Legal information
Last updated:
1. Introduction
This Privacy Policy explains how REPULO'S collects, uses, stores, shares and protects the personal data of visitors and customers of the online store operated at repulos.com (the Site).
This Policy is drafted in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, GDPR), and, where applicable, with the Ukrainian Law on Personal Data Protection No. 2297-VI, as the controller is established in Ukraine.
By using the Site, placing an order, creating an account, subscribing to our newsletter or contacting us, you confirm that you have read this Policy. Where processing is based on your consent, that consent is requested separately and may be withdrawn at any time.
If you do not agree with this Policy, please do not use the Site or provide us with your personal data.
2. Who we are: controller and EU representative
The controller responsible for processing your personal data is:
Controller Individual entrepreneur Olena Repulo (FOP Repulo Olena Borysivna)
Address vul. Akademika Yanhelia 32, Vinnytsia, 21000, Ukraine
Email order@repulos.com
Phone +380 98 304 5455
Because the controller is established outside the European Economic Area and offers goods to individuals in the European Union, a representative has been designated in writing under Article 27 GDPR. You and the supervisory authorities may contact the representative directly on all matters relating to the processing of your personal data:
EU Representative under Article 27 GDPR Kateryna Nechyporenko
Address Office 509, Williama Heerleina Lindleya 16, 02-013 Warsaw, Poland
Email order@repulos.com
Phone +48 508 772 319
3. What personal data we process
Depending on how you interact with the Site, we may process the following categories of personal data.
3.1. Data you provide directly
When placing an order:
- first name and surname;
- contact telephone number;
- email address;
- delivery address, including country, city and the address or pick-up point of the carrier;
- body measurements, where you request a made-to-measure garment;
- order comments and any instructions you choose to add.
When subscribing to our newsletter: email address and, optionally, your name.
When contacting us through the contact form, WhatsApp or email: your name, contact details and the content of your message.
When booking a consultation: name and surname, telephone number, preferred date and time, and the nature of your request.
3.2. Data collected automatically
- IP address;
- browser type and version, operating system;
- device type;
- referring source;
- pages viewed, time spent on them and the sequence of interactions;
- approximate location at city or country level;
- identifiers stored in or read from your device by similar technologies.
3.3. Payment data
We do not store payment card details. Payments are processed directly by the payment provider. We receive only confirmation of the payment and its status.
3.4. Special categories of data
We do not intentionally collect special categories of personal data within the meaning of Article 9 GDPR. Body measurements provided for made-to-measure orders are processed solely to manufacture the garment you ordered and are not used for any other purpose.
4. Purposes and legal bases for processing
We process your personal data only for specific, explicit and legitimate purposes, each with a legal basis under Article 6(1) GDPR:
| Purpose | Legal basis |
|---|---|
| Concluding and performing the contract of sale, processing and delivering your order | Performance of a contract, Art. 6(1)(b) |
| Manufacturing a garment to your individual measurements | Performance of a contract, Art. 6(1)(b) |
| Communicating with you about order status and clarifying details | Performance of a contract, Art. 6(1)(b) |
| Handling returns, complaints, exchanges and warranty claims | Legal obligation, Art. 6(1)(c) |
| Accounting and tax record-keeping | Legal obligation, Art. 6(1)(c) |
| Sending marketing communications about collections and offers | Consent, Art. 6(1)(a) |
| Analytics and advertising technologies that require consent | Consent, Art. 6(1)(a) |
| Ensuring the security of the Site and preventing fraud | Legitimate interests, Art. 6(1)(f) |
| Establishing, exercising or defending legal claims | Legitimate interests, Art. 6(1)(f) |
Where we rely on legitimate interests, we have assessed that those interests are not overridden by your rights and freedoms. You may object to such processing at any time as described in section 9.
We do not use your personal data for purposes incompatible with those listed above without obtaining your separate consent.
5. Consent technologies and similar tracking
The Site stores and reads small files and identifiers on your device in order to operate correctly, to measure how the Site is used and, where you allow it, to show you relevant advertising.
5.1. Categories we use
Strictly necessary. Required for basic functionality such as retaining the contents of your basket, authentication and language selection. These do not require consent.
Preferences. Remember your settings and choices, such as language and region.
Statistics. Collect information about how visitors use the Site. We use Google Analytics 4. These are set only with your consent.
Marketing. Allow us to measure advertising performance and show relevant advertising on third-party platforms, including Google Ads and Meta. These are set only with your consent.
5.2. Managing your choices
You can change or withdraw your choices at any time through the consent banner on the Site or in your browser settings. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. Disabling certain categories may affect how the Site functions.
A detailed list of the technologies used is available in our separate policy on this topic, linked in the footer of the Site.
6. Recipients of personal data
We share personal data only to the extent necessary to achieve the purposes described above, with the following categories of recipients:
Delivery and logistics providers who deliver your order. We share the name, telephone number and delivery address.
Payment providers who process your payment, including card schemes and the acquiring bank.
IT and service providers acting as processors on our behalf: our hosting provider, email and marketing automation services, and analytics providers.
Public authorities where disclosure is required by law and on the basis of a valid request.
