PRIVACY POLICY

and Personal Data Processing Policy

Last updated: 20 July 2026

This Privacy Policy sets out the procedures for collecting, using, storing, protecting and transferring the personal data of users of elvira-cake-school.com, Telegram bots, private Telegram channels, groups and other Elvira Cake School services.

By using the Website or a Telegram bot, placing an order, purchasing a subscription or contacting customer support, the User confirms that they have read this Policy.

1. Personal Data Controller

The personal data controller is:

Individual Entrepreneur: ELVIRA STANISLAVIVNA MILCHENKO
Ukrainian Tax Identification Number: 3197509241
Contact email: info@elvira-cake-school.com
Website: elvira-cake-school.com

Hereinafter referred to as the “Controller.”

2. Who This Policy Applies To

This Policy applies to individuals who:

• visit the Website;
• register on the Website or create an account;
• purchase recipes, courses, subscriptions or other digital products;
• use Telegram bots;
• subscribe to the private Telegram Club;
• participate in private Telegram channels or groups;
• subscribe to informational or promotional communications;
• contact customer support;
• participate in surveys, promotions or other activities organised by the Controller.

3. Personal Data That May Be Processed

Depending on how the User interacts with the services, the Controller may process the following data:

3.1. Identification and Contact Data

• first and last name;
• email address;
• telephone number;
• Telegram ID;
• Telegram username;
• name displayed in the User’s Telegram account;
• other contact details voluntarily provided by the User.

3.2. Order and Subscription Data

• information about purchased products or services;
• subscription plan name;
• order or subscription price;
• order and payment date;
• subscription start and end dates;
• subscription status;
• payment status;
• information about subscription renewal or cancellation;
• information about the use of a trial period;
• order and payment history;
• promotional codes, discounts and special offers used by the User.

The Controller does not receive or store full payment card details where the payment is processed by a third-party payment service provider.

3.3. Website and Service Usage Data

• IP address;
• device, browser and operating system type;
• date and time of visits;
• pages viewed by the User;
• source from which the User accessed the Website;
• cookie files;
• technical logs and error data;
• interactions with advertising communications;
• data required to analyse the performance of the Website and advertising campaigns.

3.4. Enquiry and Communication Data

• messages sent by email, through Telegram, Website forms or customer support;
• reviews, questions and complaints;
• information voluntarily provided in surveys;
• communication history with the User.

The Controller does not intend to collect special categories of personal data, including health data, political or religious beliefs, ethnic origin or other sensitive information.

The User should not provide such data unless it is necessary for the consideration of a specific enquiry.

4. Sources of Personal Data

Personal data may be obtained:

• directly from the User;
• when an order or subscription is placed;
• through forms on the Website;
• through a Telegram bot;
• from a payment service provider to the extent necessary to confirm a payment;
• automatically when the Website is used;
• through analytics and advertising services;
• during communications with customer support;
• from partners or contractors, provided that the User has lawfully provided their data to them and agreed to such transfer.

5. Purposes of Personal Data Processing

Personal data is processed for the following purposes:

• registering and identifying the User;
• accepting and fulfilling orders;
• accepting and recording payments;
• providing access to purchased recipes, courses and other digital products;
• providing, renewing, terminating and administering subscriptions;
• providing access to the Telegram Club, channel, group or bot;
• verifying the User’s right of access;
• preventing repeated use of a trial period where the offer permits only one trial period;
• sending service communications relating to an order, payment, access or subscription;
• providing technical and informational support;
• reviewing enquiries, applications and complaints;
• complying with accounting, tax and other legal obligations;
• ensuring the security of the Website, Telegram bot and Club;
• preventing fraud, unauthorised access and breaches of the terms of use;
• analysing and improving the Website and services;
• conducting statistical and marketing research;
• displaying advertisements and evaluating their effectiveness;
• sending informational and promotional communications where permitted by law;
• protecting the rights and legitimate interests of the Controller.

Personal data will not be used for purposes incompatible with those specified in this Policy.

6. Legal Bases for Processing

The Controller processes personal data on the following legal bases:

• the necessity to enter into and perform a contract with the User;
• the necessity to provide the ordered digital product or service;
• compliance with obligations imposed by Ukrainian law;
• the User’s consent, where such consent is required;
• the legitimate interests of the Controller, including maintaining security, preventing violations, improving the service and protecting its rights;
• other legal bases provided for under Ukrainian law.

Where processing is based on consent, the User has the right to withdraw that consent. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

7. Service and Promotional Communications

The Controller may send the User service communications necessary for fulfilling an order or managing a subscription, including:

• payment confirmations;
• information about the provision of access;
• notifications about the expiry or renewal of a subscription;
• notifications about failed payments;
• notifications about changes to material terms of the service;
• responses from customer support.

Such communications form part of the service and may be sent without separate consent to receive promotional communications.

Informational and promotional communications may be sent by email, through Telegram or through other communication channels where there is an appropriate legal basis.

The User may unsubscribe from promotional communications by:

• clicking the unsubscribe link;
• using the relevant command in the Telegram bot;
• contacting info@elvira-cake-school.com.

Unsubscribing from promotional communications does not stop service communications necessary for the performance of the contract.

8. Disclosure of Data to Third Parties

The Controller may disclose personal data to third parties only to the extent necessary for the purposes specified in this Policy.

