PRIVACY AND PERSONAL DATA PROCESSING POLICY

Individual Entrepreneur POLEVOY YEVGENIY MYKOLAIVYCH, registered in the Unified State Register of Legal Entities, Individual Entrepreneurs and Public Formations on August 9, 2017 (hereinafter the “Owner”), hereby establishes by this Policy the procedure for collecting, using, storing, transferring, and protecting the personal data of users and buyers of the website https://companygroupteam.com.

1. GENERAL PROVISIONS

1.1. This Privacy and Personal Data Processing Policy (hereinafter the “Policy”) is a public document that establishes the procedure for processing personal data when visiting the Site, creating an account, placing and fulfilling an Order, contacting customer support, subscribing to messages, or otherwise interacting with the Owner.

1.2. The Policy is drawn up in accordance with the Constitution of Ukraine, the Civil Code of Ukraine, the laws of Ukraine “On Personal Data Protection,” “On Information,” “On Electronic Commerce,” “On Electronic Communications,” and other regulatory acts of Ukrainian legislation.

1.3. The Policy applies to the website https://companygroupteam.com and its pages, order forms, personal account, electronic messages, and agreed communication channels of Company Group Team.

1.4. The Policy is an integral part of the Public Offer Agreement in cases where data processing is related to the conclusion or performance of a sales contract. In case of conflict, mandatory provisions of legislation shall prevail.

1.5. Providing the data necessary for placing and fulfilling the Order is a condition for concluding and performing the relevant contract. Failure to provide such data may prevent the placement, payment, delivery, return, or warranty service of the Product.

2. BASIC TERMS

2.1. Personal data - information or a set of information about an identified or identifiable natural person.

2.2. Processing of personal data - any action or set of actions involving personal data, including collection, registration, accumulation, storage, adaptation, modification, updating, use, transfer, anonymization, and destruction.

2.3. Data subject - a user of the Site, Buyer, recipient of the Product, applicant, or other natural person whose personal data is being processed.

2.4. Personal data owner - Individual Entrepreneur POLEVOY YEVGENIY MYKOLAIVYCH, who determines the purpose of processing, the scope of data, and the procedures for its processing.

2.5. Personal data processor - a person or service that processes personal data on behalf of and under the instructions of the Owner within the defined purpose.

2.6. Cookies - small text files or similar technologies that are stored on the User’s device or read from it for the operation of the Site, security, analytics, personalization, or advertising.

2.7. Site, Buyer, Consumer, Product, Order, and Carrier are used in the meanings set forth in the Public Offer Agreement.

3. INFORMATION ABOUT THE PERSONAL DATA OWNER

3.1. Owner: Individual Entrepreneur POLEVOY YEVGENIY MYKOLAIVYCH.

3.2. Date of state registration: 09.08.2017. Tax ID: 3043706435 

3.3. Correspondence and contact address: 02091, Kyiv, “Vesna” Garden Association (Darnytskyi district), 192 Sadova St., Building 31a

3.4. Email for personal data inquiries: cgt.support.team@gmail.com

3.5. Telegram customer support: @cgt_support. Inquiries regarding the exercise of personal data rights are recommended to be sent to the official email address provided in Section 3.4.

4. CATEGORIES AND SOURCES OF PERSONAL DATA

4.1. The Owner may process data that an individual provides voluntarily: name, surname, patronymic (if any), phone number, email, password, or other account data; city, address, or delivery branch/parcel locker number; recipient data; comment on the Order; and selected method of communication.

4.2. The following information about the Order is processed: number, date, contents, and cost; discounts; payment method; payment status without full payment card details; delivery method and status; returns; exchanges; warranty and claims inquiries.

4.3. While using the Site, the following may be automatically collected: IP address, browser type and version, device and operating system type, language, time zone, approximate location at the country or city level, referral source, viewed pages, session identifiers, cookie identifiers, date, time, and duration of interaction, error and security logs.

4.4. When contacting support, the content of the correspondence, contact data, provided photos, videos, documents, and other materials necessary for reviewing the inquiry are processed. The Owner does not request data that is obviously unnecessary for the relevant purpose.

4.5. When voluntarily subscribing to news, the email or other provided contact, information about consent, its date, source, and withdrawal are processed.

4.6. If the Buyer provides the data of another recipient, they confirm that they have a lawful basis to transfer such data and have informed the recipient of its use for delivery and communication regarding the Order.

4.7. The Owner does not intentionally collect special categories of data regarding health, biometric data, political or religious beliefs, or other sensitive data unless their processing is directly necessary and lawful in a specific situation.

