This Policy explains how the ICON MANIA online store processes and protects buyers' personal data. The seller and owner of the personal data database is FOP Maryna Viktorivna Lappo, individual tax number (RNOKPP) 3223217163, address: 154 Pisochna St., Shevchenko 3 village (hereinafter the "seller"). For questions about personal data, write to info@icon-mania.com.
Regulation on the processing and protection of personal data in personal data databases owned by the seller
1. General terms and scope
1.1. Definitions:
personal data database — a named set of organized personal data in electronic form and/or in the form of personal data card files;
responsible person — a designated person who organizes the work related to the protection of personal data during their processing, in accordance with the law;
owner of a personal data database — an individual or legal entity granted, by law or with the consent of the personal data subject, the right to process such data, who approves the purpose of processing personal data in that database and establishes the composition of such data and the procedures for processing them, unless otherwise provided by law;
State Register of Personal Data Databases — the single state information system for collecting, accumulating and processing information about registered personal data databases;
publicly available sources of personal data — directories, address books, registers, lists, catalogues and other systematized collections of open information that contain personal data placed and published with the knowledge of the personal data subject. Social networks and online resources in which the personal data subject leaves their personal data are not considered publicly available sources of personal data (except where the personal data subject has expressly stated that the personal data are placed for free distribution and use);
consent of the personal data subject — any documented, voluntary expression of an individual's will granting permission to process their personal data in accordance with the stated purpose of processing;
depersonalization of personal data — removal of information that makes it possible to identify a person;
processing of personal data — any action or set of actions performed wholly or partly in an information (automated) system and/or in personal data card files that relate to the collection, registration, accumulation, storage, adaptation, modification, updating, use and dissemination (distribution, sale, transfer), depersonalization and destruction of information about an individual;
personal data — information or a set of information about an individual who is identified or can be specifically identified;
processor of a personal data database — an individual or legal entity granted by the owner of the personal data database or by law the right to process such data. A person instructed by the owner and/or processor of a personal data database to carry out technical work with the database without access to the content of the personal data is not a processor;
personal data subject — an individual whose personal data are processed in accordance with the law;
third party — any person, other than the personal data subject, the owner or processor of the personal data database and the authorized state body for personal data protection, to whom the owner or processor of the personal data database transfers personal data in accordance with the law;
special categories of data — personal data on racial or ethnic origin, political, religious or ideological beliefs, membership in political parties and trade unions, as well as data concerning health or sex life.
1.2. This Regulation is binding on the responsible person and on the seller's staff who directly process and/or have access to personal data in connection with their duties.
2. List of personal data databases
2.1. The seller owns the following personal data databases:
- personal data database of counterparties;
- personal data database of buyers of the ICON MANIA online store.
2.2. When an order is placed, an account is registered, or someone subscribes to the newsletter or to back-in-stock notifications, the seller receives: surname and first name, phone number, email address, city and branch or delivery address, order contents and amount, and the wishlist. When the website is visited, technical data are processed automatically: cookies, IP address, device and browser type, pages viewed and actions on the website (see clause 6.13). If you press "Near me" at checkout, your device's location is processed with your permission (see clause 6.14).
3. Purpose of personal data processing
3.1. The purpose of processing personal data in the system is to carry out civil law relations, provide and receive goods and services, and settle payments for purchased goods and services in accordance with the Tax Code of Ukraine and the Law of Ukraine "On Accounting and Financial Reporting in Ukraine".
3.2. The personal data of online store buyers are also processed in order to place, pay for and deliver orders, contact the buyer about an order, exchange or return, send back-in-stock notifications, save the wishlist, and, with separate consent, send store news and offers. You can unsubscribe from the newsletter at any time using the link in the email.
4. Procedure for processing personal data: obtaining consent, notification of rights and actions with the personal data subject's data
4.1. The consent of the personal data subject must be a voluntary expression of the individual's will granting permission to process their personal data in accordance with the stated purpose of processing.
4.2. The consent of the personal data subject may be given in the following forms:
- a paper document with details that make it possible to identify the document and the individual;
- an electronic document that must contain the mandatory details making it possible to identify the document and the individual. It is advisable to certify the individual's voluntary permission to process their personal data with the electronic signature of the personal data subject;
- a mark on an electronic page of a document or in an electronic file processed in an information system on the basis of documented software and hardware solutions.
4.3. The consent of the personal data subject is given when civil law relations are formalized in accordance with current legislation. By placing an order on the website, the buyer agrees to this Regulation.
4.4. The personal data subject is notified of the inclusion of their personal data in the personal data database, of the rights defined by the Law of Ukraine "On Personal Data Protection", of the purpose of data collection and of the persons to whom their personal data are transferred when civil law relations are formalized in accordance with current legislation.
