1. GENERAL PROVISIONS

1.1. The personal data controller is Individual Entrepreneur Vasyl Ivanovych Kravchuk (Tax ID: 2068015839; address: Apt. 41, 109 Heroiv Maidanu St., Chernivtsi, 58013, Ukraine) (hereinafter referred to as the “Controller”).

1.2. This Policy applies to the website https://promo.doctor-magnesium.com.ua, as well as to the placement and fulfillment of Orders, payment, delivery, inquiries, reviews, claims, subscriptions, and interactions via telephone, email, and instant messaging services.

1.3. Third-party services may act as independent data controllers. Their independent operations are governed by their own policies; however, the Controller is responsible for the lawfulness of selecting the service and transferring data within the scope of their own activities.

2. PRINCIPLES AND LEGAL REGULATION

2.1. Processing is carried out in accordance with the Constitution of Ukraine, the Law of Ukraine “On the Protection of Personal Data,” the laws “On Information” and “On E-Commerce,” legislation regarding consumer protection, accounting, and taxation, as well as other applicable regulations.

2.2. The Owner adheres to the principles of lawfulness, fairness, transparency, purpose limitation, adequacy and data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability.

2.3. The provisions of the GDPR apply only to the extent that the Regulation expressly extends to the specific processing activity. A reference to the GDPR does not replace compliance with Ukrainian legislation.

3. DATA SUBJECTS, CATEGORIES, AND SOURCES

3.1. Data concerning visitors, Buyers, Recipients, subscribers, applicants, representatives of legal entities and sole proprietors, counterparties, and other persons interacting with the Owner is processed.

3.2. The following may be processed: first name, surname, phone number, email, address or delivery branch; Order details; payment status and technical payment details; refund details; correspondence and inquiries; marketing consent; IP address, device, browser, security logs, and cookie identifiers.

3.3. The Owner does not request or store PINs, CVV/CVC codes, banking application passwords, one-time payment codes, or full payment card numbers, unless required by a secure payment institution process to which the Owner has no access.

3.4. Data is received directly from the data subject; from the Buyer regarding the Recipient; automatically from the device; or from LiqPay, NovaPay, banks, Nova Poshta, technical services, official registers, or authorized persons.

4. HEALTH DATA AND CHILDREN

4.1. For a standard order, the Owner does not require diagnoses, medical records, test results, or treatment history. Please do not send such information via general forms or messaging apps.

4.2. If an individual voluntarily discloses an allergic or other adverse reaction, such information is processed only to the extent necessary to address the inquiry, ensure safety, protect vital interests, or handle a legal claim. Access to this information is subject to additional restrictions.

4.3. The Website is not intended for the placement of Orders by minors. Orders must be placed by a legally competent adult. If data concerning a child is found to have been obtained unlawfully, it will be deleted, or its processing will be brought into compliance with the law.

5. PURPOSES AND LEGAL BASES

5.1. Conclusion and execution of the contract: acceptance of the Order, payment, assembly, delivery, communication, return of goods and funds.

5.2. Enforcement of the law: accounting and tax accounting, settlement documents, consideration of consumer complaints, traceability and response to dangerous products, responses to legal requests from authorities.

5.3. Legitimate interest: security of the Site, fraud prevention, protection of legal claims, basic internal analytics and improvement of the service, provided that the interest does not outweigh the rights of the subject.

5.4. Consent: marketing mailings, optional analytical and advertising cookies, as well as other operations for which consent is required by law. Consent must be specific, informed, voluntary and being confirmed.

5.5. Withdrawal of consent does not affect the lawfulness of prior processing and does not terminate processing that is necessary for the performance of a contract, compliance with a legal obligation, the protection of vital interests, or the establishment, exercise, or defense of legal claims.

6. MANDATORY PROVISION OF DATA

6.1. Name, telephone number, and delivery details are required to fulfill the Order. Failure to provide mandatory data may make the sale or delivery impossible.

6.2. Optional fields need not be filled in. The data subject must provide accurate, up-to-date data and notify of any changes when necessary for the performance of the contract.

7. RECIPIENTS AND ROLES OF THIRD PARTIES

7.1. Nova Poshta receives the Recipient’s data, phone number, locality, branch/parcel locker or address, shipment parameters, declared value, and the cash-on-delivery amount.

7.2. LiqPay, NovaPay, and banks receive the data necessary to process, confirm, and refund payments and to prevent fraud.

7.3. Hosting providers, developers, administrators, CRM providers, email services, and cybersecurity and backup providers may act as data processors under contract and solely in accordance with documented instructions, unless they act in an independent capacity.

7.4. Accountants, lawyers, auditors, courts, tax authorities, law enforcement agencies, regulatory bodies, and the Ukrainian Parliament Commissioner for Human Rights receive data only on lawful grounds.

7.5. The Owner does not sell personal data databases and does not transfer data for incompatible purposes without a separate legal basis.

8. COOKIES AND SIMILAR TECHNOLOGIES

8.1. Essential cookies support the shopping cart, session management, protection against attacks, and the preservation of privacy settings. They are used without separate consent only to the extent technically necessary for the function requested by the user.

8.2. Functional, analytical, and advertising cookies are activated only in accordance with the user’s choice where consent is required. Such technologies must not be loaded prior to the user making a selection.

