Privacy Policy
Last updated: 6 July 2026
This Privacy Policy explains what personal data we collect on the website at nattaliepiano.com (the "Site"), why we collect it, and what your rights are. We try to keep this brief and human-readable.
1. Who controls your data
Your personal data is controlled by Nataliia Kuzmina, a sole proprietor (ФОП) registered in Ukraine ("we", "us"). You can reach us about anything in this policy at [email protected].
2. What we collect, and why
We collect the minimum data needed to run the Site and serve you:
- Contact form. When you write to us via the contact form, we receive your name, email, subject, and message. We use this only to reply.
- Newsletter. If you opt into our Telegram newsletter, we don't collect anything ourselves — that's between you and Telegram.
- Purchases. When you make a purchase, Paddle.com Market Limited processes the payment on our behalf. Paddle collects your email, billing address, and payment details. We receive from Paddle: your email, the items you bought, and the amount paid (so we can deliver your purchase and answer questions). We never see your card number.
- Server logs. Our hosting and CDN provider keeps short-term technical logs (IP address, browser type, requested URL) for security and to debug problems. These rotate out after a few weeks.
- Analytics (optional). If we have Google Analytics enabled, it loads only after you accept analytics cookies on our consent banner. See our Cookie Notice.
3. Legal basis (GDPR)
If you're in the EU, the UK, or another jurisdiction that recognises a similar framework, the legal bases under which we process your data are:
- Performance of a contract — for delivering purchases you've made.
- Legitimate interest — for keeping the Site running and secure (server logs, fraud prevention).
- Consent — for optional analytics cookies, which you can withdraw at any time.
4. Who else sees your data
- Paddle — payment processing and tax handling. See Paddle's Privacy Policy.
- Hosting and CDN provider — handles request delivery and short-term technical logs (see above).
- Google — if analytics is enabled, anonymised usage data flows to Google Analytics 4. See Google's Privacy Policy.
We do not sell your data, and we do not share it for marketing purposes.
5. How long we keep it
- Contact-form messages: kept while we may need them to follow up; routinely purged after 24 months.
- Purchase records: kept for the period required by Ukrainian tax law (usually 3 years), then deleted.
- Server logs: rotated out by our hosting provider within weeks.
- Analytics data (if enabled): retained per Google Analytics 4 defaults (currently 14 months).
6. Your rights
Where applicable law gives you these rights (e.g. under the GDPR), you can:
- request a copy of the personal data we hold about you;
- ask us to correct inaccurate data;
- ask us to delete your data (subject to retention obligations);
- object to processing or ask us to restrict it;
- withdraw consent for any processing based on consent.
Email [email protected] with your request. We respond within 30 days.
You also have the right to lodge a complaint with the supervisory authority in your country (in Ukraine, the Office of the Ombudsperson).
7. Children
The Site is not directed at children under 16. If you believe a child has given us personal data, please contact us so we can delete it.
8. International transfers
Some of our service providers (e.g. Paddle, our hosting/CDN provider, Google) are based outside Ukraine and the EEA. Where data is transferred, we rely on those providers' standard contractual clauses and similar safeguards.
9. Changes to this policy
We may update this Policy. Material changes will be announced on the Site, and the "Last updated" date at the top will change.