Privacy Policy

Version of 7 August 2026

This Privacy Policy (the "Policy") sets out how personal data of visitors and customers of the online store https://mareoni.com (the "Website") is processed. It has been drawn up to comply with the Law of Ukraine "On Personal Data Protection" No. 2297-VI of 1 June 2010 (the "Law"), in particular Article 12(2) thereof.

For visitors located in the European Union, Regulation (EU) 2016/679 (GDPR) applies in addition.

1. CONTROLLER OF PERSONAL DATA

The controller of personal data within the meaning of Article 2 of the Law is Iryna Demchenko, individual entrepreneur (FOP), Ukrainian taxpayer registration number 3337819483 (the "Controller").

Contact details of the Controller for matters concerning the processing of personal data:

• email: care@mareoni.com;
• phone: +38 (066) 000 44 55;
• correspondence address: 12 Dmytra Doroshenka St., Kyiv, Ukraine.

2. DEFINITIONS

The terms used in this Policy have the meaning given in Article 2 of the Law:

• personal data — information or a set of information about a natural person who is identified or can be specifically identified;
• data subject — the natural person whose personal data is processed ("you");
• controller — the person who determines the purpose of processing, the composition of the data and the processing procedures;
• processor — the person authorised by the controller to process the data on the controller's behalf;
• processing — any action or set of actions performed on personal data;
• consent — a freely given expression of will granting permission to process personal data for a stated purpose.

3. COMPOSITION AND CONTENT OF PERSONAL DATA

3.1. Personal data you provide yourself:

• first and last name;
• phone number;
• email address;
• delivery address, or a branch or parcel locker of a postal operator;
• the content of your communications with the Controller, including email, the Website chat and messengers;
• where an account is created — username, password in encrypted form, order history, wishlist.

3.2. Personal data generated automatically while you use the Website:

• IP address and the approximate settlement-level location derived from it;
• device type, operating system, browser type and version, screen resolution;
• date, time and duration of the visit, pages viewed, referral source;
• on-page actions: clicks, scrolling, cursor movement, interaction with forms;
• cookie identifiers.

3.3. The Controller does not collect or store payment card details. Payment is processed on the side of the WayForPay payment service; the card number, expiry date and CVV code are entered in the payment service's form and are not transmitted to the Controller.

3.4. The Controller does not process personal data revealing racial or ethnic origin, political, religious or philosophical beliefs, membership of political parties or trade unions, health data, biometric data or data concerning sex life.

4. PURPOSES AND LEGAL GROUNDS OF PROCESSING

Personal data is processed for the following purposes and on the following grounds set out in Article 11 of the Law:

• Conclusion and performance of a sales contract; placing, payment and delivery of an order. Data: name, surname, phone, email, delivery address. Ground: Article 11(1)(3) of the Law — conclusion and performance of a transaction to which the data subject is a party.
• Accounting and tax records. Data: order details, amount and date of the transaction. Ground: Article 11(1)(5) of the Law — necessity to fulfil a statutory obligation of the controller.
• Handling enquiries, returns and exchanges. Data: name, contact details, content of the enquiry, order details. Grounds: Article 11(1)(3) and 11(1)(6) of the Law.
• Maintaining a Website account. Data: registration details, order history, wishlist. Ground: Article 11(1)(3) of the Law.
• Sending informational and promotional messages (newsletters). Data: email, name. Ground: Article 11(1)(1) of the Law — consent of the data subject. Commercial electronic messages are distributed in compliance with Article 10 of the Law of Ukraine "On Electronic Commerce".
• Analysis of Website traffic and user behaviour to improve its operation. Data: the information listed in clause 3.2 of this Policy and cookie identifiers. Ground: Article 11(1)(6) of the Law — necessity to protect the legitimate interests of the controller, except where the need to protect the data subject's fundamental rights and freedoms overrides those interests.
• Advertising and remarketing. Data: the information listed in clause 3.2 of this Policy, cookie identifiers, product views. Ground: Article 11(1)(6) of the Law.
• Fraud prevention and Website security. Data: IP address, technical information, order details. Ground: Article 11(1)(6) of the Law.

4.1. Withdrawal of consent. Where processing is based on your consent, you may withdraw it at any time under Article 8(2)(11) of the Law. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

4.2. For visitors located in the European Union, processing for analytics and advertising purposes is carried out on the basis of consent in accordance with Directive 2002/58/EC.

4.3. Right to object to processing based on legitimate interest. Where processing is based on Article 11(1)(6) of the Law — in particular for analytics, advertising and remarketing — you have the right to submit a reasoned demand to the Controller objecting to such processing under Article 8(2)(5) of the Law. The demand should be sent to care@mareoni.com. The Controller reviews it within thirty calendar days and, if granted, ceases processing your personal data for that purpose.