8.3. The banner must provide equivalent and accessible buttons for “Accept All,” “Reject Non-Essential,” and “Configure,” must not use pre-checked boxes, and must retain a record of the user’s choice.

8.4. The User may change or withdraw their choice via the permanently available “Cookie Settings” link. Withdrawing consent must be no more difficult than granting it.

8.5. The actual list of providers, cookie names, purposes, retention periods, and third-party transfers is displayed in the current banner/settings center. A general mention of a service in this Policy does not authorize its implementation without proper configuration.

9. ANALYTICS, ADVERTISING, AND MARKETING

9.1. Google Analytics, Google Ads, Meta Pixel, or other services may be used only if they are actually integrated, listed in the settings center, and—where required—blocked until consent is obtained.

9.2. No medical information, full payment details, the text of private communications, or data unnecessary for the stated purpose is transmitted to advertising and analytics systems.

9.3. Marketing messages are sent based on consent or another lawful basis, identifying the sender and providing a simple way to opt out. Opting out of advertising does not stop service-related messages regarding orders, payment, delivery, returns, or safety.

10. RETENTION PERIODS

10.1. Data is retained no longer than necessary for the specified purpose, unless the law prescribes a longer period. The retention period is determined based on contract performance, tax and accounting requirements, statutes of limitation, product safety considerations, and the validity of consent.

10.2. Indicative retention periods are set out in the table below; the actual period may be extended only on documented legal grounds.

11. PROTECTION AND INCIDENTS

11.1. The Owner implements measures proportionate to the risks: access segregation, unique passwords, multi-factor authentication, encryption of data in transit, updates, backups, logging, contractor oversight, and training for individuals with access.

11.2. In the event of an incident, the Owner contains the event, assesses risks, documents the circumstances, restores availability, and notifies data subjects and competent authorities in the cases and manner prescribed by applicable law.

11.3. Absolute security cannot be guaranteed. The User must protect their device, email, and access codes, and immediately report any suspicious activity.

12. TRANSCORD TRANSFER

12.1. Technical, postal, analytical, or advertising service providers may process data outside Ukraine. Such transfers take place only on a lawful basis, following an assessment of the recipient, and subject to appropriate contractual, organizational, and technical safeguards.

12.2. Where the GDPR applies, the transfer mechanisms provided for therein are also utilized. The data subject may request general information regarding the countries, categories of recipients, and safeguards involved.

13. AUTOMATED PROCESSES

13.1. The Website may automatically calculate amounts, apply promo codes, verify payment status, determine delivery details, detect suspicious activity, and generate recommendations.

13.2. There are no plans to make solely automated decisions that produce significant legal consequences without a legal basis, proper notification, and the opportunity for human review where required by law.

14. RIGHTS OF THE DATA SUBJECT

14.1. The Data Subject has the rights provided for in Article 8 of the Law of Ukraine “On the Protection of Personal Data,” including the right to know about the sources, location, purpose, and conditions of processing; to receive information about recipients; to access their data; to object to processing; to demand the modification or destruction of unlawfully processed or inaccurate data; to withdraw consent; and to appeal to the Commissioner and the courts.

14.2. The right to erasure is not absolute. Data may be retained for compliance with the law, accounting purposes, the defense of legal claims, and product safety and traceability.

14.3. If the GDPR applies to the processing, the data subject may also have additional rights, including the rights to restriction, portability, and objection, to the extent applicable under that Regulation.

15. PROCEDURE FOR EXERCISING RIGHTS

15.1. Requests shall be sent to [email protected] or by mail to the Owner’s address. They must contain sufficient information to identify the requester, the substance of the request, the date, and contact details for a reply.

15.2. The Owner may request additional proof of identity only to the extent necessary to prevent the disclosure of data to an unauthorized person. A copy of a document is requested only when a less intrusive method is insufficient.

15.3. A response shall be provided within the timeframes prescribed by law. In the event of a lawful refusal or restriction, the grounds and the procedure for appealing the decision shall be communicated.

16. CHANGES, LANGUAGE, AND CONTACTS

16.1. The Policy is updated in the event of changes to legislation, functionality, data categories, service providers, payment or delivery methods, or marketing technologies. The new version enters into force upon publication, unless otherwise specified.

16.2. Material changes requiring new consent cannot be implemented based on prior consent. Where necessary, the user is asked to make a new choice.

16.3. The Ukrainian version prevails. Translations are provided for informational purposes only, unless otherwise required by law.

16.4. Privacy contact: [email protected]; postal address: Apt. 41, 109 Heroiv Maidanu St., Chernivtsi, 58013, Ukraine.

SELLER / DATA CONTROLLER DETAILS

APPENDIX 1. MANDATORY COOKIE BANNER CONFIGURATION

• All non-essential analytical, advertising, and functional scripts requiring consent are blocked pending consent.
• The button to reject non-essential cookies appears on the first level of the banner and is no less prominent than the accept button.
• The settings center displays the provider, specific purpose, retention period, category, and information regarding transfers to third parties.
• The date, text version, categories, and technical proof of selection are stored; the withdrawal is recorded in the same way.
• Upon a change of supplier or purpose, the list is updated prior to the activation of the technology; consent is re-requested if necessary.

This appendix is ​​part of the Policy, but its text does not replace the technical blocking of scripts and the proper functioning of the banner on the Site.