Privacy and Cookies Policy
Last updated: 21 September 2026
1. Controller and Business Information
This website (kunanets.art) is operated by:
FOP Kunanets Khrystyna Yaroslavivna
Sole Proprietor under the laws of Ukraine
Taxpayer Identification Number: 3403200301
State Registration Date: 24 August 2023
Unified State Register Entry Number: 2010350000000383353
Registered Address: Ukraine, 71080, Lvivska oblast, Yavorivskyi raion, Ivano-Frankove, Khmeliuka Street, building 1
Email: office@kunanets.art
Phone: +380 96 829 0922
For all questions about this policy or about your personal data, please write to office@kunanets.art. Your request is handled by the artist personally.
2. EU Representative
We are a one-person business in Ukraine. We do not process personal data of people in the European Union on a large scale or as a regular part of our activity: we process an address and an email when someone orders a painting, and we answer messages that people send us. On that basis we rely on the exception in Article 27(2)(a) of the General Data Protection Regulation and have not appointed a representative in the European Union. You can reach us directly at any time at office@kunanets.art.
3. Scope of This Policy
This policy explains what personal data we collect when you visit this website, place an order, or contact us; why we use it; who else sees it; how long we keep it; and what rights you have.
Our business is registered in Ukraine and primarily governed by the laws of Ukraine. Where the mandatory consumer protection or data protection law of your country of residence also applies, those provisions apply alongside Ukrainian law.
4. Personal Data We Collect
4.1 Data You Give Us
- Name, email address and, where you provide it, telephone number
- Billing address and delivery address
- Order details: which artwork, price, order number, order date, order status
- The content of messages you send us by email or through WhatsApp
- Account details, if you choose to create a customer account
4.2 Data Collected Automatically
- Your IP address, the date and time of the request, the page requested, the referring page, and your browser and device type. This information is written to the web server log and to the security log of our firewall plugin.
- Cookies and comparable browser storage that are needed for the shopping cart and checkout to work, and for remembering your cookie choice (see Section 9).
- Statistical data through Google Analytics, but only within the limits described in Section 9.
We do not operate a newsletter, we do not build customer profiles, and we do not use advertising, remarketing or conversion-tracking pixels of any kind.
5. Purposes and Legal Bases
| Purpose | Legal basis (where the GDPR or UK GDPR applies) |
|---|---|
| Processing and fulfilling your order, and communicating with you about it | Performance of a contract, Article 6(1)(b) |
| Passing your delivery details to Ukrposhta so your parcel can be delivered | Performance of a contract, Article 6(1)(b) |
| Processing your card payment through Monobank | Performance of a contract, Article 6(1)(b) |
| Answering your questions by email or WhatsApp before you order | Steps prior to a contract, Article 6(1)(b), or our legitimate interest in replying to enquiries, Article 6(1)(f) |
| Keeping accounting and tax records | Legal obligation, Article 6(1)(c) |
| Protecting the website against attacks, blocking malicious requests, protecting the login page | Legitimate interest in a secure website, Article 6(1)(f) |
| Measuring how the shop is used with Google Analytics | Your consent, Article 6(1)(a). For visitors in the EEA, the United Kingdom and Switzerland, consent is requested through the banner described in Section 9 before any analytics cookie is set. |
6. Payment
Card payments are processed by Monobank (Universal Bank JSC, Ukraine) through its Plata by mono payment service and its authorised partners. When you pay, you are handed over to Monobank’s own secure payment page. We never see and never store your card number, expiry date or security code. We receive only the information we need to reconcile the order: whether the payment succeeded, the amount, and a payment reference.
Prices in this shop are shown in US dollars. Because the payment is collected in Ukraine, your card is charged in Ukrainian hryvnia (UAH) at the exchange rate applied by your card network and your bank; your bank may add a currency conversion or foreign transaction fee. Monobank processes your payment data as an independent controller under its own privacy terms: https://monobank.ua/en/documents.
7. Shipping
Orders are shipped with Ukrposhta (the national postal operator of Ukraine). To send your parcel we pass on your name, delivery address, country, and — where the destination requires it — your telephone number and email address. This information also appears on the customs declaration that must accompany every international postal shipment. Ukrposhta’s privacy policy: https://www.ukrposhta.ua/en/polityka-konfidentsiinosti.
8. Hosting, Email and Website Security
Hosting. This website is hosted by Hosting Ukraine LLC (adm.tools), a Ukrainian hosting provider. The physical servers used for this website are located in a data centre operated by Hetzner Online GmbH in Germany. The hosting provider processes personal data on our behalf, as our processor, only to operate the servers.