5. COOKIES AND ANALYTICS SERVICES

5.1. Cookies are small text files stored in your browser that allow the Website to recognise your device on a subsequent visit.

5.2. The Website uses the following categories of cookies:

• necessary — enable the cart, authentication, language and currency selection, and Website security. The Website does not function without them;
• analytics — enable visit statistics, heatmaps and session recordings;
• advertising — enable ad delivery, remarketing and campaign measurement.

5.3. The Website uses the following services:

• Google Analytics 4 (Google Ireland Limited, Ireland) — visit statistics and traffic sources; analytics cookies. policies.google.com/privacy
• Microsoft Clarity (Microsoft Corporation, USA) — heatmaps, session recordings, click analysis; analytics cookies. privacy.microsoft.com
• Meta Pixel (Meta Platforms Ireland Limited, Ireland) — advertising measurement and remarketing; advertising cookies. facebook.com/privacy/policy
• TikTok Pixel (TikTok Technology Limited, Ireland) — advertising measurement and remarketing; advertising cookies. tiktok.com/legal/privacy-policy
• 13chats — operation of the support chat; necessary cookies.

5.4. Session recordings. Microsoft Clarity and Plerdy generate anonymised recordings of page interaction: cursor movement, clicks and scrolling. Such recordings are not a recording of your device screen and involve no access to your camera or microphone.

Personal data you enter, or that is displayed at checkout and in your account — name, surname, phone number, email address, delivery address, postal operator branch — is masked and does not appear in the recordings; placeholder characters are displayed instead.

5.5. Retention periods of analytics services:

• Microsoft Clarity: session recordings — 30 days; aggregated data — up to 9 months;
• Google Analytics 4: up to 14 months;
• Plerdy: as provided by the service's plan;
• Meta Pixel and TikTok Pixel: as provided by the respective providers' policies.

5.6. Refusing cookies. You may block or delete cookies in your browser settings. Blocking necessary cookies makes it impossible to place an order on the Website. You may also opt out of data collection by Google Analytics using the browser add-on: tools.google.com/dlpage/gaoptout

6. RECIPIENTS OF PERSONAL DATA

6.1. In compliance with Article 8(2)(2) and Article 12(2) of the Law, the Controller informs you that personal data is transferred to the following persons solely to the extent necessary to achieve the relevant purpose:

• Nova Poshta JSC — name, surname, phone number, address or branch; purpose: order delivery;
• the operator of the WayForPay payment service — order amount and number, contact details for issuing the payment document; purpose: online payment processing;
• Google, Microsoft, Plerdy, Meta, TikTok — the information listed in clause 3.2 of this Policy and cookie identifiers; purpose: analytics and advertising;
• 13chats — name, contact details, conversation content; purpose: operation of the support chat;
• SendPulse — email address, name; purpose: sending newsletters where you have given consent;
• cloud providers for order management and customer enquiry handling — name, contact details, order details, enquiry history; purpose: internal order and customer management;
• public authorities — within the limits and under the procedure established by law.

6.2. These persons act as processors on the basis of contracts with the Controller and are required to protect personal data in accordance with Article 24 of the Law.

6.3. Notification of the transfer of personal data to third parties is given through publication of this Policy in compliance with Article 12(2) of the Law; under Article 21(2) of the Law no separate notification is required in that case. The Controller notifies other actions concerning personal data — modification, deletion, destruction, restriction of access, and transfer to a new recipient not listed in clause 6.1 — within ten working days in accordance with Article 21(1) of the Law.

6.4. The Controller does not sell personal data to third parties.

6.5. Upon a written request from a data subject sent to care@mareoni.com, the Controller provides the names of the specific providers referred to collectively in clause 6.1, together with the conditions of their access to personal data. A response is provided within thirty calendar days in accordance with Article 8(2)(2) and Article 8(2)(4) of the Law.

7. CROSS-BORDER TRANSFER OF PERSONAL DATA

7.1. Under Article 29(2) of the Law, member states of the European Economic Area and states that have signed the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data are deemed to ensure an adequate level of data protection. Transfers to Google Ireland Limited, Meta Platforms Ireland Limited and TikTok Technology Limited take place under this rule.

7.2. Transfer of personal data to Microsoft Corporation (United States of America) takes place under Article 29(3)(5) of the Law. The Controller provides appropriate guarantees of non-interference with the data subject's private and family life, securing them through the provider's contractual commitments — the Microsoft data processing terms, which incorporate the European Commission's Standard Contractual Clauses, and the provider's participation in the EU–US Data Privacy Framework.

