Privacy Policy

and Personal Data Processing Policy of The Lace Online Store
Version dated 03.09.2026 · Applies to https://thelace.com.ua/ and its language versions

1. General Provisions

1.1. This Privacy Policy (the “Policy”) sets out the procedure for collecting, storing, using, and protecting the personal data of users (the “User,” “you”) of The Lace online store, operating at https://thelace.com.ua/, including its mobile and English-language versions, as well as related ordering channels (Telegram bot, Viber, and telephone support lines).

1.2. This Policy supplements the website’s Public Offer and forms an integral part thereof.

1.3. By using the website, placing an order, registering an account, or subscribing to the newsletter, the User confirms that they have reviewed the terms of this Policy and consent to the processing of their personal data under the terms specified herein.

1.4. If the User does not agree with the terms of this Policy, they must stop using the website and its services.

2. Personal Data Controller

2.1. The controller (owner) of personal data collected through thelace.com.ua is:
• Name: PE Kobernyk Alina Vitaliivna, tax code 3604201565
• Email for personal data inquiries: info@thelace.com.ua
• Email for partnership inquiries: partners@thelace.com.ua
• Support phone numbers: +38 067 252 52 03, +38 050 252 52 03, +38 063 252 52 03
• Stores: Gulliver Shopping Mall (Kyiv, 1a Sportyvna Square) and Riviera Shopping Mall (Odesa, 101a Pivdenna Road)

2.2. Hereinafter in this Policy, the controller is referred to as the “Website Administration” or “we.”

3. Terms and Definitions

• “Personal Data” means any information relating directly or indirectly to an identified or identifiable natural person.
• “Processing of Personal Data” means any operation or set of operations performed on personal data, including collection, recording, accumulation, storage, alteration, use, disclosure, anonymization, and destruction.
• “User” means a natural person who uses the website, including unregistered visitors, registered customers, and loyalty program members.
• “Cookies” means small text files stored in the User’s browser that enable the website and third-party services to recognize the device during repeat visits.
• “Third Parties” means partners, contractors, and services engaged in operating the website (delivery, payment, analytics, advertising, and mailings).

4. Personal Data We Collect

4.1. Data Provided Directly by the User
When an account is registered, an order is placed, a newsletter subscription is created, or support is contacted, we may collect:
• surname, first name, and patronymic;
• phone number;
• email address;
• delivery address and delivery service branch;
• account password (stored in encrypted form);
• the content of inquiries submitted through the feedback form, Telegram bot, Viber, or email.

4.2. Data Collected When Signing In Through Social Networks
The website supports sign-in and registration through Facebook and Google accounts. In such cases, we receive basic profile data from the relevant provider (name, email, and account identifier) to the extent the User authorized its transfer during authentication. We do not receive the password for the social network account.

4.3. Sign-In by Phone Number (One-Time Code)
For sign-in by phone number, we process the phone number and confirmation of the one-time password (OTP) sent by SMS or through a messenger service.

4.4. Order and Payment Data
Order history, the selected payment method, and transaction status are processed to perform the sale and purchase agreement. Card, Apple Pay, and Google Pay payments are processed through payment systems (Visa, Mastercard, Plata by mono, and other acquiring providers). The Website Administration does not receive or store full bank card details; such data is processed exclusively by the payment provider in accordance with the PCI DSS standard.

4.5. Technical Data Collected Automatically
When the website is viewed, the following data is collected automatically:
• IP address;
• browser type and version, operating system, and device type;
• date and time of access, pages viewed, and time spent on the website;
• referring page (referrer);
• cookie data and session identifiers.
This data is processed, among other means, through Google Tag Manager (container GTM-52D9GG), which manages the analytics tools connected to the website.

4.6. Advertising Technology Data (Meta/Facebook Pixel)
The website uses the Meta Pixel (Facebook Pixel), which records visitor actions (page views, adding products to the cart, and placing orders) to measure advertising effectiveness, conduct retargeting, and create lookalike audiences in Meta Ads. Data transmitted by the pixel is processed in accordance with the privacy policy of Meta Platforms, Inc.

4.7. Loyalty Program and Newsletter Subscription Data
If a User participates in the loyalty program or subscribes to the email newsletter (including to receive a subscription discount), we process their email address, purchase history, and newsletter interaction statistics (opens and clicks) to personalize offers.

5. Legal Bases for Processing Personal Data

Personal data is processed on the following legal bases:
• the User’s consent—for marketing communications, the use of analytics and advertising cookies, and sign-in through social networks;
• necessity for the performance of a contract—for processing and delivering an order, returning/exchanging goods, and providing access to the personal account;
• the legitimate interests of the Website Administration—to ensure website security, prevent fraud, and improve the service;
• compliance with a legal obligation—to provide data to public authorities in cases stipulated by Ukrainian law.

