1.1. This Privacy Policy explains what personal data the Barva Kimono online store (“Barva”, “we”) collects on barvaclothes.com and its English version barvaclothes.com/en, why we collect it, who we share it with, how long we keep it and how you can control it.
1.2. We process personal data in accordance with the Constitution of Ukraine, the Law of Ukraine “On Personal Data Protection” (the “Law”), the Law of Ukraine “On Electronic Commerce” and other Ukrainian legislation. We also follow the principles of the EU General Data Protection Regulation (GDPR): we collect as little data as possible, explain honestly what happens to it and do not keep it longer than necessary.
1.3. In short: for orders we only collect the data we need to make, take payment for and deliver your order and to contact you about it. We do not sell personal data. To measure visits and run ads, the website uses Google Analytics and Meta Pixel (section 11); they do not receive any order data.
2.1. The controller of your personal data is the individual entrepreneur (FOP) Ovcharenko Anastasiia Vasylivna, RNOKPP (taxpayer number) 3268806706, registered address: 41 Mashynobudivna St., Kyiv.
2.2. For any question about your personal data, please contact us:
3.2. Required fields are marked in the form; without them we cannot fulfil the order. If you provide another person’s data (for example, a gift recipient’s), you confirm that you are entitled to share it and that the person does not object.
Payment takes place on the secure page of the Plata by mono (monobank) payment service. You enter your card details directly there, so we never see or store your full card number, expiry date or CVV code. From the bank we receive the payment status, amount, transaction identifier and technical payment details, including a masked card number (only a few first and last digits are visible) and the card network. We need them to confirm the payment, keep our accounts and issue refunds if necessary.
If you contact us via Telegram, Viber, Instagram, by phone or by email, we receive whatever you choose to tell us, as well as your phone number, email address or profile name in that service.
When you open the website, your browser connects to the servers of our hosting provider (Webflow) and of the services that deliver fonts, images and scripts (Webflow CDN, jsDelivr, the Supabase cloud service). These servers automatically receive technical data: IP address, browser and device type, the requested page, date and time. This is simply how the internet works: a page cannot be displayed otherwise. We do not use this data to identify you and do not build visitor profiles from it; the providers keep such logs under their own rules.
We do not ask for passport details, date of birth or card details, and we do not process sensitive data (about health, religious or political beliefs, etc.). Please do not include such information in your order comment.
4.1. We process data only for the following purposes:
4.2. By ticking the consent box at checkout (agreeing to the terms of the public offer and to the processing of personal data), you consent to the processing of your personal data for the purposes described in this Policy, including its transfer to the recipients listed in section 5 and abroad as described in section 6. An order cannot be placed on the website without ticking this box, because we cannot fulfil it without the data.
4.3. We do not send marketing emails or messages without your separate consent, do not make automated decisions about you that have legal effects, and do not use your data for purposes incompatible with those for which it was collected.
5.1. We share data only with those without whom we cannot fulfil the order or run the website, and only to the extent necessary:
5.2. Separately from orders, Google (Google Analytics) and Meta (Meta Pixel) receive technical data when you visit the website, for statistics and advertising, as described in section 11. We do not sell order data (name, phone number, address) or share it with advertising networks, data brokers or other companies for their marketing.
6.1. Some of the services we use store data outside Ukraine: Supabase in the European Union; Webflow, Notion, Resend and Google in the USA; Meta in Ireland and the USA; Telegram on servers in various countries.
6.2. States of the European Economic Area and parties to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data are recognised as ensuring an adequate level of data protection (Article 29 of the Law). We transfer data to other countries, including the USA, on the basis of your unambiguous consent and because the transfer is necessary to perform a contract concluded in your interest (Article 29 of the Law).
6.3. We choose services that encrypt data in transit and restrict access to it. You may state reservations about such transfers (Article 8(2)(10) of the Law); please write to us before placing your order.
7.1. We keep data no longer than the purpose of processing requires:
7.2. Once the period expires, we delete the data from all our systems or anonymise it so that you can no longer be identified (Article 15 of the Law). The history of your conversations in Telegram, Viber or Instagram may also be kept on your side and on those services’ servers under their own rules.
8.1. We take organisational and technical measures to protect data against accidental loss, destruction and unauthorised access (Article 24 of the Law):
8.2. If an incident occurs that threatens your rights, we will notify you without delay and, where required by law, the Ukrainian Parliament Commissioner for Human Rights.
9.1. Under Article 8 of the Law, you have the right to:
9.2. On request, we will also provide a copy of your data in a commonly used electronic format.
9.3. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. After withdrawal, we will stop processing, except for data needed to fulfil an order that has already been paid for or data we are required by law to keep.
10.1. Send your request to barva.clothes89@gmail.com. Please include your name, the order number or the phone number you used, and what exactly you would like us to do with your data. We may ask you to confirm that the request really comes from you, so that we do not disclose your data to someone else.
10.2. Within 10 working days we will tell you whether your request will be granted and, if not, explain why. We will fulfil the request within 30 calendar days of receiving it (Article 16 of the Law). The same time limits apply to requests to correct or delete data. Handling requests is free of charge.
11.1. To measure visits, the website uses Google Analytics 4 (Google), and to measure and show ads on Facebook and Instagram it uses Meta Pixel (Meta Platforms). They receive technical data (IP address, browser and device type, pages viewed, where you came from and actions on the website) and store cookies in your browser: _ga and _ga_* (Google, up to 2 years) and _fbp (Meta, up to 90 days). We never pass them the name, phone number or address from your order.
11.2. Visitors from the European Economic Area and the United Kingdom are asked for consent first. Until you click “Accept”, Meta Pixel does not load, and Google Analytics stores no cookies and receives only anonymous signals without identifiers (Google Consent Mode). For other visitors these tools work straight away; the legal basis is our legitimate interest in understanding how the website is used and in showing ads to people who may be interested (Article 11(1)(6) of the Law).
11.3. You can change your choice at any time: click “Cookie settings” below to bring up the same prompt, and “Decline” turns off analytics and advertising cookies in this browser. You can also delete cookies in your browser settings, install the Google Analytics Opt-out add-on or change the ad settings in your Facebook or Instagram account. We remember your choice in the browser for 12 months and then ask again.
11.4. The website also keeps your cart contents (items, sizes, quantities), selected currency (Ukrainian hryvnia or US dollar) and cookie choice in your browser’s storage (localStorage). These entries stay on your device and are not sent to us automatically; we receive the cart contents only when you place an order. The website cannot work as an online store without them, so we do not ask for separate consent to them. You can delete them in your browser settings: your cart will be emptied and the currency will return to the default.
11.5. Our hosting provider and CDNs may use strictly technical mechanisms, including technical cookies, to protect against attacks and deliver pages quickly. The monobank payment page is a separate bank website with its own cookie rules.
Cookie settingsThe website is not intended for children under 14, and we do not knowingly collect their data. If you are a parent or other legal guardian and believe that a child has given us their data, please write to us and we will delete it.
The website contains links to Instagram, Telegram, the monobank payment page and other services. When you go there, the rules and privacy policies of those services apply, and we are not responsible for them.
14.1. We may update this Policy, for example when we start using a new service or when the law changes. The new version is published on this page together with the date from which it applies.
14.2. We will announce material changes on the website. We will not use data collected earlier for new purposes without your consent.
15.1. This Policy is drawn up in Ukrainian and English. In case of any discrepancy, the Ukrainian version prevails.
15.2. This version of the Policy is effective from 23 October 2026.