4.5. Processing of personal data on racial or ethnic origin, political, religious or ideological beliefs, membership in political parties and trade unions, as well as data concerning health or sex life (special categories of data), is prohibited.
5. Location of the personal data database
5.1. The personal data databases listed in Section 2 of this Regulation are located at the seller's address. Online store buyers' data are also stored on the servers of the Shopify platform on which the website runs. When an order is placed, the buyer's data are temporarily stored (for up to 30 days) on the servers of Cloudflare, which powers the checkout page.
6. Conditions for disclosing personal data to third parties
6.1. The procedure for third-party access to personal data is determined by the terms of the consent given by the personal data subject to the owner of the personal data for the processing of such data, or in accordance with the requirements of the law.
6.2. Access to personal data is not granted to a third party if that party refuses to undertake to ensure compliance with the requirements of the Law of Ukraine "On Personal Data Protection" or is unable to ensure such compliance.
6.3. A party to relations involving personal data submits a request for access (hereinafter the "request") to personal data to the owner of the personal data.
6.4. The request shall state:
- the surname, first name and patronymic, place of residence (place of stay) and details of the identity document of the individual submitting the request (for an individual applicant);
- the name and location of the legal entity submitting the request, and the position, surname, first name and patronymic of the person certifying the request; confirmation that the content of the request falls within the powers of the legal entity (for a legal entity applicant);
- the surname, first name and patronymic, as well as other information making it possible to identify the individual to whom the request relates;
- information about the personal data database to which the request relates, or information about the owner or processor of that database;
- the list of personal data requested;
- the purpose and/or legal grounds for the request.
6.5. The request shall be reviewed within no more than ten working days from the date of its receipt. Within this period, the owner of the personal data database informs the person submitting the request that the request will be granted or that the relevant personal data cannot be provided, stating the grounds set out in the relevant regulation. The request is granted within thirty calendar days from the date of its receipt, unless otherwise provided by law.
6.6. Access to personal data by third parties may be deferred if the required data cannot be provided within thirty calendar days from the date the request is received. In this case, the total time for resolving the issues raised in the request may not exceed forty-five calendar days.
6.7. Notice of deferral is given in writing to the third party that submitted the request, with an explanation of the procedure for appealing such a decision.
6.8. The notice of deferral shall state:
- the surname, first name and patronymic of the official;
- the date the notice is sent;
- the reason for the deferral;
- the period within which the request will be granted.
6.9. Access to personal data may be refused if access to them is prohibited by law.
6.10. The notice of refusal shall state:
- the surname, first name and patronymic of the official refusing access;
- the date the notice is sent;
- the reason for the refusal.
6.11. A decision to defer or refuse access to personal data may be appealed in court.
6.12. To fulfill an order, the seller transfers the necessary data to: delivery services (Nova Poshta LLC, Ukrposhta JSC) — name, phone number and delivery address; the payment service — payment data; the Shopify platform, Cloudflare (the checkout page) and the wishlist and back-in-stock notification services installed on the website — to the extent needed for their operation. The seller does not sell buyers' personal data.
6.13. Analytics and advertising. The website uses services that automatically receive technical data about visits — cookies and similar identifiers, IP address, device and browser type, pages viewed and actions on the website, order contents and amount: Google Analytics and Google Tag Manager (Google) — visit and sales statistics; the Meta pixel and Conversions API (Meta Platforms) — measuring and setting up advertising on Facebook and Instagram; Microsoft Clarity (Microsoft) — statistics of on-page behaviour, including clicks, scrolling and session recordings. After an order is paid, Meta also receives the order number and amount, the buyer's IP address and browser type, and the buyer's contact details (phone, email, first name, surname, city) only as a SHA-256 hash, never in plain text, in order to match the purchase with advertising. These services process data under their own privacy policies and may store it on servers outside Ukraine.
6.14. Branch map. If you press "Near me" at checkout, your browser determines the device's location with your permission, and the coordinates are sent to OpenStreetMap (Nominatim) to identify the town or city. The seller does not store the coordinates. The branch map is loaded from OpenStreetMap servers, which receive the visitor's IP address.
6.15. You can delete or block cookies in your browser settings. The website will still work without them, but the cart, wishlist and language choice may not be saved between visits.
7. Protection of personal data: methods of protection, responsible person, staff who directly process and/or have access to personal data in connection with their duties, personal data retention period
7.1. The owner of the personal data database is equipped with system, software and hardware tools and communication tools that prevent loss, theft, unauthorized destruction, distortion, forgery and copying of information and that meet the requirements of international and national standards.
7.2. The responsible person organizes the work related to the protection of personal data during their processing in accordance with the law. The responsible person is appointed by order of the Owner of the personal data database. The responsible person's duties regarding the organization of personal data protection during processing are set out in their job description.
