Privacy Policy

Effective date: 27 October 2026
Version: 1.1

1. Who is responsible for your data

This website is operated by Iuliana Kilchevskaya, an independent artist based in Chișinău, Republic of Moldova. In this policy, “I”, “me” and “the studio” mean Iuliana Kilchevskaya; “you” means the visitor or customer.

Contact for privacy questions and requests: [email protected]. I answer requests within one month, and within two additional months if the request is complex.

2. What this policy covers

This policy explains how personal data is handled when you visit iuki-art.com, contact the studio, create an account, place an order or use the site’s consent controls. It does not cover third-party websites reached from this site, including PayPal.

3. What data I collect

  • Enquiries. Your name, email address and the content of your message when you write to the studio. The site has no contact form; enquiries arrive by email.
  • Orders and account. Name, billing and delivery address, email address, telephone number, order contents, order value, payment status and correspondence connected with an order. Card and bank details are entered on PayPal’s own checkout and are not received or stored by this site.
  • Technical data. IP address, browser and device information, requested pages, referring page and security logs, processed by the hosting provider and Cloudflare when the site is accessed.
  • Measurement. Aggregated, cookieless page-view and performance data from Cloudflare Web Analytics: page URL, referrer, country, device type and web-performance measurements. This service does not use cookies or cross-site identifiers.
  • Consent data. Your cookie choices, the categories and services you allowed, the banner version, the version of the policy shown to you, the date and time, a hashed IP address, browser user agent and language. The raw IP address is not stored in the consent log.
  • Marketing and measurement data, only with your permission. If you allow Marketing, Google Tag Manager may load Google Analytics and Google Ads measurement tags. These can set Google analytics and advertising cookies and receive limited technical and interaction data.

4. Why I use it, and on what legal basis

  • To answer enquiries and provide information — steps taken at your request before a contract, and the studio’s legitimate interest in corresponding with visitors.
  • To process orders, payments and delivery — performance of a contract with you.
  • To keep accounts, tax and transaction records — compliance with legal obligations.
  • To protect the site, prevent abuse and diagnose faults — legitimate interest in a secure and functioning website.
  • To measure site performance and understand which pages are used — legitimate interest in improving the site and its presentation, using aggregated cookieless Cloudflare Web Analytics.
  • To load Google Tag Manager, Google Analytics and Google Ads — your consent, which you may withdraw at any time through Cookie settings.

Where I rely on legitimate interests, I have considered whether those interests are overridden by your rights. You may object to that processing at the address above.

5. Who receives data

Data is shared only where necessary with:

  • Top Gaming Setup — website hosting and server security.
  • Cloudflare, Inc. — content delivery, security and cookieless web analytics.
  • Automattic Inc. / WooCommerce — the website and e-commerce software.
  • PayPal — payment processing. PayPal acts under its own privacy policy.
  • Google LLC — Google Tag Manager, Google Analytics and Google Ads, only after Marketing consent.
  • Email and professional service providers — only when needed to answer an enquiry, fulfil an order or meet a legal obligation.
  • Public authorities — where required by law or a valid legal request.

I do not sell personal data. I do not use automated decision-making that produces legal or similarly significant effects.

6. International transfers

Some providers process data outside Moldova, including in the United States and the European Union. Where required, transfers rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and the providers’ data-processing terms. You may ask for more information about the safeguards used.

7. How long data is kept

  • Enquiries: for as long as needed to answer them, then normally up to 24 months, unless the correspondence becomes part of a contract or legal claim.
  • Orders, invoices and tax records: for the period required by Moldovan accounting and tax law.
  • Server and security logs: normally up to 90 days, unless needed to investigate an incident.
  • Consent records: while the relevant processing continues and for at least three years after it ends, to demonstrate compliance and handle claims.
  • Cloudflare Web Analytics: according to Cloudflare’s retention for aggregated measurement data; the site does not receive individual profiles.

When data is no longer needed, it is deleted or anonymised.

8. Your rights

Subject to the conditions in Law No. 195/2024, you have the right to:

  • access your personal data and receive a copy;
  • correct inaccurate or incomplete data;
  • request deletion;
  • restrict processing;
  • receive data you provided in a portable format;
  • object to processing based on legitimate interests, including direct marketing;
  • withdraw consent at any time, without affecting processing already carried out;
  • not be subject to a decision based solely on automated processing that produces legal or similarly significant effects;
  • lodge a complaint with the supervisory authority.

To exercise a right, email [email protected]. I may need to confirm your identity before acting. Requests are free of charge unless they are manifestly unfounded or excessive.

Supervisory authority: Centrul Național pentru Protecția Datelor cu Caracter Personal (CNPDCP), str. Serghei Lazo 48, MD-2004 Chișinău, Republic of Moldova; datepersonale.md; [email protected].

9. Cookies and choices

Essential cookies are used for the website, cart, account, security and consent storage. Google Tag Manager and Google Ads are loaded only if you allow Marketing. Cloudflare Web Analytics is cookieless. Full details and controls are in the Cookie Policy.

You can change or withdraw your choice at any time through Cookie settings or the small consent tab at the edge of the page.

10. Security

I use HTTPS, access controls, updated software, server-side security measures and limited administrative access. No system is completely secure; if a breach creates a high risk to your rights, I will notify you and the supervisory authority as required by law.

11. Children

The site is not directed at children under 14. If you are under 14, please use the site only with the permission of a parent or guardian. If I learn that I have collected data from a child under 14 without the required permission, I will delete it.

12. Changes and contact

This policy may be updated when the site, its services or the law changes. The effective date and version at the top show the current edition. Material changes will be announced on this page and, where appropriate, through the consent banner.

Controller and privacy contact: Iuliana Kilchevskaya, Chișinău, Republic of Moldova — [email protected].

Scroll to Top