Privacy Policy
Updated 7 October 2026
Version of 07.10.2026. The Ukrainian text of this document prevails in case of discrepancy.
This Policy explains which personal data the Mia online shop (mia-chemistry.vercel.app) collects, for what purposes, with whom it is shared and what rights users have. It is drawn up in accordance with the Law of Ukraine "On Personal Data Protection" (the Law).
1. Data controller
Individual entrepreneur —, RNOKPP —, — (we, the Seller).
Personal data requests: —, —.
2. Data we collect
| When | Data |
|---|---|
| Placing an order (with or without registration) | recipient's first and last name, phone number, email, city, branch or parcel locker or delivery address, order contents, chosen payment and delivery method |
| Creating an account | email and/or phone number, first and last name, order history; no password is created — sign-in is confirmed with a one-time code |
| Verifying a phone number or email | one-time code, Telegram or Viber user identifier |
| Contacting us (phone, Telegram, Viber, email) | your contact details and the content of the message |
| Visiting the Site | technical data: browser and device type, language, pages viewed, referrer, approximate city-level location, cookie identifiers |
We do not collect or store bank card data: it is processed by the bank through which payment is made (section 4).
3. Purposes and legal bases
| Purpose | Legal basis (Article 11(1) of the Law) |
|---|---|
| Accepting, paying for and delivering an order, communication about the order, exchange and return | conclusion and performance of a transaction (item 3) |
| Maintaining an account and order history | conclusion and performance of a transaction (item 3); consent (item 1) |
| Order status notifications via Telegram, Viber or email | conclusion and performance of a transaction (item 3) |
| Accounting and tax records, issuing settlement documents | performance of an obligation provided by law (item 5) |
| Visit statistics and improving the Site | the Seller's legitimate interest (item 6); you may object to this processing (section 7) |
| Fraud prevention, handling claims and disputes | the Seller's legitimate interest (item 6) |
We do not send marketing mailings. If such mailings are introduced, they will be sent only with separate consent that can be withdrawn at any time.
4. Recipients of data
Data is shared only to the extent needed for the specific purpose.
| Recipient | What is shared | Why |
|---|---|---|
| Nova Poshta LLC (TOV "NOVA POSHTA"), EDRPOU 31316718, 103 Stolychne Shose, bldg 1, Kyiv 03026 | first and last name, phone, city, branch or parcel locker or address, declared value of the shipment | delivery of the order, cash on delivery |
| NovaPay LLC (TOV "NovaPay"), EDRPOU 38324133 | cash-on-delivery amount, shipment number | money transfer for cash-on-delivery payments |
| JSC "UNIVERSAL BANK" (monopay service), EDRPOU 21133352 | order number and amount, list of goods; you enter card data on the bank's page | online card payment |
| Telegram Messenger Inc. | your Telegram identifier, message content | verification codes, order notifications, correspondence |
| Viber Media S.à r.l. (Luxembourg) | your phone number or Viber identifier, message content | verification codes, order notifications, correspondence |
| Google LLC (Google Analytics 4) | technical visit data without name, phone or email; Google Analytics 4 does not store IP addresses | visit statistics |
| Vercel Inc. (USA) | data processed by the Site during your visit | website hosting |
| Railway (railway.com) | orders and accounts database, product images | server and database hosting |
Data is disclosed to public authorities only in cases expressly provided by law (for example, at the request of a court).
Some recipients process data outside Ukraine. The transfer is made to perform the contract with you and on the basis of your unambiguous consent (Article 29(4), items 1 and 2 of the Law). Viber Media S.à r.l. is registered in Luxembourg, a European Economic Area state recognised as providing adequate personal data protection (Article 29(3) of the Law).
5. Cookies and analytics
- Essential cookies: session, cart, interface language, account sign-in. The Site does not work without them.
- Analytics: Google Analytics 4 (gtag.js). Page view, search, add-to-cart and checkout events are collected. IP addresses are not stored; data is retained for 14 months. You can disable collection in your browser settings or with the Google Analytics Opt-out add-on.
- We do not use advertising cookies and do not share data with advertising networks.
6. Retention periods
| Data | Period |
|---|---|
| Orders and settlement documents | 3 years after the order is fulfilled (the retention period for primary documents set by the Tax Code of Ukraine); in case of a dispute, until it is resolved |
| Account | until deleted at your request or 3 years after the last sign-in |
| Verification codes | until used, but no longer than 24 hours |
| Notification log (Telegram, Viber, email) | 12 months |
| Enquiries and claims | 3 years |
| Analytics data (Google Analytics 4) | 14 months |
After the period expires, data is deleted or anonymised (Article 15 of the Law).
7. Your rights (Article 8 of the Law)
You have the right to:
- know which data we process, for what purpose and with whom we share it;
- access your data and obtain a copy — we reply no later than 30 calendar days after receiving the request;
- demand correction of inaccurate data or deletion of data processed unlawfully;
- object to processing, including analytics;
- withdraw consent — this does not affect the lawfulness of processing before withdrawal;
- know the mechanism of automated data processing; we do not make automated decisions with legal effects;
- lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua) or with a court.
To exercise your rights, write to — from the address or number stated in your account or order. You can also delete your account in the "Profile" section.
8. Data security
Data exchanged between your browser and the Site is encrypted (HTTPS). Customer accounts have no passwords: sign-in is confirmed with a one-time code sent via Telegram, Viber or email. Passwords of shop staff (admin panel) are stored only as cryptographic hashes. Order data is accessible only to the Seller and the employees who need it to process orders. Database backups are encrypted. The Seller personally ensures the protection of personal data in accordance with Article 24 of the Law.
9. Changes to this Policy
A new version is published on this page with its date. We notify registered users of material changes by email or messenger.
10. Contacts
Individual entrepreneur —
—
—, —