7.3. The responsible person shall:
- know the legislation of Ukraine in the field of personal data protection;
- develop procedures for staff access to personal data in accordance with their professional, official or employment duties;
- ensure that the staff of the Owner of the personal data database comply with the requirements of the legislation of Ukraine in the field of personal data protection and with the internal documents governing the activities of the Owner of the personal data database regarding the processing and protection of personal data in personal data databases;
- develop a procedure for internal control over compliance with the requirements of the legislation of Ukraine in the field of personal data protection and with the internal documents governing the activities of the Owner of the personal data database regarding the processing and protection of personal data in personal data databases, which, in particular, shall set the frequency of such control;
- inform the Owner of the personal data database of any violations by staff of the requirements of the legislation of Ukraine in the field of personal data protection and of the internal documents governing the activities of the Owner of the personal data database regarding the processing and protection of personal data in personal data databases no later than one working day after such violations are discovered;
- ensure the storage of documents confirming that the personal data subject has consented to the processing of their personal data and has been notified of their rights.
7.4. To perform their duties, the responsible person has the right to:
- obtain the necessary documents, including orders and other administrative documents issued by the Owner of the personal data database, related to the processing of personal data;
- make copies of the documents received, including copies of files and any records stored in local computer networks and stand-alone computer systems;
- take part in discussions of their duties related to organizing the protection of personal data during their processing;
- submit proposals for improving activities and working methods, and submit comments and options for eliminating shortcomings identified in the processing of personal data;
- receive explanations on matters relating to the processing of personal data;
- sign and endorse documents within their competence.
7.5. Staff who directly process and/or have access to personal data in connection with their official (employment) duties shall comply with the requirements of the legislation of Ukraine in the field of personal data protection and with the internal documents on the processing and protection of personal data in personal data databases.
7.6. Staff who have access to personal data, including those who process them, shall not allow the disclosure in any way of personal data entrusted to them or that became known to them in connection with the performance of their professional, official or employment duties. This obligation remains in force after they cease activities related to personal data, except in cases established by law.
7.7. Persons who have access to personal data, including those who process them, are liable under the legislation of Ukraine for violating the requirements of the Law of Ukraine "On Personal Data Protection".
7.8. Personal data shall not be stored longer than necessary for the purpose for which they are stored, and in any case no longer than the data retention period defined by the personal data subject's consent to the processing of such data.
8. Rights of the personal data subject
8.1. The personal data subject has the right to:
- know the location of the personal data database containing their personal data, its purpose and name, and the location and/or place of residence (stay) of its owner or processor, or instruct authorized persons to obtain this information, except in cases established by law;
- receive information on the conditions of access to personal data, in particular information about third parties to whom their personal data contained in the relevant personal data database are transferred;
- access their personal data contained in the relevant personal data database;
- receive, no later than thirty calendar days from the date the request is received, except in cases provided by law, a response as to whether their personal data are stored in the relevant personal data database, and receive the content of their stored personal data;
- submit a reasoned objection to the processing of their personal data by state authorities or local governments in the exercise of their powers provided by law;
- submit a reasoned demand to any owner or processor of the database to change or destroy their personal data if these data are processed unlawfully or are inaccurate;
- protect their personal data from unlawful processing and accidental loss, destruction or damage due to intentional concealment, failure to provide or late provision, and protection from the provision of information that is inaccurate or defames the honor, dignity and business reputation of the individual;
- apply to state authorities and local governments whose powers include the protection of personal data on matters of protecting their rights regarding personal data;
- use legal remedies in the event of a violation of personal data protection legislation.
9. Procedure for handling requests from the personal data subject
9.1. The personal data subject has the right to obtain any information about themselves from any party to relations involving personal data without stating the purpose of the request, except in cases established by law.
9.2. The personal data subject's access to data about themselves is free of charge.
9.3. The personal data subject submits a request for access (hereinafter the "request") to personal data to the owner of the personal data database, in particular to info@icon-mania.com. The request shall state:
- the surname, first name and patronymic, place of residence (place of stay) and details of the identity document of the personal data subject;
- other information making it possible to identify the personal data subject;
- information about the personal data database to which the request relates, or information about its owner or processor;
- the list of personal data requested.
9.4. The request shall be reviewed within no more than ten working days from the date of its receipt. Within this period, the owner of the personal data database informs the personal data subject that the request will be granted or that the relevant personal data cannot be provided, stating the grounds set out in the relevant regulation.
9.5. The request is granted within thirty calendar days from the date of its receipt, unless otherwise provided by law.
10. State registration of the personal data database
10.1. State registration of personal data databases is carried out in accordance with Article 9 of the Law of Ukraine "On Personal Data Protection".