Processors act on our documented instructions under written data processing agreements. We do not sell, rent or otherwise make your personal data available to third parties for their own commercial purposes.
7. International transfers
The controller is established in Ukraine, and personal data is therefore processed outside the European Economic Area.
The European Commission has not adopted an adequacy decision in respect of Ukraine. Transfers from the EEA to the controller are therefore carried out on the basis of the Standard Contractual Clauses adopted by the European Commission under Article 46(2)(c) GDPR, together with supplementary technical and organisational measures.
Some of our service providers, including providers of analytics, advertising and email services, are established in the United States. Transfers to those providers take place on the basis of the EU-US Data Privacy Framework where the provider is certified, or otherwise on the basis of Standard Contractual Clauses.
You may request a copy of the safeguards applied by writing to order@repulos.com.
8. Retention periods
We keep personal data only for as long as necessary for the purposes described in this Policy, or for as long as required by law. Because the controller is established in Ukraine while many customers are resident in the European Union, two different sets of rules apply: our own accounting obligations follow Ukrainian tax law, while the periods relevant to your rights as a consumer follow the law of your country of residence.
| Category of data | Retention period |
|---|---|
| Order and contract data | For the duration of the contract, and thereafter until the limitation period for claims arising from it expires. Limitation periods differ between EU Member States and generally range from 2 to 6 years; we apply the longest period applicable to your country of residence. |
| Data relating to conformity of goods and warranty claims | At least 2 years from delivery, corresponding to the legal guarantee of conformity under Directive (EU) 2019/771, extended where the national law of your country provides a longer period. |
| Accounting and tax records | As required by the tax legislation applicable to the controller in Ukraine, currently 1095 days from the deadline for filing the relevant tax reporting, and longer where the law so requires. |
| Newsletter subscription data | Until you unsubscribe or withdraw your consent. |
| Records of consent | For the duration of the processing based on that consent, and for the limitation period thereafter, so that we can demonstrate compliance under Art. 7(1) GDPR. |
| Analytics data | Up to 14 months. |
| Enquiries submitted through contact forms, messengers or email | 1 year after the communication ends, unless the enquiry relates to a contract or a claim, in which case the periods above apply. |
Once the applicable period expires, personal data is deleted or irreversibly anonymised. Where data must be retained for one purpose but is no longer needed for another, we restrict processing to that remaining purpose.
9. Your rights
Under the GDPR you have the following rights in relation to your personal data:
- Right of access (Art. 15): to obtain confirmation as to whether we process your personal data, and a copy of that data together with information about the processing.
- Right to rectification (Art. 16): to have inaccurate personal data corrected and incomplete data completed.
- Right to erasure (Art. 17): to have your personal data deleted where one of the grounds set out in the GDPR applies.
- Right to restriction of processing (Art. 18): to require that we limit our processing in the circumstances provided for by the GDPR.
- Right to data portability (Art. 20): to receive the personal data you provided to us in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible.
- Right to object (Art. 21): to object at any time to processing based on our legitimate interests. Where you object to processing for direct marketing purposes, we will stop that processing without exception.
- Right to withdraw consent (Art. 7(3)): to withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
- Right to lodge a complaint (Art. 77): to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or of the alleged infringement.
To exercise any of these rights, contact us at order@repulos.com or contact our EU representative at the details given in section 2. We will respond without undue delay and in any event within one month of receiving your request. That period may be extended by a further two months where necessary, taking into account the complexity and number of requests, in which case we will inform you within one month of the reason for the delay.
Exercising your rights is free of charge. We may charge a reasonable fee, or refuse to act, where a request is manifestly unfounded or excessive.
10. Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, loss or destruction:
- connections to the Site are encrypted using HTTPS with a valid TLS certificate;
- access to databases is restricted to authorised persons;
- persons with access to personal data are bound by confidentiality obligations;
- security systems and software are updated on a regular basis;
- data is backed up regularly;
- partners who receive personal data are assessed for compliance with data protection requirements.
No method of transmission over the internet is entirely secure. Where a personal data breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, in accordance with Article 34 GDPR.
11. Automated decision-making
We do not carry out automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR.
12. Children
The Site is directed at adults. We do not knowingly collect personal data from persons under the age of 16. If you become aware that a child has provided us with personal data without the consent of a holder of parental responsibility, please contact us at order@repulos.com and we will delete that data.
13. Changes to this Policy
We may update this Policy from time to time. The current version is always published on this page together with the date of the last update.
Where changes are material, we will notify you by an appropriate means, such as a notice on the Site or a message sent to your email address. Where changes concern processing based on your consent, we will obtain fresh consent where the law requires it.
14. Contact
For all matters relating to the processing of your personal data and the exercise of your rights, please contact:
Controller Individual entrepreneur Olena Repulo (FOP Repulo Olena Borysivna), vul. Akademika Yanhelia 32, Vinnytsia, 21000, Ukraine
EU Representative (Art. 27 GDPR) Kateryna Nechyporenko, Office 509, Williama Heerleina Lindleya 16, 02-013 Warsaw, Poland
Email order@repulos.com
We respond to requests within the time limits set out in Article 12(3) GDPR.