Updated: 20 October 2026.

1. About this policy and contact details

This policy explains how personal data is processed when you use k-maysternja.com and cossack-workshop.com, contact the workshop or place an order. The data controller is sole proprietor Oleksii Oleksandrovych Lynnyk, trading as Козацька Майстерня (Cossack Workshop), Ukraine.

For personal-data questions, contact cossack.workshop@gmail.com or +380 96 572 93 83. Current contact channels are listed on our Contact page. This policy does not replace the terms governing orders, delivery or returns.

2. The data we process

To answer enquiries and fulfil orders: your name, telephone number, email address, recipient details, delivery city, address or branch/parcel locker, order details and status, correspondence and agreed personalisation requests. Engraving text, photographs or sketches are processed if you provide them for your order.

For payments and refunds: the amount, payment method and status, payment reference or confirmation, and details needed for an agreed refund. Do not send us complete payment-card details, CVV/CVC, banking passwords or one-time codes. Enter any information requested by a payment service directly on that service’s secure payment page.

The website may process technical data, including IP address, browser and device information, request times and addresses, service logs and cookie identifiers. If you create an account or submit a review, the relevant account details, display name and review content are processed. Do not include contact details or other information you do not want made public in a public review.

Provide only information needed for your enquiry or order. If an order is for another person, share their contact details only when you have an appropriate basis to do so, and inform them about this policy.

3. Purposes and legal bases

Data is used to agree and fulfil orders, communicate with customers, arrange payment and delivery, handle enquiries and returns, keep records, meet legal obligations and protect rights. The shop uses WordPress/WooCommerce. Products are delivered within Ukraine only.

Depending on the circumstances, processing is based on entering into or performing a transaction, taking steps you request before a transaction, meeting a legal obligation, or protecting legitimate interests such as website security and fraud prevention, unless your fundamental rights and freedoms override those interests. Where consent is required for a particular purpose, it must be voluntary and informed.

Making an enquiry or placing an order does not itself constitute consent to marketing messages. You can opt out of marketing using the method provided in the message or by contacting us. Service messages about an existing order are not marketing newsletters.

4. Who may receive data

To the extent necessary, data may be received by Nova Poshta for shipment handling and delivery; the bank or payment service involved in your selected payment or refund method; and providers of hosting, email and website technical support. The payment method and service depend on the options available for the particular order.

Staff and service-provider access must be limited to the data needed for their tasks. Data may be disclosed to competent authorities or other recipients when there is a legal basis for doing so. You can request information about recipients of your data using the contact details above.

5. Processing outside Ukraine

Delivery within Ukraine does not mean that all technical services or their servers are located in Ukraine. If a foreign provider is used for the website or communications, any transfer of personal data must meet Article 29 of Ukraine’s Law on Personal Data Protection and other applicable requirements.

This policy does not provide blanket consent to transfer data to any country. Contact us for information about specific recipients, processing locations and the applicable basis for a transfer.

6. Cookies and third-party services

Cookies and similar technologies may support the cart, session, account login and website preferences. You can delete or restrict cookies in your browser; blocking necessary cookies may prevent checkout or login.

Optional analytics, advertising or third-party embedded content may be subject to providers’ separate policies and consent requirements. Visiting the website or reading this policy does not replace any required consent. Where consent is required, it must be obtained separately before the relevant processing.

If you follow a link to a social network, messenger or another external website, that service processes data under its own policies. A link to an external resource does not make its policy part of this policy.

7. Retention and protection

Data must not be retained longer than needed for its processing purpose. Retention depends on order fulfilment, enquiries or returns, accounting and tax requirements, and the need to protect rights in a particular dispute. When the purpose and lawful grounds for retention no longer exist, data must be deleted, destroyed or anonymised as required by law.

Data protection requires organisational and technical measures proportionate to the risks, including access restrictions. No Internet transmission is entirely risk-free. This policy does not certify any particular security standard and does not limit statutory data-protection duties.

8. Your rights

Under Ukraine’s Law on Personal Data Protection, you have rights to know the sources, purposes and locations of processing and access conditions; obtain information about recipients and access your own data; make reasoned objections and request correction or destruction of inaccurate or unlawfully processed data; withdraw consent where processing is based on consent; and use statutory protections against unlawful processing and automated decisions with legal consequences.

Withdrawing consent does not remove a separate legal ground for retaining data, such as a record-keeping obligation. You may complain to the Ukrainian Parliament Commissioner for Human Rights or to a court.

9. How to make a request

Email cossack.workshop@gmail.com with the nature of your request, your name and a contact for the reply; include an order number if relevant. Access to your own personal data is free. Notarised document copies or utility bills are not a condition for making a request.

Before disclosing data, verification that the request concerns you may be necessary. This should use the minimum information proportionate to the request and confirmation through a contact channel already known to us. Formal access requests are also subject to Article 16 of the Law; if additional information required by law is needed, we will explain its purpose and how to provide it. Do not send passport copies, banking documents or other excessive documents with an ordinary enquiry.

For an access request, the law allows up to ten working days to determine whether it can be fulfilled and notify the requester; the request is fulfilled within thirty calendar days of receipt unless the law provides otherwise. Other requests are handled under their applicable statutory procedures and time limits.

10. Policy updates

The current version is published on this page with its update date. Changing this policy does not itself replace consent where consent is required for a new processing purpose.

Contact · Ukraine’s Law on Personal Data Protection · Rights and requests: guidance from the Ukrainian Parliament Commissioner for Human Rights