it to lawfully perform the relevant functions, and only to the extent necessary.
The following rules apply when working with data:
- credentials for the store's systems are confidential;
- access must not be given to unauthorised persons;
- personal data is used only for the specified purposes and is not disclosed without a lawful ground.
The controller provides organisational and technical measures against unlawful access, alteration, loss and destruction of data.
Before personal data is provided in response to a request, the applicant's identity and, where necessary, the authority of their representative are verified.
If a security incident becomes known, the controller takes measures to stop the breach, establish the circumstances and reduce its consequences, and meets any statutory notification obligations.
8. Your rights and enquiries
You have the right:
- to know the sources, purposes and conditions of processing, the storage location and recipients of data;
- to access your data;
- to request correction of inaccurate data or deletion of unlawfully processed data;
- to submit reasoned objections;
- to withdraw consent where processing is based on it;
- to contact the Ukrainian Parliament Commissioner for Human Rights or a court;
- and to exercise other rights provided by law.
Send enquiries to info@catelier.com.ua with the subject “Personal data”. State your request and provide information that will help locate your order or previous enquiry. This address also accepts requests for access, correction and deletion, objections and withdrawal of consent.
Access to your own personal data is free of charge. A formal access request must contain the information required by Article 16 of the Law of Ukraine “On Personal Data Protection”:
- full name,
- place of residence or stay,
- details of the applicant's identity document,
- information identifying the person whose data is requested,
- information about the controller or relevant database,
- the list of requested data,
- and the purpose or legal grounds for the request.
When exercising your own right of access, you may state that purpose. A representative must provide evidence of their authority.
Providing document details does not mean that you must send a full copy. Do not send copies of documents without prior agreement on their necessity and method of transfer. Additional information is requested only to the extent needed to verify identity or authority or consider the request.
An access request is reviewed within no more than ten working days of receipt. Within that period, we inform you whether it will be granted or provide the legal grounds for refusing to provide data. The request is fulfilled within thirty calendar days of receipt unless otherwise provided by law.
Access to one's own data may not be deferred.
Other enquiries are considered within the statutory periods applicable to the relevant request. Inaccurate data is corrected without delay once its inaccuracy has been established. If there are no grounds to grant a request, we provide a reasoned response.
You may request deletion of your data or withdraw consent at the email address above. If other lawful grounds for processing remain for certain data, including mandatory document retention, we explain what information we continue to retain and on what basis.
Withdrawal of consent does not affect the lawfulness of earlier processing or stop processing on another lawful ground.
9. Policy updates
We update this Policy when data processing or statutory requirements change. The current version is published on the website with its date. If new processing requires separate consent or another notice, publication of an updated Policy alone is insufficient.