5. PURPOSE AND LEGAL BASIS OF PROCESSING

5.1. For preparing, concluding, and performing the contract, data is processed for the purposes of account registration, placing and confirming the Order, payment, assembly, delivery, communication, returns, exchanges, warranty service, and claims resolution.

5.2. To fulfill obligations established by law, data is processed for accounting and tax purposes, issuance of payment documents, review of consumer inquiries, fulfillment of lawful requirements of state authorities, and other mandatory procedures.

5.3. Based on the Owner’s legitimate interest, data may be processed to ensure information security, prevent fraud and abuse, maintain internal statistics, improve the operation of the Site, establish, exercise, and protect legal claims, provided that the individual’s interests or fundamental rights do not override such interest.

5.4. Based on separate consent, promotional mailings, personalized advertising, and the use of non-essential analytical or advertising cookies may be carried out. Consent must be voluntary, specific, informed, and unambiguous.

5.5. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal, nor does it terminate processing that remains necessary to fulfill the contract, comply with legal requirements, or protect the rights of the Owner or other persons.

5.6. Data is not processed in a manner incompatible with the defined purpose. For a new purpose incompatible with the original, the Owner shall determine a separate lawful basis and, where required by law, obtain new consent.

6. PLACING THE ORDER, PAYMENT, AND DELIVERY

6.1. The online store may use e-commerce, hosting, account, and technical support platform services. Such services receive only the data necessary for the technical operation of the Site and fulfillment of the Order.

6.2. Payment by bank card is carried out on a secure page of the bank or payment provider, including through the Plata by mono service, if this method is available during checkout. The Owner does not receive or store the full card number, its expiration date, or the CVV/CVC code; it may receive the payment status, amount, time, transaction identifier, and limited masked data.

6.3. For delivery, the recipient’s data, phone number, selected settlement, address, or branch/parcel locker number, and shipment information are transmitted to the relevant Carrier, including LLC Nova Poshta, if selected by the Buyer.

6.4. The bank, payment provider, and Carrier may act as independent data controllers within the scope of their own operations and process data in accordance with their policies and legal requirements.

7. COOKIES AND SIMILAR TECHNOLOGIES

7.1. The Site may use necessary, functional, analytical, and advertising cookies, local browser storage, pixels, tags, and similar technologies.

7.2. Necessary cookies ensure the operation of the shopping cart, Order placement, authorization, language selection, settings retention, load balancing, security, and fraud prevention. Without them, certain Site functions may not work.

7.3. Non-essential analytical and advertising cookies must be used only after consent is provided, if consent is required by law. The User must be able to reject or change their choice without losing access to the Site’s core functions.

7.4. The User can manage cookies using the cookie banner and browser settings. Deleting or blocking necessary cookies may affect the operation of the shopping cart, authorization, and Order placement.

7.5. The duration of cookies is determined by their purpose: session cookies are deleted after the session ends, persistent cookies are stored until the specified period expires, consent is withdrawn, or the User deletes them.

8. PERSONAL DATA RECIPIENTS AND PROCESSORS

8.1. Data may be transferred only to the extent necessary for the relevant purpose: to Carriers; banks and payment providers; e-commerce and hosting platform providers; CRM, email, telephone, and messenger services; analytics, advertising, cybersecurity, and technical support providers; accountants, auditors, and legal advisors.

8.2. Data may be provided to state authorities, courts, law enforcement, and other authorized bodies exclusively on a lawful basis, within the scope of their authority, and in the manner prescribed by law.

8.3. Processors receive access only to the data necessary for the assigned function and must ensure its confidentiality, security, and use in accordance with the contract and legislation.

8.4. The Owner does not sell personal data or provide it to an undefined circle of persons. Data transfer in connection with reorganization or business transfer is permitted only on a lawful basis, while maintaining the purpose of processing and proper protection of the data subjects’ rights.

9. INTERNATIONAL DATA TRANSFER

9.1. Certain platform, hosting, analytics, advertising, email, or technical support providers may locate infrastructure or personnel outside Ukraine. In connection with this, data may be processed or transferred in other countries.

9.2. International transfer is carried out only if there is a lawful basis and if the conditions prescribed by Ukrainian legislation are met, taking into account the level of data protection in the relevant country, the need to fulfill the contract, the individual’s consent, or other permissible safeguards.

9.3. The Owner takes reasonable measures to select reliable providers and limit the volume of transferred data. 

10. RETENTION AND DELETION PERIODS

10.1. Personal data is retained no longer than necessary for the purpose of processing, contract performance, warranty obligations, compliance with accounting, tax, and other legislation, dispute resolution, and the protection of rights.

10.2. Data about Orders, payments, returns, and payment documents is retained for the periods established by law for the relevant documents and transactions.

