Privacy Policy Privacy Policy

Who processes your data

The personal data controller (“володілець”) is to be specified (taxpayer number / EDRPOU code to be specified), address: to be specified. B.MUSE brand.

For questions about your data: to be specified, to be specified.

What data we collect

• Order form data: first and last name, phone number, email (optional), preferred contact method (call, Telegram, Viber, Instagram Direct), city and Nova Poshta branch, comment.
• Order data: number, selected items, sizes, quantity, price, status and fulfilment history.
• Correspondence with the manager via the channel you choose.
• For made-to-measure orders — the measurements and garment preferences you provide.
• IP address — to protect the order form from automated and repeated submissions. These records are stored with the time of the request and deleted automatically: records older than one day are purged regularly.
• For online payments — only the payment status and amount. Card data is processed by the acquiring bank’s payment service; we do not receive it.

We ask only for the data without which we cannot fulfil an order (Art. 7(4) of the Law of Ukraine “On Electronic Commerce”). Your cart and favourites are stored only in your browser and do not reach us until you place an order (see the Cookie Policy).

Why we process it and on what basis

• To accept, confirm and fulfil your order, contact you, arrange delivery, handle exchanges or returns and consider complaints. Bases: your consent, given by ticking the relevant box in the order form (Art. 11(1)(1) of the Law), and the conclusion and performance of a contract (Art. 11(1)(3) of the Law).
• To keep accounting and tax records and store payment receipts. Basis: a legal obligation (Art. 11(1)(5) of the Law).
• To protect the website and order form from abuse. Basis: the controller’s legitimate interest (Art. 11(1)(6) of the Law).

We do not send marketing mailings, do not sell your data and do not share it for marketing. If a new purpose incompatible with the original one arises, we will ask for separate consent (Art. 6(1) of the Law).

Who we share data with

• Supabase Inc. (USA) — the cloud database where orders are stored. Servers are located in the EU (Frankfurt, Germany). It processes data on our behalf as a processor.
• Vercel Inc. (USA) — website hosting. The website functions that process orders run in the EU (Frankfurt). When delivering pages, the host processes technical request data, including IP addresses.
• Telegram — notifications to the shop owner about a new order: number, items, total, name, phone and contact method.
• Meta (Instagram Direct), Telegram, Viber — correspondence with you if you chose that contact method or wrote to us there. These services process data under their own privacy policies.
• Nova Poshta LLC — surname and first name, phone, city and branch for delivery.
• The acquiring bank and its payment service — the data needed to process a payment when you pay online.
• Public authorities — only in the cases and in the manner provided by law.

We share data with other parties only with your consent or in cases defined by law (Art. 14 of the Law).

International transfers

Some services operate outside Ukraine. States of the European Economic Area, including Germany where the database servers are located, are recognised as providing an adequate level of personal data protection (Art. 29(3) of the Law).

Supabase Inc. and Vercel Inc. are US companies; messaging services may also process data in other countries, including countries not recognised as providing an adequate level of protection. We carry out such transfers on the basis of Art. 29(4) of the Law: with your unambiguous consent and where necessary to conclude and perform a contract with you.

How long we keep data

The Seller has set retention periods according to the purpose of processing: data is kept no longer than necessary (Art. 6(8) of the Law).

• Data on fulfilled orders and related correspondence — 3 years from the end of the year in which the order was fulfilled. This matches the general limitation period (Art. 257 of the Civil Code) and covers the period for claims about defects (Art. 680 of the Civil Code).
• Accounting and tax documents containing your data (including payment receipts) — for the periods set by tax legislation (clause 44.3 of Art. 44 of the Tax Code of Ukraine).
• Orders that were not confirmed or were cancelled — up to 6 months from the date they were placed.
• IP addresses used to protect the form — deleted automatically: records older than one day are purged regularly.
• Telegram notifications and messenger correspondence — deleted within the same periods as order data, to the extent these services allow.

When the periods expire, data is deleted or anonymised (Art. 15 of the Law).

Your rights

Under Art. 8 of the Law you have the right:

• to know the sources of collection and location of your data, the purpose of processing, and the location of the controller and processors;
• to receive information on the conditions of access to your data, including the third parties to whom it has been transferred;
• to access your data and to receive, within 30 calendar days of your request, an answer on whether your data is processed, and its content;
• to submit a reasoned objection to the processing of your data;
• to submit a reasoned demand to change or destroy your data if it is processed unlawfully or is inaccurate;
• to protection of your data against unlawful processing and accidental loss, destruction or damage;
• to make reservations limiting processing when giving consent;
• to withdraw your consent to processing;
• to know how automated processing works and to protection against automated decisions with legal effects for you (we make no such decisions);
• to use legal remedies and to complain to the Ukrainian Parliament Commissioner for Human Rights or to a court.

To exercise your rights, write to to be specified or call to be specified. We may ask you to confirm that the data is yours.

How to withdraw consent

Write to to be specified or via Instagram Direct @b.m.u.s.e, or call to be specified.

Withdrawing consent does not affect the lawfulness of processing before that moment. If your order has not yet been fulfilled, we cannot fulfil it without your contact details. Data we are required by law to keep (accounting documents) will be deleted when the relevant periods expire.

How we protect data

Only the shop owner and persons authorised by her who handle orders have access to order data. The admin area is password-protected, and the connection to the website is encrypted (HTTPS). We do not collect buyers’ passwords, payment card data or identity documents.

Where to complain

If you believe your rights have been violated, you may contact the Ukrainian Parliament Commissioner for Human Rights (Arts. 8 and 23 of the Law):

• address: 21/8 Instytutska St., Kyiv, 01008, Ukraine;
• hotline: 1678 (from abroad: +380 44 299 74 08);
• email: hotline@ombudsman.gov.ua;
• website: ombudsman.gov.ua.

You may also go to court.

Changes to this policy

A new version takes effect on the day it is published on the website; the version date is shown at the top of the document.