PRIVACY POLICY AND USE OF COOKIES

This Privacy Policy forms an integral part of the Terms of Service and the Public Agreement that you concluded with us at the time of ordering the service (creating an order).

It also applies if you have ordered a derivative service (e.g. a cash on delivery) from another company (e.g. a partner). At the same time, these third parties may also have their own privacy policies (other similar documents) that apply when collecting your personal details. Furthermore, this Privacy Policy and the Use of Cookies shall apply to the personal data of the recipient on whose behalf the shipment is made.

I. GENERAL INFORMATION

1. This Privacy Policy and the Use of Cookies represents a set of rules for the processing of personal data and the collection of cookies (hereinafter referred to as the “Policy”) NOVA POSHTA LLC with its registered office at 03026, Kyiv, Stolichne shose, 103, building 1, floor 9, National State Registry of Ukrainian Enterprises and Organizations code: 31316718 (hereinafter referred to as the “NOVA POSHTA LLC” or “Administrator” or “Company”), incl. on the website https://novaposhta.ua/ (hereinafter referred to as the “Service”), which defines what data we collect about consumers using our services, as well as about other persons whose personal data we process in the course of our activities, including job applicants. This Policy also applies to the processing of personal data and communication on the Company's social media (e.g., Facebook, Instagram, Linkedin, Google), by phone, email or letter, as well as how we use it and with whom we share it. This information also outlines the measures we take to protect your personal data.

2. Users can contact the Administrator as follows:

A. By letter to: NOVA POSHTA LLC, 03026, Kyiv, Stolichne shose, 103, building 1, floor 9;

B. By e-mail: info@novaposhta.ua;

C. By phone: +380-800-500-609

For more reliable protection of personal data, the Company has appointed a Data Protection Officer (DPO) — Serhii Zimenkov.

If you have any questions, comments or wishes regarding the protection and processing of your personal data, you can contact the DPO in the following convenient way:

A. By letter to: NOVA POSHTA LLC, 03026, Kyiv, Stolichne shose, 103, building 1, floor 9;

B. By e-mail: dpo@novaposhta.ua

In all correspondence, be sure to include your full name, email address, and the nature of your question, comment, complaint, or request.

3. The personal data refers to any information relating to an identified or identifiable individual. The scope of this type of data includes, but is not limited to: first name, last name, address, telephone number and e-mail address. Data that cannot be traced back to an identified or identifiable individual (e.g., statistical data) is not considered personal data.

II. APPLICABLE LEGISLATION ON PERSONAL DATA PROTECTION AND CONFIDENTIALITY OBLIGATIONS

1. NOVA POSHTA LLC is subject to the Law of Ukraine “On the Protection of Personal Data” dated 01.06.2010 No. 2297-VI and the provisions of the Regulation of the European Parliament and of the Council (EC) 2016/679 of April 27, 2016 On the protection of individuals with regard to the processing of personal data and the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the “GDPR”), as well as other applicable national laws on the personal data protection.

III. PROTECTION OF INFORMATION

1. NOVA POSHTA LLC, applying appropriate technical and organizational measures, makes all physical and technical efforts to protect personal data from loss, damage, disclosure to unauthorized persons, alteration or misuse.

2. All notifications regarding the protection of personal data are registered and explained in detail and analyzed in accordance with applicable legislation.

IV. RIGHTS OF DATA SUBJECTS

1. It is our pleasure to inform you of your rights regarding the processing of personal data in accordance with the legislation of Ukraine, namely to:

• 1
  Know the sources of collection, the location of your personal data, the purposes of their processing, the location or place of residence (stay) of the owner or administrator of personal data or give a corresponding mandate to receive this information to persons authorized, except for cases established by law;
• 2
  Receive information about the terms of providing access to personal data, including information about third parties to whom personal data is disclosed;
• 3
  Access your personal data;
• 4
  Receive a response on whether your personal data is processed no later than thirty calendar days from the date of receipt of the request, except as provided by law, as well as to receive the content of such personal data;
• 5
  Submit a reasoned request to the owner of personal data to object to the processing of your personal data;
• 6
  Submit a reasoned request to change or destroy your personal data by any owner and administrator of personal data if this data is processed illegally or if it is inaccurate;
• 7
  Protect your personal data from unlawful processing and accidental loss, destruction, damage due to intentional concealment, failure to provide or untimely provision, as well as to protect against the provision of information that is inaccurate or defamatory of the honor, dignity and business reputation of an individual;
• 8
  File complaints regarding the processing of your personal data to the Human Rights Commissioner of the Verkhovna Rada of Ukraine or to the court;
• 9
  Apply for legal remedies in case of violation of the legislation on personal data protection;
• 10
  Enter a disclaimer on the limitation of the right to process one's personal data when giving consent;
• 11
  Withdraw consent to the processing of personal data;
• 12
  Know the essence of mechanism of automated processing of personal data;
• 13
  Be protected from an automated data processing solution that entails legal consequences.

2. Other rights of personal data subjects in accordance with the GDPR

In addition to the Ukrainian legislation on the protection of personal data, NOVA POSHTA LLC is committed to ensuring your rights under the GDPR, namely to:

A. Receive information and have access to data concerning you (data subject's right of access as per Art. 15 of the GDPR);

B. Correct your personal data that is inaccurate and update your data (right to data rectification as per Art. 16 of the GDPR);

C. Request the deletion of your personal data (right to data deletion as per Art. 17 of the GDPR);

D. Request to terminate the processing of your data (right to restrict processing as per Art. 18 of the GDPR);

E. Request the transfer of data to another administrator (right to transfer data as per Art. 20 of the GDPR);

F. Object to the processing of your personal data (right to object as per Art. 21 of the GDPR).

V. EXERCISE OF RIGHTS UNDER THE GDPR

• 1
  Access to personal data. You shall have the right to request confirmation from us as to whether we are processing personal data relating to you and, in such cases, to request access to your personal data that we are processing, or to provide information about the personal data if direct access is unavailable.
• 2
  Correction of personal data. If you believe that information about you is inaccurate or incomplete, you shall have the right to request us to correct it.
• 3
  Withdrawal of consent. Since we process your personal data based on your consent, you shall have the right to withdraw your consent to the processing of personal data at any time.
• 4
  Objection to data processing for the purpose of providing direct marketing and sending commercial & marketing information. You shall have the right to object to the processing of your personal data for the purpose of targeted advertising at any time.
• 5
  Objection to processing based on legitimate interests. You shall have the right to object to the processing of personal data that we process based on our legitimate interests, however, we will continue to process your data even though you object unless we have legitimate reasons to continue processing it. To exercise the above rights, please send a written request to us or our DPO as set out in Section 1 hereof.
• 6
  Removal. In certain circumstances, you have the right to ask us to delete your personal data, but this does not apply where the law requires us to retain the data. To exercise the above rights, please send a written request to us or to our DPO as specified in Section 1 of this Policy.
• 7
  Restrictions on processing. Under certain circumstances, you shall have the right to restrict the processing of your personal data. Please note that if you make a request to restrict the processing of your data, this may affect your ability to receive our services. To exercise the above rights, please send a written request to us or our DPO as specified in Section 1 hereof.
• 8
  Data transfer. Finally, you shall have the right to receive or transfer your personal data to another Data Administrator. These rights only include data that you have provided to us based on your consent or contract and where the processing is automated. To exercise the above rights, please send a written request to us or our DPO as specified in Section 1 hereof.

VI. CATEGORIES OF PERSONAL DATA. PURPOSES OF THEIR PROCESSING AND LEGAL GROUNDS

1. With a view to providing the Services and fulfilling the Agreement with its customers (Senders, Recipients) [As per Art. 6(1b) of the GDPR], NOVA POSHTA LLC in its capacity as Administrator processes the following required data:

A. Customer data (registration data, customer contact persons' data, i.e. first name, last name, phone number, signature, e-mail address);

B. Sender data (shipping address and necessary contact data, signature, payment information and other data required to perform the service ordered by the Sender);

C. Recipient data (first name and last name, signature, address, postal code, city, country and, optionally, other data required for the implementation, provided to the Data Administrator by the Sender of the shipment or specified by them as the Recipient, in particular, e-mail address, phone number).