10.3. Contacts for promotional messages are processed until consent is withdrawn, the user unsubscribes, or the relevant channel ceases, unless there is another lawful basis for retaining separate evidence of the provision or withdrawal of consent.

10.4. Correspondence, claims, and documents regarding returns and warranties are retained for the duration of the inquiry review and for the periods necessary to establish, exercise, or protect legal claims.

10.5. After the retention period expires, data is deleted, destroyed, or anonymized unless another lawful basis for further processing exists. Backups may be deleted within the established backup cycle.

11. PERSONAL DATA PROTECTION

11.1. The Owner applies legal, organizational, and technical protection measures, taking into account the nature of the data, risks, processing method, and available technologies.

11.2. Measures may include access control, the use of unique accounts and passwords, secure connections, backups, software updates, event logging, confidentiality obligations under contract, and access control for employees and contractors.

11.3. Access to personal data is granted only to persons who need it to fulfill their official or contractual duties. Such persons are obliged to maintain confidentiality.

11.4. No method of data transfer or storage ensures absolute security. In the event of an incident, the Owner takes measures to stop it, minimize its consequences, and fulfill notification obligations, if provided for by law.

12. RIGHTS OF THE DATA SUBJECT

12.1. The data subject has the rights provided for by Article 8 of the Law of Ukraine “On Personal Data Protection,” including the right to know the sources of collection, the location of the data, the purpose of its processing, the Owner, and the processors; to receive information about the conditions of access; to access their data and receive information about its processing.

12.2. The individual has the right to submit a reasoned request objecting to processing, demand the modification or destruction of data if it is processed unlawfully or is inaccurate, withdraw consent, know the mechanism of automated processing, and protect themselves against an automated decision that has legal consequences for them.

12.3. The individual has the right to file complaints with the Ukrainian Parliament Commissioner for Human Rights or with a court, and to use other means of legal protection.

12.4. To exercise these rights, an inquiry must be sent to cgt.support.team@gmail.com, stating the individual’s full name, the substance of the request, and sufficient information to identify the applicant and the relevant data. The Owner may request additional information to verify the individual’s identity and prevent unlawful access.

12.5. Inquiries are reviewed within the timeframes and in the manner established by Ukrainian legislation. If the request cannot be satisfied, the applicant is provided with a reasoned response in the cases and manner prescribed by law.

13. PROMOTIONAL AND SERVICE MESSAGES

13.1. Service messages regarding Order placement, payment, delivery, returns, account security, and other matters related to Order fulfillment are not promotional and may be sent to the contacts provided by the Buyer.

13.2. Promotional messages about new products, promotions, special offers, and CGT’s activities are sent with separate consent or on another lawful basis, with the option to opt out through any available channel.

13.3. Unsubscribing from promotional messages does not stop the delivery of service messages necessary to fulfill an active Order or contract.

14. CHILDREN’S DATA AND THIRD-PARTY DATA

14.1. The Site is not specifically intended for the systematic collection of personal data from minors. If the law requires parental, adoptive, guardian, or caregiver consent to conclude a specific contract, such consent must be obtained before placing the relevant Order.

14.2. If the Owner reasonably determines that a child’s data was provided without the necessary lawful basis, it will take measures to stop its processing and delete it, unless retention is required by law.

15. THIRD-PARTY SITES AND COMMUNICATION CHANNELS

15.1. The Site may contain links to third-party resources, social networks, payment services, Carrier websites, and messengers. Their owners independently determine the procedure for processing data, so the User is recommended to review their respective privacy policies.

15.2. Communication through Telegram, Instagram, Facebook, TikTok, YouTube, and other third-party platforms is also governed by the rules of the respective platform. The Owner is responsible for its own use of data received through such channels but does not control the technical processing carried out by the platform owner.

16. CHANGES TO THE POLICY

16.1. The Data Controller may update the Policy due to changes in legislation, the Website’s functionality, the range of services, or processing procedures. The new version applies from the date specified at the beginning of the document and is published on the Website.

16.2. Material changes affecting the purpose of processing, the rights of individuals, or the use of previously collected data will be communicated in an appropriate manner. If consent is required for the new processing, the Data Controller will obtain it before such processing begins.

16.3. Users are advised to periodically review the current version of the Policy. Changes are not retroactive unless otherwise provided by law or separately agreed with the individual.

17. FINAL PROVISIONS

17.1. The laws of Ukraine govern relations related to the processing of personal data.

17.2. If any provision of the Policy is found to be invalid, this does not affect the validity of the other provisions. The relevant provision of law shall apply in its place.

17.3. Inquiries and requests regarding privacy, access, data rectification, deletion, or withdrawal of consent should be sent using the contact details provided in Section 3.