Privacy policy

Data controller

Controller:

Individual Entrepreneur Yana Andreevna Borovskaya

Taxpayer ID:

780229112787

Primary State Registration Number:

322784700222867

Address:

60-4, 2nd Nikitinskaya Street, Saint Petersburg, 197349, Russia

Privacy email:

alltorion@gmail.com

Data we process

• Surname, given name and patronymic where provided, telephone number, email, and other contact details.
• Delivery address, recipient details, order contents and history, returns, and support communications.
• Account data and information voluntarily entered in forms or messages.
• Payment and transaction information needed to confirm payments and refunds. Full card details are processed by the payment provider unless the website expressly states otherwise.
• Technical data, including IP address, device and browser type, request date and time, visited pages, service logs, and cookie identifiers.

Purposes and legal grounds

• Account registration, cart operation, checkout, payment, order performance, delivery, returns, and support — to enter into and perform a contract at the user's request.
• Accounting and tax records, receipts, handling claims, and other mandatory duties — to comply with law.
• Fraud prevention, website protection, and confirmation of legally significant actions — to perform contracts, comply with law, and protect the legitimate interests of the controller and users.
• Responding to requests — on the basis of the request, contract performance, or the controller's legitimate interest.
• Informational and promotional messages — only with separate consent, which may be withdrawn at any time.

Cookies

The website uses necessary cookies for authentication, cart storage, language and region selection, security, and correct interface operation. Blocking them in the browser may make some functions unavailable.

Optional analytics or advertising technologies may be used only if enabled and supported by the legal ground or consent required by law. The user's current choice is respected through any cookie controls made available on the website.

Data sharing

The controller may appoint or share the necessary minimum of data with payment organizations, delivery providers, hosting and IT infrastructure providers, messaging services, and professional advisers. They receive data only for the relevant purpose and must protect its confidentiality and security.

Data may also be disclosed to public authorities and other persons where required by law or with the user's consent. The controller does not sell personal data.

Storage and localization

When personal data of Russian citizens is collected online, its recording, organization, accumulation, storage, updating, and retrieval use databases located in the Russian Federation, except where the law provides otherwise.

Data is kept no longer than required by the processing purpose, contract, or mandatory retention period. When the purposes are achieved or consent is withdrawn, data is deleted or anonymized unless continued storage is required by law.

Security

The controller applies necessary legal, organizational, and technical safeguards against unauthorized access, alteration, disclosure, blocking, copying, provision, dissemination, and other unlawful actions. Access is limited to persons who need the data to perform their duties.

User rights

Requests may be sent to alltorion@gmail.com. To protect the data, the controller may ask for information needed to verify the applicant's identity and connect the request to the relevant data.

• Obtain information about processing and request correction of personal data.
• Request restriction or deletion where data is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated purpose.
• Withdraw consent and object to processing where provided by law.
• Complain to Roskomnadzor or a court and use other remedies available by law.

Children's data

The website is not intended for independent submission of personal data by persons who cannot legally enter into the relevant agreement or provide the required consent without a legal representative. If such data was submitted without a proper legal basis, contact the controller to have it deleted.

Policy changes

The controller may update this policy when the website, processes, or law change. A new version takes effect when published on this page unless it states a different date.