Privacy Policy

This Privacy Policy explains what personal data is collected when you use the Kumiho Beauty online store (https://kumiho.beauty), why and on what grounds we process it, who we share it with, and what rights you have. Processing is governed by the Law of Ukraine “On Personal Data Protection” No. 2297-VI and, for visitors from the European Union, also by the General Data Protection Regulation (GDPR).

Data controller

• Sole proprietor (ФОП) Diakonov K.M.
• Email: support@kumiho.beauty

What data we collect

At checkout - your first and last name, phone number, email and delivery address (a branch, a parcel locker, or a courier address). If you create an account - your profile data and order history; if you leave a review - its text and rating. If you contact us or return a product - the content of the correspondence, and for a refund of an order paid on receipt - the bank details (IBAN) you provide. Automatically - technical data about how the site is used (device type, pages viewed) and cookies according to your choice in the consent settings. We never collect more than is needed to run the store.

Purposes and legal bases

Contract performance - processing your order, payment, delivery, refunds, handling your requests and order-related communication. Your consent - analytics and marketing cookies and the email newsletter (a separate checkbox at checkout). Legitimate interest - error and stability monitoring, abuse prevention, and defending our legal rights. Legal obligation - sending payment documents (electronic receipts), record keeping and responding to lawful requests from state authorities.

Who we share data with

We share data only with parties an order cannot be fulfilled without, and only to the minimum extent: the carrier you choose - Nova Poshta LLC or JSC Ukrposhta - receives your name, phone and address for delivery; the monobank payment service (JSC “Universal Bank”) processes card payments on its own secure page (we never see or store your card details); the software payment-transaction recorder service issues the fiscal receipt and sends it to your email. Analytics (Google Analytics) and marketing (Meta Pixel) services run only after your consent in the matching cookie category. The site's technical operation relies on infrastructure contractors - hosting, email delivery, error monitoring (Sentry) and search (Algolia) - which process data on our instructions. We do not sell personal data to third parties.

International data transfers

Some of our contractors (hosting, analytics, monitoring) run servers in the European Union or the United States. Transfers outside Ukraine and the EU rely on standard contractual clauses or adequacy decisions that guarantee an adequate level of data protection.

Retention periods

Order data is kept for the duration of the contract and the limitation period, and primary and payment documents for at least 1095 days, as required by tax law. Account data - until you delete the account. Consent-based data (analytics, marketing, newsletter) - until you withdraw consent. After the retention period ends, data is deleted or anonymized.

Your rights

You have the right to: know what data of yours we process, why, and who it is shared with; access your data and get a copy; have inaccurate data corrected; have data deleted when there is no legal ground to keep it; restrict or object to processing; receive your data in a structured machine-readable format (portability); and withdraw consent at any time - this does not affect the lawfulness of processing before the withdrawal. To exercise your rights, email support@kumiho.beauty - we respond within 30 calendar days.

Where to complain

If you believe your rights have been violated, you can contact the Ukrainian Parliament Commissioner for Human Rights (21/8 Instytutska St., Kyiv, 01008; hotline 0800 50 17 20) or go to court. EU visitors can also contact the supervisory authority of their country.

Data security

The connection to the site is encrypted (TLS); access to personal data is restricted to those who need it for their work; we collect minimal data and never store card payment details. That said, no method of transmitting data over the Internet is completely secure - in the event of an incident posing a high risk to your rights, we will notify you as required by law.

Children's data

The store is not aimed at persons under 18, and we do not knowingly collect their personal data. If you become aware that a child has given us their data, write to us - we will delete it.

Automated decision-making

We make no decisions about you based solely on automated processing that produce legal effects. Advertising profiling (personalized offers) happens only with your consent in the “Marketing” category, and can be switched off at any time.

Cookie Policy

Cookies are small text files stored in your browser. The consent banner describes the cookie categories briefly; here is the full list of tools in each category. Necessary cookies are needed for the site to work and are always on. Analytics and marketing cookies are only enabled with your consent - you can change that choice at any time using the “Cookie settings” button.

Necessary. Required for the site to work - for example, to keep your cart and to monitor errors (Sentry), which helps us keep the site stable. This category also covers the built-in Vercel Analytics and Vercel Speed Insights statistics: these tools use no cookies and collect no personal data - the data is fully anonymized - so they run without separate consent.

Analytics. Belong to Google Analytics - a service that helps us understand how visitors use the store (which pages they view, which products they add to the cart and buy). Google Analytics sets its own cookies and only runs after your consent in the “Analytics” category. You can withdraw consent at any time via “Cookie settings” - data transfer stops from that moment.

Marketing. Belong to the Meta Pixel (Facebook / Instagram) - a tool for measuring advertising performance and remarketing. The pixel only runs after your consent in the “Marketing” category; without it, no data is sent to Meta. Consent can likewise be withdrawn at any time via “Cookie settings”.

Your cookie choice is stored in your browser until you change it or clear your browser data.

Changes to this policy

If we materially update this policy, we will announce it on the site and, if the changes concern cookies, ask you to make your choice again. The date of the last update is shown at the top of the page.