Privacy Policy

1. Introduction

This website (povitrulya.com) is operated by POVITRULYA LTD, a company incorporated in England and Wales under company number 14095604, with its registered office address at:

63-66 Hatton Garden, Fifth Floor, Suite 23, London, England, EC1N 8LE
(hereinafter referred to as "Povitrulya", "we", "us", or "our").

We respect your privacy and are committed to safeguarding your personal information. This Privacy Policy outlines how we collect, handle, store, and protect your personal data when you access or purchase products from povitrulya.com (the "Service" or "Website"), and explains your statutory privacy rights under the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), the Data Protection Act 2018, and related data protection legislation.

By visiting our Website, completing a purchase, or engaging with our communications, you acknowledge the practices described in this Privacy Policy.

2. Data Controller

The designated data controller responsible for the processing of your personal information is:

  • Company: POVITRULYA LTD
  • Company Registration Number: 14095604 (England and Wales)
  • Registered Address: 63-66 Hatton Garden, Fifth Floor, Suite 23, London, England, EC1N 8LE
  • Website: povitrulya.com
  • Privacy Contact: [email protected]

3. Key Definitions

  • Personal Data: Any information relating to an identified or identifiable living individual.
  • Usage Data: Diagnostic and behavioral data collected automatically by our website infrastructure (such as page duration, operating systems, and IP addresses).
  • Cookies: Small data files stored on your browser or device by web servers.
  • Service Providers / Processors: Vetted third-party entities who process data on our behalf to facilitate store operations, payments, delivery, communications, and analytics.

4. Categories of Data We Collect

We process only the personal details necessary to deliver our craft kits, manage orders, communicate with you, and comply with legal requirements.

4.1. Data Provided Directly by You

  • Orders and Checkout: First and last name, delivery address, billing address, email address, contact telephone number, and order notes.
  • Marketing Sign-Ups: Email address.
  • Customer Support: Name, email, and any communication history exchanged with our helpdesk.

Payment Security Notice: We do not collect, process, or store payment card numbers, expiry dates, or CVV/CVC codes on our infrastructure. All payments are executed directly through encrypted, PCI-DSS compliant third-party payment gateways.

4.2. Automatically Collected Information (Usage Data)

  • Internet Protocol (IP) address;
  • Device model, browser type, browser version, and operating system;
  • Referral links (the URL through which you navigated to our store);
  • Timestamp, visited URLs, session duration, and click paths;
  • Bot prevention telemetry and security challenge tokens (via Cloudflare Turnstile or equivalent security systems).

5. Lawful Bases for Processing

Under the UK and EU GDPR, we process personal data under the following legal bases:

Purpose / Processing Activity Categories of Data Legal Basis
Order Fulfilment (invoicing, packing, global postage, customs handling) Name, shipping address, billing address, email, phone Performance of a contract (Article 6(1)(b))
Customer Support & Service Updates (order tracking, customer inquiries) Contact information, communication records Performance of a contract (Article 6(1)(b)) & Legitimate interests (Article 6(1)(f))
Marketing Communications (promotional emails, needlework releases, discounts) Email address Consent (Article 6(1)(a))
Store Security & Abuse Prevention (blocking fraud, spam, automated bots) IP address, browser telemetry, diagnostic logs Legitimate interests (Article 6(1)(f)) & Legal obligation (Article 6(1)(c))
Analytics & Site Performance Optimization Aggregated, pseudonymized browsing data Legitimate interests (Article 6(1)(f)) / Consent (Article 6(1)(a))
Tax, Fiscal & Accounting Compliance Order invoices, payment receipts Legal obligation (Article 6(1)(c))

6. Service Providers and Third-Party Data Recipients

We never sell, rent, or lease personal data. To provide our services, we share necessary data with trusted third-party providers on a strict need-to-know basis. These partners operate under contractual data protection terms:

6.1. Payment Processors

Payment processing is handled by licensed payment institutions, merchant acquiring banks, and electronic money providers, including, but not limited to:

  • PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg);
  • LiqPay (JSC CB "PrivatBank", Ukraine);
  • And other authorized, PCI-compliant payment gateways, merchant acquirers, or wallet providers as may be integrated from time to time.

6.2. Shipping, Logistics, and Warehousing Partners

To deliver physical goods to your door, shipping information is shared with international postal and courier operators, including, but not limited to:

  • JSC "Ukrposhta" (international registered airmail services);
  • Amazon Fulfillment Services (Amazon FBA) and affiliated warehouse logistics partners (for localized storage and expedited fulfillment);
  • Destination national postal operators (e.g., USPS, Royal Mail, Deutsche Post, Canada Post) and private courier services (such as DHL, FedEx, or UPS);
  • Relevant national customs clearance authorities.