Email. Transactional email from the shop (order confirmations, replies from contact forms, password resets) is sent through the mail server of the same hosting provider. Order-related emails therefore pass through that provider’s mail infrastructure. They are sent from the address store@kunanets.art. If you want to write to us about an order, please use office@kunanets.art — that is the mailbox we read and answer.
Country detection. To decide whether the cookie banner described in Section 9 has to be shown, our server reads a two-letter country code that the hosting provider’s network adds to the incoming request. If that code is missing, the website instead checks the time zone that your browser reports. Both values are used only for that single decision, in memory, during that one request. Neither is stored, logged or passed on, and we do not use any third-party geolocation service.
Firewall. We use the security plugin Wordfence (Defiant, Inc., United States) in its self-hosted form: it runs on our own server, and blocking decisions are taken on our own server. Wordfence processes the IP address of every request, the requested address, and the browser identification in order to recognise and block attacks, to limit the number of failed login attempts, and to rate-limit abusive crawlers. Wordfence queries Defiant’s servers for malware and attack signature updates. Wordfence also reports blocked attacks back to Defiant, including the IP address of the blocking event and the attack pattern, so that the signature list improves for all users of the plugin. No order data and no customer data are transmitted, and none of it is used for advertising purposes. Legal basis: our legitimate interest in a website that stays online and uncompromised, Article 6(1)(f) GDPR.
9. Cookies, Browser Storage and Google Analytics
9.1 What is stored on your device
| Name | Set by | Purpose | Storage period | Category |
|---|---|---|---|---|
| woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_* | kunanets.art (our own domain) | Remembers the contents of your shopping cart and keeps your checkout session together. Set only once you put something in the cart. | Session, or up to 2 days for the session cookie | Strictly necessary |
| kun_consent | kunanets.art (our own domain) | Stores your answer to the cookie question, so you are not asked again. Stored both as a cookie and in your browser’s local storage. | 183 days (about six months) | Strictly necessary |
| _ga, _ga_<ID> | Google Analytics: distinguishes visitors and keeps session state so we can count visits and see which artworks are viewed. | Up to 2 years | Statistics — set only with consent where consent is required (see 9.2) |
We do not use advertising, remarketing or social media cookies. WooCommerce’s optional “order attribution”
feature, which would record how a customer found the shop, is switched off, so no sbjs_*
cookies are created.
9.2 How we ask for your consent, and where
Website statistics are collected with Google Analytics 4, integrated through the official WooCommerce extension “Google Analytics for WooCommerce”. We use Google Consent Mode v2.
If you are in the European Economic Area, the United Kingdom or Switzerland: nothing is measured and no analytics cookie is set until you agree. Before you answer, Google’s consent defaults for these regions are set to “denied” for analytics storage, advertising storage, advertising user data and advertising personalisation. A banner asks you whether Google Analytics may measure your visit. You can say no, and the shop works exactly the same either way. You can change your answer at any time through the “Cookie settings” link in the footer of every page; choosing “Decline” also deletes the Google Analytics cookies that are already on your device.
If you are outside those regions (this includes the United States, our largest market): no banner is shown and your visit is measured with Google Analytics from the start, which is the customary opt-out approach in those countries. You can object at any time and switch measurement off for yourself: open “Cookie settings” in the footer of any page and choose “Decline”. Your choice is remembered for 183 days and the existing Google Analytics cookies are deleted. You can also install Google’s browser add-on at tools.google.com/dlpage/gaoptout, or switch on “Do Not Track” or equivalent privacy settings in your browser.
Your answer to the cookie question is stored only in your own browser, under the name
kun_consent. It is not transmitted to us and not transmitted to any third party, and we do not
keep a record of consent decisions. We do not use a consent management platform.
9.3 What Google receives
Where measurement is active, Google Analytics 4 uses your IP address only to derive an approximate location and to protect the service; Google does not log or store the IP address itself in Google Analytics 4 reporting, and we have no access to it. Google Analytics then processes the pages you view, the artworks you look at, and events in the shop such as adding an item to the cart or completing an order, together with the order value and order number. This enables us to see which works attract interest. Google Analytics is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which may pass data to Google LLC in the United States. Google’s privacy policy: policies.google.com/privacy.
10. WhatsApp
Some pages of this website show a button labelled “Contact me” that links to WhatsApp, and the Contact page contains the same link. This is an ordinary link. No chat window, script or tracking code from WhatsApp or Meta is loaded into this website, and nothing about you is sent anywhere as long as you do not click it.
If you click the link, your browser or your WhatsApp app opens a conversation with us. From that moment on, your message and your telephone number are processed by WhatsApp Ireland Limited / Meta Platforms Ireland Limited under their own terms, over which we have no influence: whatsapp.com/legal/privacy-policy-eea. We see your WhatsApp display name, your telephone number and what you write to us. Please do not send payment card details or other highly sensitive information by WhatsApp. If you would rather not use WhatsApp, email office@kunanets.art instead — it reaches exactly the same person.