2. The provision of personal data is voluntary, but necessary for the performance of the Services provided by NOVA POSHTA LLC. If the Sender provides additional personal data of the Recipient with regard to the selection of one of the Additional Services, the Sender shall be responsible for the correct collection of this data, in particular, for obtaining the consent of the Recipient for their transfer to NOVA POSHTA LLC.

3. In some cases, data is also processed:

A. On the basis of the consent [As per Arts. 1(a) and 7 of the GDPR] – in particular, for marketing purposes or in relation to data voluntarily provided by the Recipient with regard to the delivery of the shipment.

B. On the basis of the legitimate interests of the Administrator [As per to Art. 6(1)(f) of the GDPR] — in particular, for the following purposes: control of solvency, compliance programs or sanctions, surveys (including those conducted by phone) regarding satisfaction with the services provided (as well as for analyzing the results of surveys conducted withtin the framework of this survey, and the possibility of feedback from the person providing the feedback), video surveillance.

4. NOVA POSHTA LLC, in its capacity as a registered postal operator, also processes personal data for the purpose of fulfilling its legal obligations [According to Art. 6(1)(c) of the GDPR] arising, in particular, from the Law of Ukraine “On Post” and the Law of Ukraine “On Accounting and Financial Reporting in Ukraine” (e.g., proper calculation for the provided service, consideration of complaints).

5. The use of the website and application of NOVA POSHTA LLC may involve the processing of personal data for the following purposes:

A. Placement of an order and measures aimed at its fulfillment.

B. Tracking shipments [As per Art. 6(1)(b) of the GDPR] – the parcel number is to provide information on the status of the parcel.

C. Inquiries via the contact form [As per Art. 6(1)(f) of the GDPR] – data sent through the contact form, such as: first name and last name, address, postal code, city, e-mail address, necessary for processing and responding to the request; [As per Art. 6(1)(a) of the GDPR] consent to the processing of personal data, incl.: e-mail address, phone number, is required for communication in relation to the submission of a commercial offer.

D. Communication with the consultant via chat [As per Art. 6(1)(f) of the GDPR] – the data sent during the conversation with the consultant, such as e-mail address, first name and last name, address, postal code, city, are processed for the purpose of verifying the question raised and replying to it.

E. Parcel forwarding [As per Art. 6(1)(b) of the GDPR] – through the website of NOVA POSHTA LLC. The Recipient is given the opportunity to change the delivery address if they are unable to receive the parcel in person. For this purpose, we collect the following personal data:

1.a. First name and last name of the Recipient or company name;

1.b. Street / House No.;

1.c. Postal code / Place of residence;

1.d. E-mail address and a description of the desired location.

6. Geolocation. Your Personal Data, including information on your location, is processed so that you can find the nearest branch/post office. The use of this feature is not obligatory and is not required for the proper use of the application. The legal basis for the processing of this data is your consent (As per Art. 6(1)(a) of the GDPR), expressed in the form of an authorization in the mobile app “Answear – fashion store” to use the location services of your smartphone. Consent can be withdrawn at any time by revoking the authorization for the mobile app to access the location information in your smartphone. The withdrawal of consent does not affect the lawfulness of the processing for which consent was granted before its withdrawal.

7. Direct marketing and sales promotion. To inform you about promotions and new offers of products and services, the Administrator will process your data as provided during registration on the Website/in the Application. The legal basis for data processing is the legitimate interest of the Administrator, which consists in the direct marketing of the Administrator's products and services (Art. 6(1)(f) of the GDPR).

A. Sending commercial and marketing information using electronic means of communication and push notifications. With a view to informing you about promotions and new products related to the joint offer of products and services of the Administrator and Partners using electronic means of communication (SMS, e-mail, push notifications), the Administrator will process your data, for which you have voluntarily granted consent to their use as stated herein. The legal basis for the data processing is the consent obtained by the Administrator (Art. 6(1)(a) of the GDPR). You shall have the right to withdraw your consent at any time, and the withdrawal of consent shall not interfere with the lawfulness of processing based on such consent prior to its withdrawal.

8. Recruitment of candidates. In the course of the recruitment process, the following categories of your personal data will be processed as required and on a legitimate basis.

