How we handle your data.

This is the previous English version. The Ukrainian version (Українська) is the authoritative current edition.

Data we collect

Partnership form (B2B): if you submit an inquiry through our partnership form, we receive your name, company, partnership format, and contact information (phone or email). Each submission is verified by Cloudflare Turnstile to filter out bots.

Web checkout (DTC, when launched): for online orders we collect your name, phone number, email, delivery address (Nova Poshta city and warehouse), order line items, and any optional notes you choose to include with your order.

Telegram Mini App: if you place an order through our Telegram Mini App, Telegram provides us with your numeric Telegram user ID and, optionally, your first name, last name, and username through the standard WebApp.initData handshake. We verify the HMAC signature on this data and do not request any additional permissions beyond the standard Telegram Mini App contract.

Analytics and marketing: we use Google Analytics 4 (GA4) to measure conversions across the order funnel and Meta Pixel to optimise advertising campaigns on Facebook and Instagram. Neither service runs until you give explicit consent through our privacy banner ("Privacy preferences" link in the footer): GA4 loads only after you consent to the analytics category; Meta Pixel loads only after you consent to the marketing category. Until consent is granted, both scripts stay blocked (Klaro! type="text/plain") and are not executed by the browser. You may withdraw your consent at any time through the same panel — Klaro! immediately removes the affected cookies (_ga, _ga_*, _gid, _fbp, _fbc) and stops sending events. We also store essential technical state: a sessionStorage flag for the brand-loader animation within a session, localStorage entries under the nashe_* prefix that persist your cart between visits, and a Klaro! localStorage record of your consent choice.

How we use your data

Partnership inquiries: exclusively to contact you about the partnership inquiry you submitted.

Orders: to send order confirmation messages by email to you and to our manager (via Mailgun EU); to display the order in our internal Telegram group for fulfillment; and to look up Nova Poshta warehouses when you choose a delivery address (we send only city and warehouse names to Nova Poshta — no personal data is sent).

We do not transfer your data to third parties, do not use it for marketing emails without your consent, and do not sell it to anyone.

How long we keep your data

Partnership inquiries: up to 12 months from the last communication, after which the records are deleted from our internal Telegram group.

DTC order records: at least 36 months — the minimum retention period required by Ukrainian commercial law for sales contracts.

Server logs: up to 30 days, after which they are rotated out automatically by the standard Docker compose log rotation policy.

Cookies

Cookies and local storage on the site are split into three categories per the Klaro! consent-manager configuration that enforces this split:

necessary — always active, no consent required, because the site cannot work without them. This category includes: the sessionStorage nashe_loader_seen flag (so the brand loader does not replay within a session), localStorage entries under the nashe_* prefix (your cart contents between visits), and the Klaro! localStorage record of your consent choice.
analytics — activated only after your explicit consent in the banner. The category contains Google Analytics 4, which sets the _ga and _ga_* cookies (GA4 user identifiers — _ga_<measurement-id> is created per analytics container, 2-year lifetime) and _gid (short-term session identifier, 24 hours). We use this data exclusively to measure the order funnel.
marketing — activated only after your explicit consent in the banner. The category contains Meta Pixel, which sets _fbp (browser identifier for Facebook attribution, 90 days) and _fbc (stores the fbclid click identifier when you arrive from a Facebook ad, 90 days). We use this data to optimise advertising campaigns on Facebook and Instagram.

Until consent is granted, cookies in the analytics and marketing categories are not set — Klaro! blocks the corresponding scripts from loading. You may withdraw consent at any time via the "Privacy preferences" link in the footer — Klaro! will immediately delete the active analytics and marketing cookies and stop sending events.

Payment (WayForPay): card payments are completed on the secure page of our payment processor WayForPay (secure.wayforpay.com), to which you are redirected from our site. Card data is entered and processed entirely on WayForPay's side and is never stored on our site. Any cookies WayForPay sets during payment belong to the WayForPay domain (secure.wayforpay.com), not to nashe-ua.com — so they are outside the Klaro! consent categories on our site and are not governed by our cookie banner.

Your rights

Under GDPR Articles 15–22 (and the equivalent provisions of the Ukrainian Law "On the protection of personal data"), you have the following rights with respect to your personal data:

Right of access — request a copy of all data we hold about you (partnership inquiries, orders, the Klaro! consent log) along with information about the purpose and retention period for each.
Right to rectification — require us to correct inaccurate or outdated data, including a wrong delivery address, phone number, or email on your order.
Right to erasure (right to be forgotten) — require us to delete your data, except for records we are legally obliged to retain under Ukrainian commercial law (DTC order records — minimum 36 months).
Right to data portability — receive a copy of your data in a machine-readable format (CSV or JSON) so that you can transfer it to another data controller.
Right to object — object at any time to processing of your data for analytics, marketing, or any other purpose not strictly required to perform your order contract.
Right to withdraw consent — revoke consent previously granted to the analytics or marketing category. The fastest way is the "Privacy preferences" link in the footer (Klaro! will immediately remove the category and delete the corresponding cookies). Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Send all such requests (DSAR — Data Subject Access Request) to [email protected]. We respond within 30 days of receiving the request, as required by GDPR. If a request is complex or requires additional identity verification, we may extend this period once by a further 60 days, notifying you of the reason for the delay.

Contact

For any questions about how we handle your data, please write to [email protected].