This policy explains what data the https://ularts.com website of the U.L. ARTS studio collects, why, who it is shared with, and how you can control it.
1. Who handles your data
Your data is handled by the sellers — the people you arrange a purchase with:
- for finished paintings — [site.yaml: sellers.ready.name], [site.yaml: sellers.ready.address];
- for commissioned paintings — [site.yaml: sellers.custom.name] (sole proprietor), [site.yaml: sellers.custom.address].
For any question about your data, write to studio@ularts.com.
[Юрист: нужен ли представитель в ЕС и Великобритании (ст. 27 GDPR и UK GDPR); если да — указать его здесь]
2. What data we receive
From the request form — only what you enter yourself:
- name, email, phone, messenger username and preferred ways to get in touch;
- country and shipping address (for a finished painting);
- the chosen painting or your idea for a commission, size, comment;
- the price and currency you saw, the language and country of the site, the page the request was sent from, and the time it was sent;
- if you have allowed analytics or advertising — the tags of the ad that brought you to the site (for example utm_source, gclid, fbclid).
Automatically when you visit the site:
- technical request data: IP address, browser and device type, country (derived from the IP address). We need these for the site to work and stay secure, and to show prices in your currency;
- your choice of language, country and cookie settings, if you made one (see the cookie policy);
- if you have allowed it — visit statistics and data for measuring ads (Google Analytics, Google Ads[, Meta, Pinterest, TikTok — оставить те, что будут подключены]).
We do not collect card details on the site and do not ask for special categories of data (health, religion and the like).
3. Why we use it and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Reply to your request and arrange a purchase or commission | request data | steps taken at your request before a contract (Art. 6(1)(b) GDPR) |
| Conclude and perform the contract: payment, shipping, certificate | request data, address | performance of a contract (Art. 6(1)(b) GDPR) |
| Accounting and tax records | sale data | legal obligation (Art. 6(1)(c) GDPR) |
| Running and protecting the site, showing prices in your currency | technical data | legitimate interests (Art. 6(1)(f) GDPR) |
| Visit statistics | analytics data | your consent (Art. 6(1)(a) GDPR) |
| Measuring and showing ads | advertising data and tags | your consent (Art. 6(1)(a) GDPR) |
The same bases apply under the UK GDPR, and under Article 11 of the Law of Ukraine "On Personal Data Protection". [Юрист: проверить основания по украинскому закону и законам ОАЭ и Саудовской Аравии]
We do not sell your data and do not make automated decisions about you that have legal effects.
4. Who we share data with
- Cloudflare, Inc. — hosting, protection against attacks, country detection.
- [Почтовый сервис] and Telegram — receiving requests. [Уточнить, когда будет подключена отправка заявок]
- Google (Google Tag Manager, Google Analytics, Google Ads) — only with your consent.
- [Meta, Pinterest, TikTok] — only with your consent to advertising.
- Shipping companies — [Nova Poshta, DHL, UPS…]: name, address and phone for delivery.
- Bank or payment service — [указать]: to receive payment.
- Public authorities — only where the law requires it.
5. International transfers
The sellers are based in Ukraine. If you live in the EU, the UK or another country, your request data is transferred to Ukraine, as this is necessary to reply to your request and perform the contract. [Юрист: основание передачи данных в Украину из ЕС и Великобритании — ст. 49(1)(b) GDPR или стандартные договорные условия]
Cloudflare and Google are based in the United States and process data under the EU Standard Contractual Clauses [и/или EU–US Data Privacy Framework — проверить].
6. How long we keep data
- requests that did not lead to a purchase — [12 months] after the last message;
- sale records and related correspondence — [срок по налоговому законодательству Украины];
- your language and country choice — 1 year; your cookie choice — 180 days;
- analytics and advertising data — according to the settings of those services [например, 14 месяцев в Google Analytics].
7. Your rights
You can:
- find out what data we hold about you and get a copy;
- correct inaccurate data;
- ask us to erase your data or restrict its use;
- object to processing based on legitimate interests;
- receive your data in a portable format;
- withdraw consent to analytics and advertising at any time via the "Cookie settings" link at the bottom of the page. This does not affect processing before the withdrawal.
Write to studio@ularts.com — we will reply within one month. You also have the right to complain:
- in the EU — to the data protection authority of your country;
- in the UK — to the Information Commissioner's Office (ico.org.uk);
- in Ukraine — to the Ukrainian Parliament Commissioner for Human Rights;
- in the UAE and Saudi Arabia — to the national data protection authority. [Юрист: уточнить органы]
8. Visitors from the United States
We do not sell personal information. The site does not respond to "Do Not Track" browser signals as such, but it does respect the Global Privacy Control signal: if your browser sends it, analytics and advertising cookies stay off. You can also opt out manually via the "Cookie settings" link at the bottom of the page. [Юрист: нужны ли разделы по законам отдельных штатов]
9. Children
The site is not intended for children under 16, and we do not knowingly collect their data.
10. Security
The site works only over a secure connection (HTTPS). Only the sellers have access to requests.
11. Changes
A new version of this policy will be published on this page with a new date. We will tell people we are in correspondence with about significant changes.