Privacy policy

Last updated on 24 October 2026.

This policy explains what personal data the online shop Hop.Shop (hop.shop) processes, why, on what legal basis, who receives it, how long it is kept and how you can exercise your rights. It follows the Law of Ukraine "On Personal Data Protection" and, for visitors from the European Economic Area and the United Kingdom, the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the UK GDPR.

1. Who processes your data

Data controller: Larysa Ivanivna Kuznietsova, a sole proprietor (FOP) registered in Ukraine, who runs the online shop Hop.Shop, Odesa, Ukraine.

Send any question about your personal data to this address. We reply within 30 days.

2. What data we collect

  • Orders and delivery: first and last name, phone, email, city, delivery address or branch, country, order contents and total, order comment, payment status.
  • Account (if you create one): the same contact details, a hashed password, order history, wishlist.
  • Messages: what you send us through the contact form or by email, and our replies.
  • Reviews: the name you enter and the review text.
  • Newsletter (only if you subscribe): your email address.
  • Technical data: IP address, browser and device type, pages you open, time of the request. The server keeps them in its logs; analytics collects them only as described in section 4.

We do not collect card details: when you pay by card online, you enter them on the payment provider's page.

3. Why and on what legal basis

  • Placing, delivering and returning orders, contacting you about an order. Basis: performance of the contract with you (Art. 6(1)(b) GDPR).
  • Accounting and tax records. Basis: a legal obligation (Art. 6(1)(c) GDPR).
  • Answering your messages, publishing reviews. Basis: performance of the contract or your consent, given when you send the form.
  • Newsletter with news and offers. Basis: your consent (Art. 6(1)(a) GDPR). Unsubscribe in your account or by writing to us.
  • Visit statistics and advertising measurement (Google Analytics, Google Ads). Basis: your consent in the cookie settings. For visitors from countries whose law does not require prior consent, the basis is our legitimate interest in understanding how the shop is used; you may object at any time.
  • Website security, protection against fraudulent orders and abuse. Basis: our legitimate interest (Art. 6(1)(f) GDPR).

We make no decisions with legal effect on you by automated means only, and we do not sell your data.

4. Cookies and analytics

Cookies are small files a website stores in your browser.

  • Necessary (the cart, sign-in and language choice do not work without them): the PrestaShop-… shop session cookie (up to 20 days) and consent_preferences with your cookie choice (1 year). They need no consent.
  • Analytics: Google Analytics 4 (_ga, _ga_…, up to 2 years). Shows which pages and products are viewed and which orders are placed.
  • Marketing: Google Ads (_gcl_au, up to 90 days). Tells whether an ad led to a purchase.

Visitors from the EEA and the UK are asked first. Until you allow analytics, Google Tag Manager and Google Analytics are not loaded on the page at all, and no request is sent to Google. In other countries analytics is on by default.

You can change or withdraw your choice at any time: cookie settings (the link is also at the bottom of every page). Cookies already stored can be deleted in your browser settings.

After you place an order, our server reports the purchase to Google Analytics (order number, products, amounts) together with the _ga cookie identifier if you allowed analytics; your name, phone and address are not sent to Google.

5. Who receives your data

Only those needed to fulfil your order or run the website, and only to the extent needed:

  • Carriers: Nova Poshta LLC and Nova Post (international delivery): name, phone, address or branch, shipment details. Cash on delivery is handled by the financial company NovaPay.
  • Banks and payment providers (including WayForPay when you choose to pay by card online): order number and amount, contact details.
  • Google Ireland Limited (Google Analytics, Google Tag Manager, Google Ads): the data described in section 4.
  • Cloudflare, Inc.: content delivery network and website protection; processes IP addresses and technical request data.
  • Hosting: the website and its database run on servers in the Czech Republic (EU).
  • Public authorities: only when the law requires it.

6. International transfers

The shop operates from Ukraine; its servers are in the EU. Google and Cloudflare may process data in the United States; these transfers rely on the EU-U.S. Data Privacy Framework, under which both companies are certified, and on the European Commission's standard contractual clauses.

7. How long we keep data

  • Orders and their documents: for the period set by Ukrainian tax and accounting law (at least 1,095 days, Tax Code of Ukraine, para. 44.3).
  • Account: until you delete it or ask us to.
  • Newsletter subscription: until you unsubscribe.
  • Messages: up to 3 years after the last exchange.
  • Web server logs: up to 10 days.
  • Google Analytics data: up to 14 months.

After that the data is deleted or anonymised.

8. Your rights

You have the right to:

  • know what data about you we process and get a copy of it;
  • have inaccurate data corrected (some of it you can change yourself in your account);
  • have your data erased when there is no legal ground to keep it;
  • restrict or object to processing, including analytics and marketing;
  • receive your data in a machine-readable format to pass it to another provider;
  • withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.

To exercise a right, write to sales@hop.shop from the address used for the order or account.

9. Complaints

If you believe we infringe your rights, write to us and we will look into it. You may also complain to the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua) or, if you live in the EEA or the UK, to the data protection authority of your country (list of EU authorities; in the UK: the ICO).

10. Security, children, changes

The website works over HTTPS only, passwords are stored hashed, and only shop staff who need the data for their work can access it.

The shop is not intended for people under 16, and we do not knowingly collect their data.

We may update this policy; the date of the current version is shown at the top. We will announce material changes on the website.

Product added to wishlist
Product added to compare.