Version 2 | Effective from: 03.10.2026
1. Who is responsible
Controller: Iryna Volodymyrivna Yeyeshnyk, individual entrepreneur (FOP), vul. Oleha Hromadskoho 1, 61068 Kharkiv, Ukraine; e-mail love@itsbeauty.shop; telephone +38 063 050 28 28.
We are established in Ukraine and offer goods to customers in the EU. The GDPR applies to this processing. For all data protection questions, write to love@itsbeauty.shop.
2. What we process and why
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Showing the website, security, bot protection | IP address, date and time, page, browser and device data; technical cookies (section 6) | Art. 6(1)(f) GDPR – our interest in a working and secure shop | technical cookies: see section 6; server logs: as long as needed for security, then deleted |
| Customer account | name, e-mail, telephone, password, addresses, order history, wish list | Art. 6(1)(b) GDPR | until you delete the account |
| Order, delivery, payment, returns and warranty | name, delivery address, e-mail, telephone, products, prices, order number, payment status, correspondence | Art. 6(1)(b) GDPR. Without the mandatory checkout data we cannot accept the order | for the contract and the legal guarantee period; then as below |
| Accounting and tax records | invoices, order and payment records | Art. 6(1)(f) GDPR – our interest in complying with Ukrainian tax law, which applies to us | at least 1,095 days after the filing of the tax return for the period (Tax Code of Ukraine, item 44.3) |
| Answering your enquiries (e-mail, telephone, callback form, Viber, WhatsApp) | name, contact details, content of the request | Art. 6(1)(b) GDPR if it concerns an order, otherwise Art. 6(1)(f) GDPR – answering enquiries | until the request is closed and possible claims are time-barred |
| Bot protection of login, registration and callback forms (Google reCAPTCHA) | IP address, browser and device data, interaction with the form | Art. 6(1)(f) GDPR – protection against abuse | per Google |
| Reviews | name or pseudonym, text, rating, date | Art. 6(1)(f) GDPR – publishing customer reviews | while the review is published; you can ask us to remove it |
| Statistics (section 6) | online identifiers, pages visited, device data, approximate location, how you reached the shop | your consent, Art. 6(1)(a) GDPR | until you withdraw consent; cookie durations see section 6 |
| Advertising and conversion measurement (section 6) | online identifiers, pages and products viewed, cart and purchase events, IP address | your consent, Art. 6(1)(a) GDPR | until you withdraw consent |
| Map on the contact page (Google Maps) | IP address, device data | your consent, Art. 6(1)(a) GDPR | per Google |
We do not send newsletters or advertising e-mails.
We do not use automated decision-making that has legal or similarly significant effects on you (Art. 22 GDPR). Our shop is intended for adults (18+).
3. Who receives data
| Recipient | What for |
|---|---|
| TOV "Horoshop", Kyiv, Ukraine – shop platform; according to Horoshop the shop database is hosted by OVH in France | operating the shop, storing account and order data (processor) |
| WayForPay (payment service) | processing card payments; you enter card data on the payment service's page |
| Postal and courier services | delivering the parcel; for parcels to the EU also customs clearance |
| Customs and tax authorities of the country of delivery | import clearance |
| Google (Tag Manager, Analytics, Ads, reCAPTCHA, Maps) | see sections 2 and 6 |
| Microsoft (Microsoft Advertising, Bing UET) | advertising measurement, only with consent |
| Meta Platforms Ireland Limited (Meta Pixel) | advertising measurement, only with consent (section 6) |
| Viber, WhatsApp | only if you write to us there; under their own terms |
| Authorities and courts | where we are legally required |
4. Data outside the EU
We are in Ukraine. The European Commission has not adopted an adequacy decision for Ukraine, so the level of data protection there may be lower than in the EU, and public authorities may have other access powers. When you order, you give your data directly to us in Ukraine. The transfer of your data to us in Ukraine is necessary for the performance of the contract you conclude with us and of pre-contractual steps taken at your request (Art. 49(1)(b) GDPR).
Google, Microsoft and Meta may process data in the USA. Where the recipient is certified under the EU-US Data Privacy Framework, the transfer is based on the Commission's adequacy decision for the USA; otherwise on standard contractual clauses. You can ask us for a copy of the safeguards at love@itsbeauty.shop.
5. Your rights
You can ask for access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) and data portability (Art. 20). You can object at any time, for reasons relating to your situation, to processing based on Art. 6(1)(f) GDPR (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)), for cookies via "Cookie settings" at the bottom of every page. Write to love@itsbeauty.shop; we answer within one month.
You can complain to a data protection supervisory authority, in particular in the EU country where you live or work. A list of all EU authorities: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en
6. Cookies and similar technologies
We use optional technologies on the basis of your consent given in the cookie banner. You can change your choice at any time via "Cookie settings". Your choice is stored for 180 days.
Strictly necessary (no consent needed):
| Name | Purpose | Duration |
|---|---|---|
PHPSESSID |
session, cart, login | 7 days |
uuid |
identifying the session on the server | 30 days |
challenge_passed |
protection of the site against bots | 30 minutes |
ib_cookie_consent |
storing your cookie choice | 180 days |
inlineSVGdata, inlineSVGrev (local storage) |
caching icons | until cleared in the browser |
| Google reCAPTCHA | bot protection, only on login, registration and callback forms | per Google |
Statistics (only with consent):
| Name | Provider | Purpose |
|---|---|---|
| Google Tag Manager | loading the tags below | |
Google Analytics 4 (_ga, _ga_*) |
statistics on how the shop is used | |
Sourcebuster (sbjs_*) |
our shop platform Horoshop | how you reached the shop (search engine, ad, website) |
Advertising (only with consent):
| Name | Provider | Purpose |
|---|---|---|
Google Ads, conversion linker (_gcl_au, _gcl_ls) |
measuring ad success (product views, cart, checkout, purchase), remarketing | |
Microsoft Advertising UET (_uetsid, _uetvid) |
Microsoft | measuring ads on Bing |
Meta Pixel (_fbp, _fbc) |
Meta Platforms Ireland Limited | measuring ads on Facebook and Instagram, audiences |
External media (only with consent): Google Maps on the contact page.
Meta Pixel. For collecting the data with the Pixel and transmitting them to Meta, we and Meta are joint controllers (Art. 26 GDPR) under the Meta Controller Addendum (https://www.facebook.com/legal/controller_addendum). We inform you and obtain consent; Meta handles your rights regarding data stored by Meta. Meta's further processing is Meta's sole responsibility: https://www.facebook.com/privacy/policy/
7. Changes
We update this policy when our services or the law change. The date is shown at the top.