Privacy.

Who is responsible

Last updated 28 October 2026

SÉRA is a beauty shop run from Kyiv. We decide what happens to the personal data described here, which makes us the controller for it.

Registered entity: [registered company name and number]. Registered address: [registered address].

This line needs the operator's real filing before launch. We have left it blank rather than invent one.

For anything on this page, write to [email protected] and a person will answer.

What we collect

Only what an order needs, plus what you choose to give us.

• Order details — name, delivery address, phone number and email, so the parcel arrives and we can tell you where it is.
• Account details — email and password, if you create an account. Passwords are stored hashed; nobody here can read yours.
• Payment — handled by the payment provider. Card numbers never reach our servers; we see the last four digits and whether the payment succeeded.
• Messages — what you write to us, so we can answer and remember the context.
• Site usage — pages viewed and rough location, only if you accept analytics cookies. See the cookie policy.

Why we are allowed to

Four reasons cover everything we do.

• To perform the contract — you ordered something; we need your address to send it.
• Legal obligation — invoices and tax records have to be kept.
• Consent — the newsletter and analytics cookies. You can withdraw it at any time and nothing else changes.
• Legitimate interest — keeping the shop working and fraud off it.

Who else sees it

Nobody who does not need it. We do not sell personal data and never have.

It reaches the courier that carries your parcel, the payment provider that takes the money, and the services that host the shop and send our email. Each one gets the minimum needed to do its job and is bound by contract to use it for nothing else.

Current processors: [list of processors and the country each operates from].

This line needs the operator's real filing before launch. We have left it blank rather than invent one.

How long we keep it

Order records are kept as long as accounting law requires, because we are not allowed to delete them sooner. Account data lives until you close the account. Newsletter consent lives until you unsubscribe. Support email is kept while it is still useful to you and us.

Exact retention periods: [retention schedule, once the operator sets it].

This line needs the operator's real filing before launch. We have left it blank rather than invent one.

What you can ask for

You can ask us for a copy of what we hold, a correction, deletion, a pause on processing, or your data in a portable file. You can object to processing based on legitimate interest, and you can withdraw consent whenever you like.

Write to [email protected]. We answer within thirty days and we do not ask why. If we get it wrong you can complain to the data protection authority where you live.

Changes

If this policy changes in a way that affects you, we will say so here and date it. Small corrections happen without notice.