Such persons and services may include:

• payment systems and banks;
• Telegram;
• Telegram bot development and maintenance services;
• hosting and technical infrastructure providers;
• website and database management system providers;
• email and mailing service providers;
• analytics, statistics and advertising services;
• CRM systems and automation services;
• accountants, lawyers, technical specialists and other contractors;
• public authorities where required by law.

Such persons may access only the data necessary to perform their respective functions.

The Controller does not sell Users’ personal data to third parties.

9. Use of Telegram

Telegram is a third-party platform that independently determines how data is processed within its services.

When the User uses a Telegram bot or the Club, the Controller may receive access to the User’s Telegram ID, username, displayed name and other information provided by Telegram in accordance with its technical settings.

The User is responsible for managing the privacy settings of their Telegram account.

The Controller does not control Telegram’s operation, servers, data retention practices or changes to the platform.

10. Payment Data

Payments may be processed through third-party payment service providers.

During payment, the payment service provider may independently collect and process:

• payment card details;
• payer’s name;
• telephone number;
• email address;
• payment information;
• other data necessary to process the transaction.

Such data is processed by the payment service provider in accordance with its own privacy policy and terms of use.

The Controller may receive information from the payment service provider concerning the payer, payment amount, date, identifier and payment status, but does not receive full payment card details.

11. Cookies and Analytics Technologies

The Website may use cookies and similar technologies for:

• ensuring the proper operation of the Website;
• saving the User’s settings;
• enabling shopping cart and checkout functions;
• maintaining security;
• analysing traffic and User behaviour;
• evaluating advertising effectiveness;
• displaying relevant advertising.

The following types of cookies may be used:

• strictly necessary technical cookies;
• functional cookies;
• analytics cookies;
• advertising cookies.

The User may restrict or delete cookies through their browser settings. Disabling certain cookies may affect the operation of some Website functions.

Where the Website uses a cookie consent management mechanism, the User may change their preferences through the relevant settings panel.

12. Transfer of Data Outside Ukraine

Certain providers of technological, analytical, advertising, payment or communication services may locate their servers outside Ukraine.

As a result, personal data may be processed in other countries in accordance with the rules of the relevant service provider and applicable law.

The Controller uses such services only to the extent necessary for the operation of the Website, Telegram bot, Club, payment processing, communications and analytics.

13. Data Retention Period

Personal data is retained for no longer than necessary for the purposes for which it was collected, unless a longer retention period is required by law or necessary to protect the rights of the Controller.

In particular:

• account data may be retained for the duration of the User’s use of the services;
• order and payment data is retained for the periods required by accounting, tax and other applicable legislation;
• subscription data is retained during the subscription period and after its termination where necessary for record-keeping, handling enquiries or protecting legal rights;
• information about the use of a trial period may be retained to prevent repeated use;
• customer support communications may be retained until the enquiry is resolved and for the applicable period during which claims may be brought;
• data used for promotional communications is retained until the User unsubscribes, withdraws consent or the relevant processing purpose ceases;
• technical and analytical data is retained for the period determined by the settings of the relevant service.

After the retention period expires, the data is deleted, destroyed or anonymised unless otherwise required by law.

14. Protection of Personal Data

The Controller takes reasonable organisational and technical measures to protect personal data against:

• unauthorised access;
• accidental loss;
• destruction;
• alteration;
• copying;
• disclosure;
• other unlawful processing.

Access to personal data is provided only to persons who require it to perform their duties.

However, no method of transmitting or storing information over the Internet can guarantee absolute security.

If a security breach is identified, the Controller takes measures to limit its possible consequences and complies with applicable legal requirements.

15. User Rights

The User has the right to:

• know the sources from which their personal data was collected, where it is stored and the purposes of processing;
• receive information about the conditions under which access to personal data is provided;
• obtain access to their personal data;
• request correction of inaccurate or outdated data;
• object to data processing in cases provided for by law;
• request amendment or deletion of data where it is processed unlawfully or is inaccurate;
• withdraw consent where processing is based on consent;
• unsubscribe from promotional communications;
• submit complaints to the Controller or authorised public authorities;
• exercise other rights provided for under Ukrainian law.

A request to delete data may not be fulfilled where retention is necessary to comply with legal obligations, confirm payments, resolve a dispute or protect the rights of the Controller.

16. Children’s Data

The Website, digital products and Club are not intended for independent use by young children.

If an individual does not have sufficient legal capacity to place an order independently, the purchase must be made by their parent, guardian or other legal representative.

If the Controller becomes aware that a child’s personal data has been provided without the appropriate consent of a legal representative, such data may be deleted.

17. Third-Party Links

The Website, Telegram bot or Club may contain links to third-party websites and services.

The Controller does not control the privacy policies or data processing practices of such third-party resources.

Before using a third-party service, the User is advised to review its terms and privacy policy.

18. Changes to This Policy

The Controller has the right to amend this Policy due to changes in legislation, the functionality of the Website, Telegram bot or Club, or the methods of personal data processing.

The updated version becomes effective upon publication on the Website unless otherwise stated in the Policy itself.

The date of the latest update is stated at the beginning of the document.

In the event of material changes, the Controller may additionally notify Users through available communication channels.

19. Contact Information

To exercise their rights, obtain information about the processing of personal data or submit an enquiry, the User may contact:

Individual Entrepreneur: ELVIRA STANISLAVIVNA MILCHENKO
Email: info@elvira-cake-school.com
Website: elvira-cake-school.com

The enquiry must contain sufficient information to identify the User and describe the nature of the request.

The Controller may request additional information where necessary to verify the identity of the applicant and prevent unauthorised access to personal data.