{"id":37797,"date":"2026-07-19T09:29:21","date_gmt":"2026-07-19T06:29:21","guid":{"rendered":"https:\/\/babywood.shop\/privacy-policy\/"},"modified":"2026-08-13T15:43:27","modified_gmt":"2026-08-13T12:43:27","slug":"privacy-policy","status":"publish","type":"page","link":"https:\/\/babywood.shop\/en\/privacy-policy\/","title":{"rendered":"Privacy Policy"},"content":{"rendered":"\n

Version of 12 August 2026<\/strong><\/p>\n\n

This policy explains what data we collect about you, why, who we share it with, and how long we keep it. We\u2019ve tried to describe what actually happens rather than rewrite someone else\u2019s template.<\/p>\n\n

It is written to comply with the Law of Ukraine “On Personal Data Protection” No. 2297-VI and with the EU General Data Protection Regulation (Regulation (EU) 2016\/679, GDPR) \u2014 the latter applies because we deliver orders to European Union countries.<\/p>\n\n

Who processes your data<\/h2>\n\n

The data controller is:<\/p>\n\n

Andrii Mihachov, private entrepreneur registered in Ukraine<\/strong>Taxpayer registration number 2898010290Data protection enquiries: legal@babywood.shop<\/strong>, telephone +380 (63) 180-38-79The controller\u2019s location and full details are in the “Company details” section of the Contacts<\/a> page.<\/p>\n\n

What data we collect<\/h2>\n\n

When you place an order:<\/strong> name and surname, telephone number, email address, delivery address, contents and total of the order.<\/p>\n\n

When you write via the contact form:<\/strong> name, email address, telephone number, company name (if you provide one) and the text of your message.<\/p>\n\n

Automatically, as you use the site:<\/strong> IP address, browser and device type, screen size, pages you opened, data from cookies (see the separate section), and how you behave on a page: clicks, scrolling, the order in which you moved through the site, and \u2014 in the shop \u2014 viewing a product, adding it to the basket, starting checkout and completing a paid order. This is collected by two analytics services, Google Analytics and PostHog \u2014 see “Who we share data with” and “Cookies” below.<\/p>\n\n

Session recording has been on since 12 August 2026.<\/strong> The analytics keeps a replay of your path through the site: the sequence of pages, cursor movement, clicks and scrolling, the content of the pages you saw, and technical messages from your browser. Recordings are kept for 30 days<\/strong>, after which they are deleted automatically.<\/p>\n\n

What the analytics does not collect:<\/strong> the text you type into fields. Your name, phone number, address and order note are masked in your browser, before anything is sent \u2014 they never reach a recording.<\/p>\n\n

One exception is worth naming plainly: on the order confirmation page your name, phone number and address appear as ordinary text rather than in input fields \u2014 there they do end up in the recording.<\/p>\n\n

What we don\u2019t collect:<\/strong> your payment card details. You enter them on the payment provider\u2019s secure page \u2014 they never reach us and we don\u2019t store them.<\/p>\n\n

Why, and on what legal basis<\/h2>\n\n
Purpose<\/th>Legal basis<\/th><\/tr><\/thead>
To place and fulfil your order and deliver the item<\/td>Performance of a contract to which you are party \u2014 Art. 11(1)(3) of Law 2297-VI, Art. 6(1)(b) GDPR<\/td><\/tr>
Accounting and tax records<\/td>Compliance with a legal obligation \u2014 Art. 11(1)(5), Art. 6(1)(c) GDPR<\/td><\/tr>
To answer your enquiry<\/td>Steps prior to entering into a contract \u2014 Art. 11(1)(3), Art. 6(1)(b) GDPR<\/td><\/tr>
To operate and secure the site<\/td>Legitimate interests \u2014 Art. 11(1)(6), Art. 6(1)(f) GDPR<\/td><\/tr>
To see how the site is used and fix what gets in the way<\/td>Legitimate interests \u2014 Art. 11(1)(6), Art. 6(1)(f) GDPR<\/td><\/tr>
To send news and offers<\/td>Your consent<\/strong> \u2014 Art. 11(1)(1), Art. 6(1)(a) GDPR<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

No separate consent is needed or requested for placing an order.<\/strong> The basis here is the contract itself: without your name, phone number and address the item cannot be delivered. Consent is needed only for what goes beyond fulfilling the order \u2014 chiefly the newsletter \u2014 and you can withdraw it at any time.<\/p>\n\n

Who we share data with<\/h2>\n\n

We share your data with processors acting on our instructions. The first three are needed for the order to happen at all; the last two show us what the site looks like from a visitor\u2019s side.<\/p>\n\n

WayForPay<\/strong> \u2014 payment service. When you pay by card, your name and surname, email, telephone, address, city, postcode, country, and the contents and total of your order are transmitted. This is needed to process the payment.<\/p>\n\n

Nova Poshta, Ukrposhta, Meest Express<\/strong> \u2014 carriers. Name, telephone and delivery address are transmitted. This is needed to get the parcel to you.<\/p>\n\n

Hostinger<\/strong> \u2014 the hosting provider whose servers run the site and relay our outgoing email. It has technical access to data stored on the site.<\/p>\n\n

Google Ireland Limited<\/strong> \u2014 the Google Analytics 4 service. It receives de-identified data about how the site is used: pages viewed, referral source, device and browser type, approximate location at country and city level, and shop events \u2014 viewing a product, adding it to the basket, starting checkout and completing a paid order together with its total and contents. Your name, phone number, email and delivery address are not<\/strong> passed to the service: an order is identified by its number alone. Google\u2019s advertising features (Google Signals) are switched off.<\/p>\n\n

PostHog, Inc.<\/strong> \u2014 a product analytics service. The project is hosted in the EU Cloud<\/strong> region, so the data is stored within the European Union. It receives the same signals: page views, clicks and element labels, shop events, and session recordings \u2014 with the contents of input fields masked. No separate profiles are created for anonymous visitors.<\/p>\n\n

We do not<\/strong> sell your data and do not pass it on for third-party advertising or marketing.<\/p>\n\n

International transfers<\/h2>\n\n

The site runs on a Hostinger server located in France<\/strong>, where the order database is also stored. The content delivery network that serves pages to visitors uses nodes in Lithuania<\/strong> \u2014 that is a cache of static pages, not a place where your data is stored. PostHog data is stored within the European Union<\/strong> \u2014 the project is hosted in the EU Cloud region. Google Analytics is the exception:<\/strong> the processor is Google Ireland Limited, but Google\u2019s infrastructure is global, so analytics data may be processed outside the EEA, including in the United States<\/strong>. The basis for that transfer is the standard contractual clauses within Google\u2019s data processing terms.<\/p>\n\n

Both countries are members of the European Union and therefore of the European Economic Area. Under Article 29(3) of Law 2297-VI, EEA states are recognised as providing an adequate level of data protection; no additional safeguards are required for such a transfer.<\/p>\n\n

If you order delivery outside Ukraine, the data needed to prepare an international shipment is passed to the carrier and to the customs authorities of the destination country in accordance with their rules.<\/p>\n\n

How long we keep data<\/h2>\n\n
What<\/th>How long<\/th><\/tr><\/thead>
Order data (name, contacts, address, contents)<\/td>3 years \u2014 the retention period for primary accounting documents under tax law<\/td><\/tr>
Copies of emails sent (order confirmations, notifications)<\/td>14 days<\/strong>, then deleted automatically<\/td><\/tr>
Messages sent via the contact form<\/td>For as long as the correspondence continues, then within mail logs for 14 days<\/td><\/tr>
Newsletter data<\/td>Until you withdraw consent<\/td><\/tr>
Server technical logs<\/td>Per the hosting provider\u2019s policy<\/td><\/tr>
Analytics visitor identifier (_ga<\/code>)<\/td>400 days<\/strong> (\u2248 13 months) \u2014 after that you are a new visitor to the service<\/td><\/tr>
Analytics data in Google Analytics<\/td>14 months<\/strong> \u2014 beyond that only de-identified aggregate reports remain<\/td><\/tr>
Session recordings<\/td>30 days<\/strong>, then deleted automatically<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

Once the relationship ends and the statutory retention periods expire, the data is deleted (Article 15 of Law 2297-VI).<\/p>\n\n

Cookies<\/h2>\n\n

Cookies are small files that a website stores in your browser.<\/p>\n\n

What we use as of 7 August 2026:<\/strong><\/p>\n\n

Technical<\/strong> \u2014 the site does not work without them:<\/p>\n\n

    \n
  • WooCommerce cookies<\/strong> \u2014 hold your basket contents and your session as you move around the site. Without them the basket would forget items on every page.<\/li>\n\n\n\n
  • Caching cookies<\/strong> \u2014 speed up page loading.<\/li>\n\n\n\n
  • Banner consent cookie<\/strong> \u2014 remembers that you\u2019ve already dismissed the cookie notice.<\/li>\n<\/ul>\n\n

    Analytics<\/strong> \u2014 these show us how the site is used:<\/p>\n\n

      \n
    • _ga<\/code>, _ga_VPMKHNCXE1<\/code><\/strong> \u2014 Google Analytics. The first tells visitors apart, the second holds the measurement session state; both live for 400 days<\/strong>. What exactly is collected is set out under “What data we collect”.<\/li>\n\n\n\n
    • ph_phc_qxbDGoBhRxpkFU3od42sbuMittkkE4xv5NhzPteUU3z5_posthog<\/code><\/strong> \u2014 PostHog. Holds the visitor identifier and session state, and lives for 365 days<\/strong>. The service mirrors the same record in your browser\u2019s local storage \u2014 it is cleared together with site data in your browser settings.<\/li>\n\n\n\n
    • sbjs_*<\/code><\/strong> \u2014 WooCommerce\u2019s built-in referral tracking: it remembers where you arrived from (search, social network, direct link) so that we can see it on the order.<\/li>\n<\/ul>\n\n

      There are no advertising cookies on this site.<\/strong> We do not use Google Tag Manager, Meta Pixel, retargeting or ad networks. We run two analytics services, Google Analytics and PostHog, and neither is tied to advertising: Google\u2019s advertising features (Google Signals) are switched off and no data is passed to ad accounts.<\/p>\n\n

      An honest note about the banner.<\/strong> The cookie notice on the site informs you that cookies are used, but it is not a consent mechanism: it offers no choice and does not block cookies until you decide. The analytics in particular starts immediately, without waiting for your answer.<\/strong> We intend to fix this. For now we\u2019re describing the situation as it actually is.<\/p>\n\n

      You can delete cookies or block them in your browser settings. Technical cookies will be disabled too, and the basket will stop working.<\/p>\n\n

      Your rights<\/h2>\n\n

      You have the right to:<\/p>\n\n

        \n
      • know<\/strong> what data we process about you, for what purpose, and with whom we share it;<\/li>\n\n\n\n
      • access<\/strong> your data and obtain a copy;<\/li>\n\n\n\n
      • rectify<\/strong> inaccurate or incomplete data;<\/li>\n\n\n\n
      • erase<\/strong> your data where there is no lawful basis to keep it;<\/li>\n\n\n\n
      • restrict<\/strong> processing or object<\/strong> to it;<\/li>\n\n\n\n
      • receive your data in a portable format<\/strong> to transmit to another controller (Article 20 GDPR);<\/li>\n\n\n\n
      • withdraw consent<\/strong> where processing is based on consent \u2014 for example, unsubscribe from the newsletter. Withdrawal does not affect the lawfulness of processing before it;<\/li>\n\n\n\n
      • lodge a complaint<\/strong> with a supervisory authority.<\/li>\n<\/ul>\n\n

        To exercise any of these rights, write to legal@babywood.shop<\/strong>. We reply within thirty calendar days<\/strong> of receiving your request (Article 8(2) of Law 2297-VI).<\/p>\n\n

        We may ask for additional information to verify your identity \u2014 this protects you from someone else obtaining your data.<\/p>\n\n

        Where to complain<\/h2>\n\n

        In Ukraine<\/strong> \u2014 to the Ukrainian Parliament Commissioner for Human Rights, who supervises compliance with personal data protection law, or to a court.<\/p>\n\n

        In the European Union<\/strong> \u2014 to the data protection supervisory authority of your country of residence.<\/p>\n\n

        How we protect data<\/h2>\n\n

        The site runs over an encrypted HTTPS connection. Access to the site\u2019s administration and to order data is limited to the people who need it for their work. We do not process payment card data at all \u2014 it passes through the payment service, bypassing our site.<\/p>\n\n

        No system is perfectly secure, and we won\u2019t promise the impossible. If a breach occurs that puts your rights at risk, we will notify you and the supervisory authority.<\/p>\n\n

        Changes to this policy<\/h2>\n\n

        We may update this policy \u2014 for instance if new services are introduced or the law changes. The current version is always on this page, with its date at the top.<\/p>\n\n

        If the changes are significant, we will notify you separately.<\/p>\n","protected":false},"excerpt":{"rendered":"

        Version of 12 August 2026 This policy explains what data we collect about you, why, who we share it with,<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-37797","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/babywood.shop\/en\/wp-json\/wp\/v2\/pages\/37797","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/babywood.shop\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/babywood.shop\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/babywood.shop\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/babywood.shop\/en\/wp-json\/wp\/v2\/comments?post=37797"}],"version-history":[{"count":2,"href":"https:\/\/babywood.shop\/en\/wp-json\/wp\/v2\/pages\/37797\/revisions"}],"predecessor-version":[{"id":37832,"href":"https:\/\/babywood.shop\/en\/wp-json\/wp\/v2\/pages\/37797\/revisions\/37832"}],"wp:attachment":[{"href":"https:\/\/babywood.shop\/en\/wp-json\/wp\/v2\/media?parent=37797"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}