1. Who We Are (Data Controller)
The controller of your personal data is Individual Entrepreneur Karyna Pylypenko (tax identification number 3502209942, registered address: 58-A Kharkivske Highway, Kyiv, 02175, Ukraine), website karyna-light.com ("we", the "Website"). Contact for data matters: .moc.thgil-anyrak%40reganam This Policy is drawn up in accordance with the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the ePrivacy Directive.
2. What Data We Collect
2.1. Request and communication data: first and last name, e-mail, phone number and/or Telegram handle, the content of your enquiry and correspondence.
2.2. Payment data: processed by payment providers on their side; we do not store card details — we only receive information about the fact, amount and method of payment needed for accounting.
2.3. Technical data collected automatically: IP address, browser and operating system type, device identifiers, cookies, and information about your interaction with Website pages (Google Analytics 4).
2.4. Data you voluntarily share during sessions, including information about your wellbeing, emotional state and life circumstances, as well as session recordings (audio/video) where a recording is part of the service. Such data may fall within special categories (Art. 9 GDPR) and is processed solely on the basis of your explicit consent, which you give by ordering the service and taking part in the session; consent may be withdrawn at any time.
3. Purposes and Legal Bases of Processing
We process data for: performance of the agreement and communication regarding your request — Art. 6(1)(b) GDPR; handling session data — explicit consent, Art. 9(2)(a) GDPR; analytics and Website improvement — consent via the cookie banner and legitimate interest, Art. 6(1)(f); security and fraud prevention — legitimate interest; accounting and tax obligations — legal obligation, Art. 6(1)(c); informational and marketing communications — solely on the basis of separate voluntary opt-in consent under the ePrivacy Directive, with the option to unsubscribe at any time via the link in the message or upon request.
4. Cookies and Analytics
On your first visit, the Website requests consent to the use of cookies via a banner. We use: necessary cookies (which enable the Website, cart and forms to function) and analytics cookies (Google Analytics 4 — anonymised visit statistics: pages, traffic sources, device type). You may change your choice in your browser settings or by clearing cookies; disabling analytics cookies does not restrict access to the Website.
5. Who Receives the Data
Access to data is limited to contractors (processors) to the extent necessary for their functions: Weblium (Website hosting and request/CRM processing), Google (Analytics, infrastructure), payment providers, Telegram (communication), video conferencing services. Data processing agreements are in place with processors. Transfers outside the European Economic Area take place only with appropriate safeguards (European Commission adequacy decisions, EU Standard Contractual Clauses). We do not sell personal data and do not share it with third parties for their own marketing.
6. Retention Periods
Requests and correspondence — up to 2 (two) years from the last contact; session recordings — up to 12 (twelve) months from the session date (after delivery to the Client), or earlier upon your request; payment and accounting documents — for the periods established by law; analytics data — according to Google Analytics settings (14 months). After expiry of these periods, data is deleted or anonymised.
7. Your Rights (GDPR)
You have the right to: obtain confirmation of processing, access your data and receive a copy; rectify inaccurate or outdated data; erase data (the "right to be forgotten"); restrict processing; receive your data in a structured, portable format (data portability); object to processing based on legitimate interest; withdraw consent at any time — without affecting the lawfulness of processing carried out before withdrawal. To exercise your rights, write to moc.thgil-anyrak%40reganam — we will respond within 30 days. You also have the right to lodge a complaint with the data protection supervisory authority of your country of residence (for Poland — the President of the Personal Data Protection Office, PUODO, uodo.gov.pl).
8. Miscellaneous
The Website and services are intended for persons over 18 years of age; we do not knowingly collect data of minors. We apply technical and organisational protection measures (HTTPS encryption, access restriction, data minimisation). The Website may contain links to third-party resources — their privacy policies apply independently, and we recommend reviewing them. This Policy may be updated; the current version is always published on this page with the date indicated.