6.3. Email Marketing and Transactional Messaging

  • Brevo (Sendinblue SAS, France) and similar authorized transactional/marketing email platforms, utilized solely to transmit newsletters, special offers, and automated store notifications where you have given consent or completed a purchase.

6.4. Analytics, Performance, and Advertising Technologies

We employ diagnostic and promotional tools to evaluate site traffic, measure campaign performance, and show relevant needlework promotions, including, but not limited to:

  • Google LLC / Google Ireland Ltd (Google Analytics);
  • Meta Platforms Ireland Ltd (Meta Pixel for Instagram and Facebook);
  • Pinterest Europe Ltd (Pinterest Tag);
  • Umami Analytics and equivalent privacy-oriented aggregate diagnostic software.

You may control or decline non-essential tracking cookies at any time via our Cookie Banner or through your individual browser controls.

7. International Data Transfers

POVITRULYA LTD operates an international supply chain and digital storefront. Personal data may be transferred to, stored, and processed in jurisdictions outside your domestic territory, including:

  • The United Kingdom (company domicile and primary administrative location);
  • The European Economic Area (EEA) (EU data centers for email dispatch, analytics, and PayPal processing);
  • Ukraine (production workshops, design studio, postal export processing, and regional banking partners);
  • The United States (infrastructure, cloud hosting, and platform services).

Where personal data is transferred across international boundaries, we ensure appropriate safeguards are implemented in compliance with UK and EU GDPR Chapter V, including the standard contractual clauses (SCCs) adopted by the European Commission and the UK International Data Transfer Addendum.

8. Data Retention

We keep your personal information only for the duration necessary to satisfy the purposes set out in this Policy:

  • Statutory Accounting & Tax Records: Invoices and transaction documentation are retained for a minimum of 6 to 7 years to fulfill UK Companies House, HMRC, and applicable fiscal statutory duties.
  • Marketing Subscribers: Maintained until you opt out or withdraw consent.
  • Customer Support Inquiries: Retained for up to 12 months after the inquiry is successfully closed.

9. Your Statutory Rights (UK & EU GDPR)

Subject to statutory conditions, you possess comprehensive rights regarding your personal information:

  • Right of Access: You may request a copy of the personal data we hold about you.
  • Right to Rectification: You may request the update or correction of incomplete or incorrect data.
  • Right to Erasure ("Right to Be Forgotten"): You may request that we delete your personal details when retention is no longer required by law.
  • Right to Restriction: You may ask us to suspend processing while a dispute or review is pending.
  • Right to Data Portability: You may request to receive your personal data in a structured, commonly used, machine-readable format.
  • Right to Object: You may object at any time to the processing of your data for direct marketing or where we rely on legitimate interests.
  • Right to Withdraw Consent: Where processing relies upon your consent, you can withdraw it at any moment.
  • Right to Lodge a Complaint: You have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk or your national EU Data Protection Authority.

To exercise your rights, please submit your request to [email protected].

10. User Data Deletion Procedure

You retain the right to request the permanent erasure of your personal data from our systems.

To submit a deletion request:

  • Send an email to [email protected] with the subject line: "Personal Data Deletion Request".
  • Include your full name, email address used during purchase, and any relevant order reference numbers.

We will confirm your request and complete data erasure within thirty (30) calendar days. Following confirmation, all identifiable information will be permanently removed or anonymized, excluding statutory financial records that POVITRULYA LTD is legally mandated to preserve under UK company and tax law.

11. Marketing Opt-Out

Promotional marketing messages are only sent to users who explicitly opt in. You may opt out at any time:

  • By clicking the "Unsubscribe" link placed at the base of every marketing email;
  • By contacting our support team at [email protected].

Opting out of marketing does not impact transactional emails (such as payment receipts, order confirmations, and shipment tracking).

12. Protection of Minors

Our Website is not directed to individuals under eighteen (18) years of age. We do not intentionally harvest data from children. If you become aware that a child has supplied us with personal data without parental authorization, please contact us immediately, and we will take immediate action to purge such records.

13. Revisions to This Policy

We may periodically amend this Privacy Policy to reflect changing operational, legal, or regulatory standards. Any revisions will be published directly on this page with an updated modification date.

14. Contact Information

If you have questions, feedback, or inquiries concerning this Privacy Policy, please contact our data team:

  • Company: POVITRULYA LTD
  • Company Number: 14095604 (England and Wales)
  • Registered Address: 63-66 Hatton Garden, Fifth Floor, Suite 23, London, England, EC1N 8LE
  • Storefront: https://povitrulya.com
  • Email: [email protected]