• 1
  Basic data (full name, date of birth), if applicable;
• 2
  Contact details (address, phone number, e-mail address, etc.), if applicable;
• 3
  Application details (CV, motivation letter, certificates, references, interview recordings as well as any data you provide to us or wish to provide in the course of the interview);
• 4
  Photo, video, if applicable;
• 5
  Citizenship and work permit, if applicable;
• 6
  Work-related health records, if applicable;
• 7
  Criminal records, if applicable to the position being offered, e.g. for drivers;
• 8
  Data that you have provided through publicly available platforms used for occupational purposes, subject to the applicable TCs of the company responsible for operating the platform;
• 9
  Communication and means of communication (e.g. confirmation of your application or telephone/video interview details, if applicable).

Beyond these categories of data, to evaluate each job application, we also require data that speaks to your suitability for the relevant position.

To manage our relationship with you, including:

• 1
  To assess your suitability for the position (purpose), the legal basis for the processing shall be the performance of a contract;
• 2
  To set up and conduct (video) interviews (purpose), the legal basis for the processing shall be the performance of a contract;
• 3
  To verify your data against applicable sanctions lists and laws (purpose), the legal basis for the processing shall be either a) legal obligation or b) legitimate interest.

We collect the data directly from you when you submit details on our website in the “Career” section or otherwise. Once you use another communication channel, such as through publicly available platforms used for career-related purposes, such as LinkedIn, we will process your data in accordance with the applicable TCs of that particular platform. In case of cooperation with recruitment agencies, we receive your data indirectly. These agencies are responsible for ensuring the accuracy of the data and transferring it to us in accordance with applicable laws.

9. Video surveillance. We monitor and process your personal data during your visits to our branches/offices, both for your personal safety and for the security of our employees, customers and assets. Video surveillance is carried out in compliance with strict security and confidentiality rules based on the state-of-the-art technology and hardware. Video surveillance records are stored within our systems for a period of up to 30 calendar days.

10. Registration and recording of telephone conversations. Personal data and categories of data subjects in the register.

The following identification data of phone calls are recorded:

• 1
  Start and end time of the call;
• 2
  Subscriber number;
• 3
  The service number called;
• 4
  Full name and phone number of the official.

All calls to service numbers are recorded. The calls are recorded in a predefined manner. The recording starts after the call is picked up and ends with an end tone.

The following chat and chatbot session details are recorded:

• 1
  Session time;
• 2
  The name of the consultant and the customer indicated in the chat.

Chat sessions save the content of the session between the customer and the consultant, whereas chatbot sessions save the content of the session between the automated chatbot and the customer.

The content of the chatbot sessions is primarily collected from the website and other publicly available sources. At the beginning of the session, customers are provided with instructions for use.

The customer is not asked any personal questions, and they, in turn, cannot ask personal questions using the chatbot service. If the customer provides digital identification data, such as a phone number, in the chatbot service, the data is automatically erased in an hour.

If we send an SMS request to a customer who contacted our service number by phone, the following data is recorded:

• 1
  Request time;
• 2
  Customer phone number;
• 3
  Written responses of the customer to the request.

The following data is registered for the identification of customers who receive information about the actual beneficial owners:

• 1
  Name of the customer and identification code.

VII. DATA EXCHANGE

1. NOVA POSHTA LLC is entitled to provide personal data to:

A. All companies that are directly and/or indirectly owned or controlled by the same ultimate beneficial owners as NOVA POSHTA LLC, as well as subcontractors (for example, transport partners, operating parcel pickup points or parcel storage facilities) within or outside Ukraine and the European Union for the purpose of delivering parcels from the Sender to the Recipient [As per Art. 49(1)(b) and (c) of the GDPR];

B. Entities that are parties to a service agreement with or on behalf of NOVA POSHTA LLC (Data Processors), in particular IT service providers;

C. Other persons or organizations pursuant to the applicable legislation;

D. Banks and payment providers to carry out the transaction (including payments made using codes);

E. Law enforcement officials and authorities to comply with national security requirements or as part of a legal proceeding involving the protection of property, or to continue to investigate a violation of the principles and policies of NOVA POSHTA LLC, unauthorized access to or use of NOVA POSHTA LLC equipment, or any other illicit conduct.

