PRIVACY POLICY

Last Updated: Sep 2026

Kateryna Chernetska (“we”, “us”, “our”) operates the website katerynachernetska.com (the “Website”). We are committed to protecting the privacy and personal data of our customers and visitors in accordance with the EU General Data Protection Regulation (GDPR) and the Dutch GDPR Implementation Act (Uitvoeringswet Algemene verordening gegevensbescherming - UAVG).This Privacy Policy outlines what personal data we collect, why we process it, how it is handled, and your statutory rights regarding your information.

1. DATA CONTROLLER INFORMATION

The data controller responsible for processing your personal data is a sole proprietorship (eenmanszaak) registered in the Netherlands:

Business Name: Kateryna Chernetska
Operator / Owner: Kateryna Chernetska
Registered Address: Schubertlaan 43, 2324CN, Leiden, The Netherlands
Contact Email: info@katerynachernetska.com
Chamber of Commerce (KvK) No: 42076327
VAT (BTW) No: NL005475687B31

For any privacy-related queries, please contact us directly at info@katerynachernetska.com

2. CATEGORIES OF PERSONAL DATA COLLECTED

In accordance with the data minimization principle (Art. 5(1)(c) GDPR), we collect only the data necessary to operate our digital storefront, fulfill orders, and communicate with you:

Order & Shipping Information: Name, billing address, shipping address, email address, phone number, and purchased items.
Direct Enquiries: Name, email address, and any correspondence history when you contact us directly.
Newsletter Data (where applicable): Email address and timestamp of your explicit consent.
Technical & Website Metadata: IP address, browser type, device details, and general site interaction data collected automatically via platform cookies (Squarespace) and analytics tools.
Financial & Payment Data: All payment processing is handled externally by certified payment service providers and integrated platform processors (including Squarespace Payments and PayPal). We do not collect, view, or store sensitive credit card numbers or banking credentials on our servers.
Note on Minors: Our Website is not intended for children under 16 years of age, and we do not knowingly collect personal data from minors.

3. LEGAL BASES AND PURPOSES OF PROCESSING

Pursuant to Article 6 of the GDPR, we process your personal data under the following legal grounds:

Order Fulfillment & Customer Service:

  • Purpose: To process transactions, ship artwork, send order updates, and address customer queries.

  • Legal Basis: Performance of a contract (Art. 6(1)(b) GDPR).

Tax & Legal Compliance:

  • Purpose: To maintain proper financial accounts and fulfill legal record-keeping obligations under Dutch law.

  • Legal Basis: Legal obligation (Art. 6(1)(c) GDPR).

Marketing Communications:

  • Purpose: To send newsletters or collection updates (only if requested).

  • Legal Basis: Explicit consent (Art. 6(1)(a) GDPR). You may unsubscribe at any time.

Website Analytics & Functionality:

  • Purpose: To analyze traffic patterns and enhance user experience.

  • Legal Basis: Explicit consent (Art. 6(1)(a) GDPR) granted via our cookie consent banner.

Security & Fraud Prevention:

  • Purpose: To maintain platform stability and protect our store against illegal activity.

  • Legal Basis: Legitimate interest (Art. 6(1)(f) GDPR).

4. DATA RETENTION PERIODS

We store personal data only for as long as necessary to fulfill the operational purposes for which it was collected or to comply with statutory retention mandates:

Transactional & Invoicing Data: Retained for 7 years to comply with statutory fiscal obligations under Dutch tax law (Art. 52 Algemene wet inzake rijksbelastingen).
Customer Enquiries: Retained for up to 2 years following the final communication, unless related to a pending transaction or legal matter.
Newsletter Subscriptions: Retained until you withdraw consent or unsubscribe.
Analytics Data: Retained for up to 26 months, according to standard tool configuration.

5. DATA SHARING & THIRD-PARTY SERVICE PROVIDERS

We do not sell, rent, or trade your personal data. Data is shared exclusively with necessary service providers (Data Processors or independent Controllers) bound by strict confidentiality and compliance standards:

Hosting & Platform Provider: Squarespace Inc. / Squarespace Ireland Ltd.
Payment Processors: Stripe, PayPal, iDEAL (independent controllers for payment execution).
Logistical Carriers: Shipping services (e.g., PostNL, DHL, FedEx) to deliver your order.
Professional Advisors & Tax Authorities: Qualified bookkeepers and the Dutch Tax Office (Belastingdienst) as legally required.
International Transfers: Where data is transferred outside the European Economic Area (EEA) — such as to service infrastructure in the United States — transfers are safeguarded using EU Standard Contractual Clauses (SCCs) or under the EU-U.S. Data Privacy Framework.

6. COOKIES

Our Website utilizes cookies to manage shopping cart state, maintain platform security, and analyze site performance. Essential cookies required for storefront functioning are placed automatically. Non-essential analytical or marketing cookies are suppressed by default and placed only with your explicit opt-in consent via our cookie banner (Art. 11.7a Telecommunicatiewet).

You can change or withdraw your consent at any time by clicking the "Cookie Preferences" link in the footer of our Website. For a detailed breakdown of all cookies we use, their duration, and purpose, please review our full Cookie Policy.

7. YOUR RIGHTS UNDER THE GDPR

Under Articles 15–22 of the GDPR, you hold the following rights regarding your personal data:

Access: Request a copy of the personal data we hold about you.
Rectification: Request correction of inaccurate or incomplete data.
Erasure ("Right to be Forgotten"): Request deletion of your personal data (subject to legal fiscal retention rules).
Restriction: Request restriction of processing under certain conditions.
Objection: Object to data processing based on legitimate interests or for direct marketing.
Data Portability: Request transfer of your data to another organization.
Withdraw Consent: Withdraw consent for marketing or cookies at any time without affecting prior lawful processing.

To exercise any of these rights, please contact us at info@katerynachernetska.com. We will respond within one (1) month. If a request is exceptionally complex, this period may be extended by an additional two months as permitted under Art. 12(3) GDPR.

You also have the right to lodge a complaint with the Dutch Data Protection Authority:

8. DATA SECURITY

We employ SSL/TLS encryption across our entire Website and restrict administrative access strictly to authorized systems. While no internet transmission is completely immune, we maintain operational protocols to mitigate risks and will notify affected users and regulatory authorities promptly in the unlikely event of a reportable data breach (Art. 33 & 34 GDPR).

9. UPDATES TO THIS POLICY

We may update this Privacy Policy from time to time to reflect operational or regulatory adjustments. The revised version will be published on this page with an updated "Last Updated" date.