Who is responsible for your data
The data controller is WEST SALE GROUP LLC (company number 43354484), 3A Kolberha St., Lviv 79013, Ukraine. We own the VELANO trade mark and this website.
For anything related to your data, write to [email protected] — this is our single channel for such requests, and we answer all of them.
What we don't do
The quickest way to understand this site is to see what it does not have. It is not an online shop: you cannot buy or pay here, so we never see payment data at all.
- we take no payments and never see card numbers — you buy from our partners;
- there is no sign-up, no customer account and no passwords;
- we set no cookies of our own;
- we do not build profiles and make no automated decisions about you;
- we do not sell, rent or trade your data;
- we do not collect your location — the map on "Where to buy" shows our partners, not you;
- we do not collect special categories of data (health, religion, political views and the like).
What data reaches us and why
Data reaches us only when you send something yourself — plus automatically in technical logs, without which the site cannot run or defend itself.
| When | What exactly | Why | Legal basis | How long |
|---|---|---|---|---|
| Newsletter sign-up | Email, site language, time, IP address, the text and version of your consent | To send news and offers; to prove consent was given | Your consent | Until you withdraw it |
| "Become a partner" application | Shop name, city, address, phone numbers, email, website, logo (if attached) | To process the application and contact you | Pre-contractual steps at your request | 3 years after last contact |
| Suggested correction to a shop listing | Your name and contact, the correction, IP address | To check and fix the map data | Our legitimate interest — accuracy of the map | 1 year |
| Factory enquiry form (/factory) | Company, contact person, email, phone, WeChat, message, uploaded files | To process a B2B enquiry | Pre-contractual steps at your request | 2 years |
| Email, phone call or messenger | Whatever you write or say yourself | To reply to you | Your request | 3 years after last contact |
| Automatic error log | Page address, error text, browser, IP address | To spot a broken page before you do | Our legitimate interest — a working site | 30 days |
| Server and security logs | IP address, time, page address, browser | Protection against attacks and abuse, diagnostics | Our legitimate interest — security | 30 days |
We don't ask for more than we need: our forms contain no fields we couldn't reply without. If you send more than necessary, we delete the excess.
Who else sees this data
We pass data to nobody "for marketing". But the site physically runs on someone else's infrastructure, and these companies process data on our behalf:
| Who | What they do | Where |
|---|---|---|
| Hetzner Online GmbH | The server that runs the site and stores applications | Germany (EU) |
| Cloudflare, Inc. | Protection against attacks and site acceleration; sees visitor IP addresses | Network with nodes in the EU and the US |
| Google LLC | Visit analytics, partner map, YouTube video player | United States and other countries |
| Telegram | Instant notification to our team about a new enquiry | Outside the EU |
We may also disclose data where the law requires it — for example, on request from a court or law-enforcement body.
Transfers outside Ukraine
The site's server is in Germany — a European Economic Area state, which under Article 29(3) of the Ukrainian Personal Data Protection Act is deemed to provide an adequate level of protection. No separate consent from you is required for this.
Google and Telegram also operate outside the EU. That is exactly why analytics on our site does not start until you press "Accept": without your consent, that data does not go there.
Cookies and analytics
Our site sets no cookies of its own. We store only a few technical values in your browser (colour theme, comparison list, your analytics choice) — they never reach our server and do not identify you.
Google Analytics only starts after you consent. The full list is on the Cookies page. You can change your choice at any time via "Cookie settings" at the bottom of every page.
Partner data from public sources
On the "Where to buy" page we show shops that sell VELANO. Some of those listings were not built from applications but from public sources: our supply contracts, the shops' own public pages and Google Maps. They may contain a name, address, phone number and website — and for sole traders that counts as personal data.
The basis is our legitimate interest in showing buyers where to buy, and the shops' own interest in receiving customers. We publish only what is already publicly available.
If you own a shop and want the listing corrected or removed from the map, write to [email protected]. We will remove or correct it without asking you for reasons.
Your rights
Article 8 of the Ukrainian Personal Data Protection Act — and, where it applies, the GDPR — gives you rights you can use at any time, free of charge:
- find out whether we hold data about you, what exactly and where we got it;
- get a copy of that data;
- correct inaccurate data;
- delete data or withdraw consent — for example, unsubscribe from the newsletter;
- object to processing where we rely on our legitimate interest;
- complain if you believe we got something wrong.
To use any of these rights, write to [email protected]. We review a request within 10 working days and fulfil it within 30 calendar days (Article 16(8) of the Act).
So that nobody else can obtain your data in your name, we reply to the same address the request came from, or cross-check it against your original application.
If our answer does not satisfy you, you may turn to the Ukrainian Parliament Commissioner for Human Rights or to a court. If you are in the European Union, you may also complain to the supervisory authority of your country.
How long we keep data
The periods are in the table above. When a period ends, the data is deleted automatically. Server backups are kept for up to 30 days, so deleted data may remain in them for a while before disappearing with the next rotation.
How we protect data
The site works only over an encrypted HTTPS connection. Applications are accessible to a handful of staff through individual accounts with different permission levels; passwords are stored as cryptographic hashes. Attack protection sits in front of the site, and the server accepts connections only through it. Backups are taken regularly.
No system is absolutely secure, so we do not promise perfect safety — but we do what is appropriate for a site of this size.
Children
This site is intended for adults — parents choosing products for their children. We deliberately do not collect children's data and offer no services to children.
Children may appear in our photos and videos. We use such material only with the consent of a parent or legal guardian. If you recognise your child in our material and did not give consent, write to us and we will remove it.
Changes to this policy
We update this page whenever the way we handle data changes — for instance when a new service is added. The update date is always shown at the top. If changes are significant, we will ask for your consent again.
This page is an informational document. If the language versions differ, the Ukrainian version prevails.
