Privacy Policy
Short and without legal fog: what data we collect, why we need it, and what you can do with it.
Who processes your data
Online store «Придбай» (PrudBuy), Lviv, Ukraine. We are the data controller within the meaning of the Law of Ukraine "On Personal Data Protection" No. 2297-VI. Questions about your data: no-reply@prudbuy.com or (063) 606-75-91.
What data we collect and why
- Name, surname, phone, e-mail — to place the order, confirm it, have the courier call you, and send the waybill. Delivery can't be arranged without it.
- Delivery address — city, Nova Poshta branch, or street and building number. Needed only so the parcel gets to you.
- Order contents, amounts, status history — so you can see your purchases in your account, and so we can process a return or a claim. This is also a tax record-keeping requirement.
- Password — stored only as an irreversible hash. Even we can't read your password.
- Technical session data — IP address, browser and device type, login time. Needed so you can see in the "Security" section which devices your account is open on, and so we can stop password brute-forcing.
- Cookies — login session, guest cart, CSRF token, selected theme and language. They're all technical: the site doesn't work without them. We don't set advertising cookies.
- Newsletter consent — tracked separately, with a timestamp. Can be turned off in your account or via the link in any email.
Who we share your data with
Only with those without whom the order couldn't physically happen — and only to the extent necessary:
- Acquiring bank (Fondy) — the payment provider. Receives the amount, order number, and contact info for the receipt. You enter your card details directly with them — they never pass through us.
- Нова Пошта — the carrier. Receives the recipient's name, phone number, city, and branch — what's printed on the waybill.
- Email sending service — your email address, to deliver the order email or the email confirmation.
- Our accounting system (1C) — the order contents and contact info, to pick and ship the product.
We don't sell or share your data for third-party advertising. To government authorities — only in cases directly provided for by law, and strictly within the scope of the request.
How long we keep it
- Order data — for as long as tax and accounting law requires it.
- Account data — for as long as the account exists. After deletion, we anonymize it in your orders.
- Login and session log — up to 12 months.
- The saved card token — until you click "Unlink" in your account.
Your rights
Under Article 8 of Law No. 2297-VI, you have the right to:
- know exactly what data of yours we process, and get a copy of it;
- correct inaccurate data — you can change your name, phone, and email yourself in the "My Data";
- withdraw consent to the newsletter — with a single toggle in your account;
- request deletion of your data and account if there's no lawful basis to keep them;
- object to the processing or restrict it;
- appeal our actions to the Ukrainian Parliament Commissioner for Human Rights.
To exercise any of these rights, write to no-reply@prudbuy.com from the address specified in your account. We respond within 30 calendar days.
How we protect your data
- The connection to the site is encrypted (HTTPS).
- The password is stored only as a hash, session cookies are httpOnly.
- Every form that changes something is protected by a CSRF token.
- Sensitive account actions are logged with a timestamp and IP address.
- Only employees who need it for their work have access to the database.
Children
This site is not intended for people under 16, and we don't knowingly collect their data. If this has happened — write to us and we'll delete the record.
Policy changes
If we change this policy, the new version will appear on this page. We'll notify you by email about any significant changes.
Version dated 7 August 2026.