Privacy Policy

Last updated: [DATE]

This Privacy Policy explains how we process your personal data when you visit nastasiarose.com (the "Website") or buy books from us. It is intended to meet the requirements of the EU General Data Protection Regulation (GDPR) and of Russian Federal Law No. 152-FZ "On Personal Data".

1. Controller

• Anastasia Olegovna Rozova, individual entrepreneur registered in the Russian Federation
• Taxpayer identification number (INN): 773126446890
• State registration number (OGRNIP): [OGRNIP]
• Postal address: [ADDRESS]
• Email for all privacy matters: info@nastasiarose.com
• Phone / WhatsApp: [PHONE]
• EU representative under Article 27 GDPR: [EU REPRESENTATIVE, IF APPOINTED]

2. What data we process, why, and on what legal basis

2.1. Orders. To process your order — taking payment, sending the e-book, shipping the print edition and issuing the receipt — we process:

• your name;
• your email address;
• your phone number (required for print editions, optional for e-books);
• your shipping address (print editions only);
• details of your order and payment.

Legal basis: performance of a contract (Article 6(1)(b) GDPR). We need this data to conclude and perform the contract; without it we cannot fulfil your order.

Your card details are entered on the Robokassa payment page. We do not receive or store them.

2.2. Communication about your order. We use your name, email address and phone number to contact you about your order, delivery or return, and to answer your enquiries. Legal basis: Article 6(1)(b) GDPR.

2.3. Accounting and tax. We keep order and payment records as required by the tax and accounting laws that apply to us. Legal basis: our legitimate interest in complying with these legal obligations under Russian law (Article 6(1)(f) GDPR).

2.4. Newsletter. We only send you our newsletter about the books and the author's news if you have given separate consent. We process your name and email address. Legal basis: consent (Article 6(1)(a) GDPR). You can unsubscribe at any time using the link in every email.

2.5. Website analytics. With your consent, we use Yandex Metrica and Google Analytics to understand how visitors use the Website. These services use cookies and process your IP address, information about your browser and device, the pages you visit, and the date and time of your visit. Legal basis: consent (Article 6(1)(a) GDPR and the rules on storing information on your device implementing Article 5(3) of the ePrivacy Directive). Analytics cookies are only set after you accept them in the cookie banner. You can withdraw your consent at any time: [COOKIE SETTINGS LINK].

Strictly necessary cookies, which keep the Website and your cart working, do not require consent.

3. Recipients

We share your data only to the extent necessary for the purposes above:

• Selectel — hosting provider; our server is located in Moscow, Russia;
• Robokassa LLC (Russia) — payment processing and receipts;
• postal and courier services [DELIVERY SERVICES], including the delivery service in the recipient's country — print editions only: name, phone number, shipping address;
• our email delivery provider [EMAIL SERVICE PROVIDER] — name, email address, order details;
• Yandex LLC (Russia) — Yandex Metrica analytics, only with your consent;
• Google LLC (USA) — Google Analytics, only with your consent.

We do not sell your personal data.

4. Where your data is processed

4.1. We are based in Russia, and your data is stored on our server in Moscow. Russia is not covered by an adequacy decision of the European Commission. We transfer to Russia the data you provide to us because this is necessary to conclude and perform the contract with you (Article 49(1)(b) GDPR).

4.2. If your print edition is shipped outside Russia, your name, phone number and shipping address are passed to the delivery service in the destination country, as this is necessary to deliver your order (Article 49(1)(b) GDPR).

4.3. Google Analytics data is transferred to Google LLC in the USA. Google LLC participates in the EU–U.S. Data Privacy Framework, which is covered by an adequacy decision of the European Commission.

5. How long we keep your data

• Order data: 3 years from your last order, or until you withdraw your consent where processing is based on consent.
• Accounting records: for the periods required by law.
• Newsletter data: until you unsubscribe.
• Analytics data: for the retention periods set in Yandex Metrica and Google Analytics, or until you withdraw your consent.

6. Your rights

You have the right to:

• access your personal data (Article 15 GDPR);
• have inaccurate data corrected (Article 16 GDPR);
• have your data erased (Article 17 GDPR);
• restrict processing (Article 18 GDPR);
• receive your data in a structured, commonly used, machine-readable format (Article 20 GDPR);
• object to processing based on our legitimate interests (Article 21 GDPR);
• withdraw your consent at any time with effect for the future (Article 7(3) GDPR);
• lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work.

To exercise your rights, write to info@nastasiarose.com. We will reply within one month. We may ask you to confirm your identity, for example by giving your order number.

We do not use automated decision-making or profiling.

7. Security

We take appropriate technical and organisational measures to protect your data, including restricted access and encrypted connections.

8. Changes

We may update this Privacy Policy. The current version is always available on this page.