7.3. Personal data is not used for any purpose other than that for which it was collected.

8. PROCESSING AND RETENTION PERIODS

• order details and customer contact data — at least three years from the order date, taking into account the limitation period under Article 257 of the Civil Code of Ukraine;
• primary accounting documents — 1095 days under Article 44.3 of the Tax Code of Ukraine, and 1825 days in the cases provided for by that paragraph;
• enquiries, return and exchange requests — at least three years from the date of the enquiry;
• account data — until the account is deleted by the data subject;
• newsletter data — until consent is withdrawn;
• analytics data — for the periods set out in clause 5.5 of this Policy;
• data processed for fraud prevention — one year.

The running of these periods may be suspended in the cases provided for by law. Where different periods apply to the same personal data, processing continues for the longest of them. Upon expiry, personal data is destroyed or anonymised.

9. RIGHTS OF THE DATA SUBJECT

Under Article 8(2) of the Law you have the right to:

1. know the sources of collection, the location of your personal data, the purpose of its processing, and the location of the Controller or processor, or to instruct authorised persons to obtain this information, except as established by law;
2. receive information on the conditions of access to personal data, including information on third parties to whom your personal data is transferred;
3. access your personal data;
4. receive, no later than thirty calendar days from the date of the request, except as provided by law, an answer as to whether your personal data is processed, and to receive the content of such data;
5. submit a reasoned demand to the Controller objecting to the processing of your personal data;
6. submit a reasoned demand for the modification or destruction of your personal data by any controller or processor, where the data is processed unlawfully or is inaccurate;
7. protection of your personal data against unlawful processing and accidental loss, destruction or damage caused by deliberate concealment, failure to provide or untimely provision, and protection against the provision of information that is inaccurate or damages honour, dignity or business reputation;
8. lodge complaints about the processing of your personal data with the Ukrainian Parliament Commissioner for Human Rights or with a court;
9. use legal remedies in the event of a breach of personal data protection legislation;
10. make reservations restricting the right to process your personal data when giving consent;
11. withdraw consent to the processing of personal data;
12. know the mechanism of automatic processing of personal data;
13. protection against an automated decision producing legal effects for you.

Visitors located in the European Union additionally enjoy the rights set out in Chapter III of Regulation (EU) 2016/679, in particular the right to data portability.

10. HOW TO EXERCISE YOUR RIGHTS

10.1. A request for access to personal data, its modification or destruction, or an objection to processing, should be sent to care@mareoni.com or to the correspondence address given in section 1 of this Policy. Please mark the subject line "Personal data".

10.2. A response is provided within thirty calendar days of receipt of the request, in accordance with Article 8(2)(4) of the Law.

10.3. You may unsubscribe from newsletters by following the "Unsubscribe" link contained in every informational email.

11. DATA PROTECTION MEASURES

In accordance with Article 24 of the Law, the Controller applies organisational and technical measures to protect personal data against unlawful processing and accidental loss, in particular: use of an encrypted connection (HTTPS), restriction of access to personal data to persons who need it to perform their duties, storage of passwords in encrypted form, and confidentiality undertakings in contracts with contractors.

In the event of a personal data breach likely to create a risk to the rights and freedoms of data subjects, the Controller notifies the data subjects and the Ukrainian Parliament Commissioner for Human Rights within the period prescribed by law.

12. PROCESSING OF MINORS' PERSONAL DATA

12.1. Full civil capacity is acquired at the age of eighteen. From that moment a person gives consent to the processing of their personal data independently.

12.2. Processing of the personal data of a person under eighteen is carried out with the consent of their parents or other legal representatives. The Controller does not deliberately collect the personal data of such persons.

12.3. Where it is established that personal data has been provided by a person under eighteen without the consent of a legal representative, that data is destroyed upon a request sent to care@mareoni.com.

12.4. For visitors located in the European Union, Article 8 of Regulation (EU) 2016/679 applies, setting the threshold at sixteen years unless a member state's national law provides for a lower age.

13. AUTOMATED PROCESSING AND PROFILING

13.1. The Controller carries out profiling for advertising purposes: based on information about products viewed and behaviour on the Website, advertising platforms may display more relevant advertising to you.

13.2. The Controller does not take decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing of personal data.

13.3. You may object to profiling for advertising purposes under the procedure set out in clause 4.3 of this Policy, or by using the advertising settings of the relevant platforms.

14. AMENDMENTS TO THIS POLICY

14.1. The Controller may amend this Policy. The current version, together with its date, is published at https://mareoni.com/en/privacy-policy/.

14.2. Where amendments are material — in particular a new processing purpose or the engagement of new processors — the Controller notifies data subjects separately, by email or by posting a notice on the Website.