6. Purposes of Personal Data Processing

The User’s personal data may be used for the following purposes:
• identifying the User to place an order and enter into a distance sale and purchase agreement;
• processing and delivering orders, including transferring data to delivery services;
• providing access to the personal account and order history;
• providing feedback, including responding to inquiries and sending order status notifications;
• processing payments and confirming transactions;
• providing customer and technical support;
• sending, with consent, news, personalized offers, and information about discounts and promotions;
• conducting advertising activities, retargeting, and analysis of marketing campaign effectiveness;
• performing analytics, improving the website, and identifying and resolving technical issues;
• preventing fraud and ensuring transaction security;
• complying with the requirements of Ukrainian law.

7. Cookies and Similar Technologies

7.1. The website uses the following categories of cookies:
• essential (technical) cookies—which enable the cart, authentication, and basic website functionality;
• analytics cookies—which collect anonymized visit statistics through Google Tag Manager;
• advertising/marketing cookies—including the Meta Pixel, which are used to display relevant advertising and conduct retargeting.

7.2. Disabling cookies in the browser settings may restrict access to certain website features, particularly those requiring authentication.

7.3. The User may manage or delete cookies through their browser settings and may opt out of personalized advertising through their Google or Meta account settings.

8. Disclosure of Data to Third Parties

8.1. The Website Administration does not sell Users’ personal data. Data may be disclosed only to the following categories of third parties and only to the extent necessary to achieve the processing purpose:
• delivery services and postal operators—to deliver orders;
• payment systems and acquiring banks (including Apple Pay, Google Pay, and Plata by mono providers)—to process payments;
• IT infrastructure providers (hosting, the online store platform, and email distribution services)—to support the technical operation of the website;
• advertising and analytics platforms (Google and Meta)—to analyze visits and display advertising;
• Ukrainian public authorities—solely on the grounds and in accordance with the procedure established by law.

8.2. Certain services (Google and Meta) may process data on servers located outside Ukraine, including in countries outside the European Economic Area. In such cases, data is transferred subject to appropriate safeguards provided by the relevant service providers.

9. Personal Data Retention Period

9.1. Account data and order history are retained for the duration of the User’s account and for [period, for example: 3 years] after the User’s last activity or account deletion to comply with accounting and tax recordkeeping requirements.

9.2. Data obtained for marketing communications is processed until the User withdraws consent (unsubscribes).

9.3. Technical and analytics data (cookies) is retained for the lifespan of the relevant cookie as set by the analytics or advertising service provider.

10. User Rights

Under the Law of Ukraine “On Personal Data Protection,” and, for EU residents, also under the General Data Protection Regulation (GDPR), the User has the right to:
• obtain information as to whether their personal data is being processed and the conditions of such processing;
• access their personal data;
• request correction of inaccurate or outdated data;
• request deletion of personal data (the “right to be forgotten”), except where retention is required by law;
• withdraw previously given consent to data processing, including unsubscribing through the link in an email;
• object to the processing of data for direct marketing purposes;
• request restriction of processing or data portability—for EU residents;
• lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights or, for EU residents, with the competent data protection authority in their country.
To exercise these rights, the User may contact info@thelace.com.ua. We respond to inquiries within 30 calendar days of receiving the request.

11. Personal Data Security

11.1. The Website Administration implements organizational and technical measures to protect personal data against unauthorized access, loss, destruction, alteration, or disclosure, including traffic encryption (HTTPS), restricting staff access to data, and storing passwords in encrypted form.

11.2. If a personal data breach or unauthorized disclosure is identified, the Website Administration notifies the User and takes measures to minimize the consequences in accordance with applicable law.

12. Children’s Personal Data

The website is not intended for persons under 16 years of age. We do not knowingly collect minors’ personal data without the consent of their parents or legal representatives. If you become aware that a child has provided us with their data without such consent, please contact info@thelace.com.ua to request its deletion.

13. Links to Third-Party Websites

The website may contain links to social media pages (Instagram, Facebook, and Telegram) and other external resources. This Policy does not apply to such websites, and the Website Administration is not responsible for their data processing policies.

14. Changes to the Privacy Policy

14.1. The Website Administration may amend this Policy. A new version takes effect upon its publication on the website unless otherwise specified in the new version.

14.2. If material changes affect the scope or purpose of data processing, we will notify Users by posting a notice on the website and/or sending an email notification.

14.3. The current version of the Policy is always available at https://thelace.com.ua/en/privacy-policy/.

15. Contact Information

For all questions concerning this Policy and the processing of personal data, please contact:
• Email: info@thelace.com.ua
• Phone: +38 067 252 52 03