I. Basic provisions

Substantive provisions

1. The administrator of personal data pursuant to Article 4 point 7 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter: “GDPR”) is LUNATOYS ( hereinafter: “Administrator”).

2. The contact details of the data controller can be found in Ukraine, Lviv Oblast, Truskavets, ul. Sahaidachnoy 18/32

3. Personal data means any information relating to an identified or identifiable natural person; An identifiable natural person is a natural person who can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, a network identifier or to one or more specific physical, physiological or genetic, mental, economic characteristics , cultural or social identity of that natural person.

4. The administrator has not appointed a data protection officer.

II. Sources and categories of personal data processed

1) The Administrator processes personal data that you have provided to him or personal data that the Administrator received as part of the execution of your order.

The administrator processes your identification and contact data as well as the data required to fulfill the contract.

III. Legal justification and purpose of processing personal data

1. The lawful ground for processing personal data is

- Fulfillment of the contract between the user and the person responsible in accordance with Art. 6 Section 1 Letter b) GDPR,

- the legitimate interest of the administrator in the provision of direct marketing (in particular for the purpose of sending commercial information and newsletters) in accordance with Art. 6 Section 1 Letter f) GDPR,

2. The purpose of processing personal data is:

- Execution of your order and exercise of rights and obligations arising from the contractual relationship between you and the administrator; When placing an order, personal data is required that is necessary for the effective processing of the order (first and last name as well as address, contact details), whereby the provision of personal data is a necessary prerequisite for the conclusion and implementation of the contract without the provision personal data is required if the administrator is unable to conclude or execute the contract,

- Sending commercial information and other marketing activities.

3. An automatic individual case decision by the administrator within the meaning of Art. 22 GDPR.

VI. Duration of data storage

1) The data controller stores personal data

- for the period necessary to exercise the rights and obligations arising from the contractual relationship between you and the administrator and to assert claims arising from this contractual relationship (for a period of 15 years from the end of the contractual relationship).

- for a period until the withdrawal of consent to the processing of personal data for marketing purposes, but not longer than 15 years if personal data is processed on the basis of consent.

2. After the storage period has expired, the administrator deletes the personal data.

V. Recipients of personal data (subcontractors of the Administrator)

1) Recipients of personal data are natural persons

- are involved in the delivery of goods/services/payment processing under the contract,

- provision of services related to the operation of an online store and other services related to the operation of an online store,

- Providing services in the area

2) The Administrator intends to transfer personal data to a third country (non-EU country) or to an international organization. Recipients of personal data in third countries are shipping service providers.

VI. User rights

1. Under the conditions stated in the GDPR, you have

- the right to information about your personal data in accordance with Art. 15 GDPR,

- the right to rectification of personal data in accordance with Art. 16 GDPR or restrictions on processing in accordance with Art. 18 GDPR.

- the right to delete personal data in accordance with Art. 17 GDPR.

- the right to object to data processing in accordance with Art. 21 GDPR; And

- the right to data portability in accordance with Art. 20 GDPR.

- the right to withdraw consent to data processing in writing or electronically to the address or email address of the administrator specified in Article 1. III of these General Terms and Conditions.

2. You also have the right to lodge a complaint with the Office for Personal Data Protection if you believe that your data protection rights have been violated.

VII. Conditions for the security of personal data

1. The Administrator declares that he has taken all appropriate technical and organizational measures to protect personal data.

2. The Administrator has taken technical measures to secure data storage and store personal data in paper form.

3. The Administrator declares that only persons authorized by him have access to personal data.

VIII. Use of personal data by other companies.

This website uses third-party online services that collect information independently of us: Google Analytics, Google AdSense, Facebook.com, Shopify.

The data collected may be shared with other companies within these organizations and used to personalize ads within their own advertising network. You can read these organizations' user agreements on their websites. You can also object to the collection of personal data here; for example, you can find the Google Analytics blocker here. We do not transfer personal information to other organizations and services not listed in this Privacy Policy. The only exception is the provision of information in accordance with the legal requirements of state authorities authorized to carry out these activities.

IX. Final provisions

1) By placing your order in the online order form, you confirm that you have read the data protection declaration and accept it completely.

2. You agree to these Terms and Conditions by ticking the consent box in the online order form. By ticking the consent box, you confirm that you have read the data protection declaration and accept it in full.

3) The administrator has the right to change these provisions. The new version of the Privacy Policy will be posted on the Website and sent to the email address that you have provided to the Administrator.


These Terms and Conditions come into effect on February 12, 2024