F. Cellular operators (PJSC “VF Ukraine” (EDRPOU code 14333937) and/or PJSC “KYIVSTAR” (EDRPOU code 21673832) and/or LLC “LIFECELL” (EDRPOU code 22859846)), which provide the Customer with telecommunication services and process data related to the provision of such services (hereinafter referred to as the “Operator”), the following data: known telephone number of the Customer in the mobile (cellular) network of the Operator to prevent unauthorized access and protect interests from third-party fraudulent actions.

2. Only the Sender and the Recipient shall have the right to receive information about the shipment. NOVA POSHTA LLC can provide such information to other persons only in the cases set out by the relevant provisions of the law, including in the Law of Ukraine “On Personal Data Protection”.

VIII. TERM OF DATA STORAGE AND DELETE

1. NOVA POSHTA LLC processes personal data only for the period required to achieve the purpose for which they were collected. The data storage period is determined based on the following requirements:

A. Operational requirements: the period during which the data is necessary for the performance of the Services provided.

B. Legal requirements: the period during which NOVA POSHTA LLC shall store the data for a specified period of time to comply with the applicable legislation.

C. Legitimate interests of NOVA POSHTA LLC: the period during which the data is processed for the purpose of their fulfillment, in particular, to identify and resolve any claims arising from the Services provided.

2. What kind of data do we collect and how do we use it?

3. Once anonymized, archived data is available only to authorized personnel. At the end of the retention period, the data is permanently deleted.

IX. TRANSFER OF PERSONAL DATA TO COUNTRIES THAT ARE NOT MEMBERS OF THE EEA

1. Personal data are transferred to third countries in case the services provided by NOVA POSHTA LLC shall also be performed on the territory of a third country. Personal data may also be transferred to subcontractors of NOVA POSHTA LLC (e.g., organizations that deliver a parcel on the territory of a third country) and organizations that provide tax, legal, audit and settlement advice to NOVA POSHTA LLC, if they operate in a third country.

2. NOVA POSHTA LLC does not transfer personal data to international organizations.

3. NOVA POSHTA LLC does not transfer personal data to third countries, if this is impossible or contrary to generally accepted legislation.

4. The level of protection of personal data outside the European Economic Area (EEA) does not coincide with the level provided for by European legislation. Thus, NOVA POSHTA LLC transfers personal data outside the EEA only when necessary, ensuring an adequate level of data protection, mainly via:

A. Cooperation with subjects of personal data processing in countries for which the relevant resolution of the European Commission has been issued to ensure an adequate level of personal data protection;

B. The use of standard contractual provisions issued by the European Commission, provided that an adequate level of personal data protection is ensured;

5. In the case of a justified intention to transfer personal data outside the EEA, in addition to the aforementioned, NOVA POSHTA LLC will notify thereof at the appropriate stage of data processing pursuant to applicable legislation.

X. INFORMATION ON DATA COLLECTED THROUGH THE WEBSITE

1. Event logs and cookies. Each time a user browses the NOVA POSHTA LLC website, data is stored in a log file. The scope of temporarily stored data includes:

A. IP address of the computer from which the request was sent;

B. Domain name;

C. Date and time of the access;

D. Response code http ;

E. Pages visited;

F. Name and version of the operating system;

G. Browser name and version;

H. Screen resolution.

2. The use of the NOVA POCTA LLC websites may be associated with the use of cookies by the servers of NOVA POCTA LLC. These files are used by the website administrators. Each user can configure their browser settings so that it does not accept cookies. In this case, no data will be stored on the visitor's computer. The information stored in cookies will not be sent to NOVA POSHTA LLC.

XI. COOKIES

1. Cookies are Internet data, in particular text files, which are stored on the end device (computer, smartphone, tablet) of the User. First of all, they contain the name of the website of their origin, their unique number and the time of storage on the end device. Cookies are used to provide the Administrator with statistical information about the User's traffic, user activity and the way the Service is used. They allow you to customize content and Services according to the User's preferences.

2. We provide the most important information regarding how we use cookies:

A. The Cookies are not used to obtain any data about the Users, except for information about their browsing behavior on the pages of the Service.

B. The Administrator stores cookies on Users' computers to:

1.a. Properly adapt the Service to the needs of the Users and optimize the use of websites;

1.b. Memorize the preferences and customized settings of the User, recognize the User's device and properly display the website in accordance with its needs (full version, mobile version);

1.c. Create website viewing statistics that helps to understand how Users use the websites, thus improving website structure and content;

1.d. Maintain the User's session (after logging in), so that the User does not need to re-enter the login and password on each subpage of the Website;

1.e. Save the shopping cart data in the online store so as not to lose it after visiting the Service again.

3. The Website uses two main types of cookies: session and persistent. Session cookies are temporary files that are stored on the website user's end device until the user logs out, leaves the website or closes the software (web browser). Persistent cookies are stored on the website user’s end device for the time specified in the cookie settings or until they are deleted by the website User.

4. The Service uses two main types of cookies:

• 1
  “Necessary” cookies that allow you to use the services available on the Website, such as authentication cookies that are used for services that require authentication on the Website, cookies that are used to ensure security, such as those that are used to detect authentication fraud on the Website;
• 2
  “Functional & Analytical” cookies that allow “remembering” the settings selected by the user and personalizing the user interface, for example with regard to the language or region selected by the user, font size, appearance of the website and allowing the collection of information on how the pages of the website are used, etc.;
• 3
  “Advertising” cookies that allow Website Users to provide advertising content that is more relevant to their interests.

5. When you first visit the website, you will be shown information about the use of cookies. The use of the website requires the processing of “necessary” cookies. The processing of other cookies is possible after granting consent to the use of cookies in accordance with the provisions hereof. You can always withdraw your consent by changing the cookie settings in your browser. These settings can be changed, in particular, in such a way as to block the automatic processing of cookies in the web browser settings or to inform each time they are stored on the website user’s end device. Detailed information on the possibilities and methods of processing cookies is available in the software (web browser) settings.

“Advertising” and “Analytical” cookies stored on the website user’s end device may also come from the Administrator's partners and may be further used for analytical and marketing purposes. Detailed information thereon can be found in the privacy policy of such a partner. The Administrator uses the following analytical and marketing tools provided by partners:

a. Google Ads – files used by Google to configure advertising in its services, for example in the search engine or to display advertising on the Internet, for more information see: https://policies.google.com/technologies/partner-sites

b. Facebook pixels – files used to match advertising on Facebook services to the individual preferences of the recipient, for more information see: https://www.facebook.com/privacy/policies/cookies/

c. Google Analytics – files used to analyze how users use the website, create statistics and reports, for more information see: https://policies.google.com/technologies/partner-sites

XII. BLOCKING COOKIE FILES

1. In many cases, web browsers by default allow cookies to be stored on the user's end device. Website users can change their cookie settings at any time, e.g., to block the automatic processing of cookies or to notify each time they are stored on the website user's device. Detailed information on the possibilities and methods of processing cookies is available in the browser settings or:

A. in the Internet Explorer browser;

B. in the Mozilla Firefox browser;

C. in the Google Chrome browser;

D. in the Safari browser;

E. in the Opera browser;

2. However, the Administrator informs that restricting the use of cookies may affect some functions available on the Website pages.

XIII. COMPLAINTS

1. If you have a complaint about how NOVA POSHTA LLC processes your data, please submit it in writing, providing as much detail as possible, using the contact details provided in Section I hereof. NOVA POSHTA LLC will cooperate with you to resolve any issues without delay.

2. The personal data protection authority in Ukraine is the Office for Protection of Personal Data of the Secretariat of the Commissioner of the Verkhovna Rada of Ukraine for Human Rights. You can address your complaints or suggestions to it if you believe that your rights have been violated in respect of the personal data processing.

XIV. CHANGES TO THIS POLICY

1. Any changes that NOVA POSHTA LLC may make to this Privacy Policy in the future will be published on the website: https://novaposhta.ua/. New terms and conditions will be displayed on the screen and you may be required to read and accept them in order to continue using any/all NOVA POSHTA LLC Services.

This version of the Policy was updated on 09/15/2023