11. Recipients of Your Data
We do not sell personal data and we do not share it for advertising. Your data is disclosed only to:
- Monobank (Universal Bank JSC), Ukraine — payment processing
- Ukrposhta, Ukraine, and the postal or courier operator in your country that carries out the final delivery — delivery and customs clearance
- Hosting Ukraine LLC (adm.tools), Ukraine, with servers at Hetzner Online GmbH, Germany — hosting and outgoing email, as our processor
- Google Ireland Limited / Google LLC — website statistics, only where analytics is active as described in Section 9
- Defiant, Inc., United States — security signature updates for the Wordfence firewall, as described in Section 8
- WhatsApp Ireland Limited / Meta Platforms Ireland Limited — only if you choose to write to us on WhatsApp
- Our tax adviser and, where we are legally required to do so, public authorities and courts
12. International Transfers
We are based in Ukraine, so ordering from us always involves a transfer of your order and delivery data to Ukraine. Ukraine is not the subject of an adequacy decision of the European Commission. Transfers of your order data to us are nevertheless permitted because they are necessary for the performance of the purchase contract you enter into with us, and to take steps at your request before that contract (Article 49(1)(b) and (c) GDPR).
Google Analytics may involve a transfer of statistical data to the United States. Google LLC is certified under the EU–U.S. Data Privacy Framework and its UK Extension, so transfers to it take place on the basis of the European Commission’s adequacy decision of 10 July 2023; Google additionally relies on Standard Contractual Clauses. This only ever happens where measurement is active under Section 9, and you can prevent it entirely by declining analytics.
13. How Long We Keep Your Data
- Order, invoice and payment records: kept for as long as the accounting and tax law applicable to us in Ukraine requires us to keep them, and no longer than needed afterwards to deal with warranty claims or legal disputes. This is a legal obligation we cannot shorten at request.
- Delivery data: kept with the order record; the copy held by the postal operators is subject to their own retention periods.
- Enquiries that do not lead to an order (email, WhatsApp, contact messages): deleted once the matter is clearly finished and no follow-up is expected, unless we have to keep them as evidence.
- Cancelled or abandoned orders: deleted once they are no longer needed for accounting or fraud prevention.
- Server and firewall logs: kept only for a short period for security analysis and then overwritten.
- Google Analytics: event-level data is deleted automatically by Google after the retention period set in our property, which is at most 14 months.
- Your cookie choice: 183 days, in your own browser only.
14. Your Rights
Depending on where you live, you may have the right to ask us for a copy of the personal data we hold about you, to have it corrected, to have it deleted, to have our use of it restricted, to object to our use of it, to receive it in a portable format, and to withdraw a consent you have given. Withdrawing consent does not affect the lawfulness of what was done before. To exercise any of these rights, write to office@kunanets.art. We reply without undue delay and in any event within one month. There is no charge, and we will never make you use a form.
EEA, UK and Switzerland. You also have the right to lodge a complaint with a data protection supervisory authority — in the EU, the authority of your member state of residence, workplace or the place of the alleged infringement; in the United Kingdom, the Information Commissioner’s Office (ico.org.uk); in Switzerland, the Federal Data Protection and Information Commissioner.
United States. Where the law of your state gives you such rights, you may ask us to confirm what personal information we hold about you, to provide a copy, to correct it, or to delete it, and you may not be treated differently for asking. We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use it for targeted advertising or for profiling. The “Cookie settings” link in the footer of every page is the direct way to switch off analytics for yourself.
15. Automated Decision-Making
We do not use automated decision-making or profiling that produces legal effects for you or similarly significantly affects you. Orders are reviewed and accepted by a person.
16. Security
This website is served exclusively over an encrypted HTTPS connection, with HTTP Strict Transport Security enabled. Card payments take place on Monobank’s own systems, so card data never reaches this website. Access to the administration area is protected by strong passwords and by the Wordfence firewall described in Section 8. Software is kept up to date. No system can be made absolutely secure, but we take reasonable technical and organisational measures appropriate to the sensitivity of the data we hold.
17. Children
This website is intended for adults. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
18. Governing Law
This policy is governed by the laws of Ukraine. If you are resident in a country whose mandatory data protection law applies to our processing of your data, that law applies alongside Ukrainian law and this policy does not limit the rights it gives you.
19. Changes to This Policy
We update this policy when the way we work changes. The current version is always published on this page, with the date of the last update at the top.
20. Contact
FOP Kunanets Khrystyna Yaroslavivna
office@kunanets.art
+380 96 829 0922