Privacy Policy

Effective date: 01.01.2025  |  Last updated: 26.04.2026

This Privacy Policy describes how Individual Entrepreneur Ivanovych Oleksiy Romanovych (hereinafter — "we", "us", "our"), operating under the trademark GYMFAST at gymfast.com.ua, collects, uses, stores, and protects the personal data of users (hereinafter — "you", "user") in accordance with the Law of Ukraine "On Personal Data Protection" dated 01.06.2010 No. 2297-VI and EU Regulation 2016/679 (GDPR).

By using our website, you agree to the terms of this Policy. If you do not agree — please stop using the website.

1. Data Controller

• Business entity: Individual Entrepreneur Ivanovych Oleksiy Romanovych
• Location: Kyiv, Ukraine
• Email: info@gymfast.com.ua
• Website: gymfast.com.ua

2. What Personal Data We Collect

2.1 Data you provide directly to us

• First and last name — for identification when placing an order
• Mobile phone number — for authentication, order confirmation, and communication
• Email address — for sending order confirmations and newsletters (only with your consent)
• Delivery address — city, Nova Poshta branch, or courier address
• Order comments — if you leave them
• Product reviews and ratings — if you publish them

2.2 AI assistant (chatbot) data

When using the AI assistant on the Website, the following data may be collected:

• Message text — your queries and the bot's responses are stored during the session to maintain conversation context
• The page from which the conversation is initiated — to provide relevant answers
• Anonymised logs of problematic dialogues — in the event of bot errors, to improve service quality (not linked to any individual)

Chat messages are processed by Anthropic (USA) via API to generate responses. Anthropic does not store data or use it to train models in accordance with its policy. We recommend not sending confidential information (passwords, card numbers, etc.) through the chat.

2.3 Automatically collected data

• IP address — for fraud protection and analytics
• Browser type and operating system
• Pages you visit — time on page, referral source
• Cookie and localStorage data — shopping cart, authentication, preferences, recently viewed products

2.4 Data from third parties

• Delivery status from delivery services (Nova Poshta, Ukrposhta)
• Payment confirmations from payment services (we do not store bank card data — it is processed directly by the payment service)

3. Purposes and Legal Bases for Data Processing

4. Cookies

Cookies are small text files stored in your browser. We use the following types:

Essential (technical)

These enable core website functionality: authentication, cart storage, session management. Without them the website will not function correctly. These do not require your consent.

Analytical (Google Analytics)

We use Google Analytics to analyse website traffic and user behaviour. Google may collect data in accordance with its Privacy Policy. Data is transferred to Google LLC (USA) and anonymised. You can opt out via the browser extension.

Functional

These remember your preferences: website language, recently viewed products, saved items.

You can manage your consent via the cookie banner on your first visit or through your browser settings.

5. Online Payments

Secure payment services (LiqPay, WayForPay, or others) are used to process payments on the website. When making a payment, you are redirected to the payment service's secure page.

We do not receive or store bank card details. All payment data is processed directly by the payment service in accordance with the PCI DSS standard.

We only receive confirmation of whether a payment was successful or unsuccessful.

6. Email Newsletters

If you have subscribed to our newsletter, we may send you emails about discounts, new arrivals, and promotions. Every email includes an option to unsubscribe with a single click.

We do not send spam. Your email address is not shared with third parties for marketing purposes.

7. Sharing Data with Third Parties

We do not sell or rent your personal data. Sharing is only possible with the following categories:

• Nova Poshta, Ukrposhta — name, phone, address — exclusively for order delivery
• Payment services — to process payments (we do not receive card data)
• SMS providers — to send verification codes (phone number only)
• Google LLC — anonymised analytics data (Google Analytics)
• Anthropic (USA) — chatbot message text for generating AI assistant responses (not stored)
• Government authorities — upon lawful request in accordance with Ukrainian law

8. Where Data Is Stored

Website data is stored on servers of the hosting provider Mirohost, located in Ukraine. Google Analytics data may be processed on Google's servers in the USA and EU.

9. Data Retention Periods

• Order data — 3 years (for accounting records)
• Account data — until account deletion or your request
• Session cookies — 3 days (authentication)
• Analytics data — up to 26 months (Google Analytics)
• Newsletter email — until unsubscription
• Reviews — until deleted by you or upon your request

10. Personal Data Security

• Secure HTTPS connection (SSL certificate)
• Restricted access — authorised personnel only
• Passwords and codes are not stored in plain text
• Regular data backups
• Payment data is processed under the PCI DSS standard

11. Your Rights

• Access — find out what data we hold about you
• Rectification — update incorrect data in your account or via a request
• Erasure — request deletion of your data ("right to be forgotten")
• Restriction of processing — restrict processing in certain cases
• Portability — receive your data in a structured format
• Objection — to processing based on legitimate interest
• Withdrawal of consent — unsubscribe from newsletters at any time

To exercise any right, write to info@gymfast.com.ua. We will respond within 30 days.

12. User Age

Our store sells products for all age groups, including sports goods for children. Orders on behalf of children are placed by their parents or legal guardians, who are responsible for the data provided.

13. Changes to the Policy

We may update this Policy. We will notify you of significant changes via the website or email. Continued use of the website after an update constitutes your acceptance of the new version.

14. Contact

• Owner: Individual Entrepreneur Ivanovych Oleksiy Romanovych
• Location: Kyiv, Ukraine
• Email: info@gymfast.com.ua
• Website: gymfast.com.ua

If you believe we are violating your rights regarding personal data, you have the right to lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua).