Privacy Policy

The controller is the sole proprietor trading as Grand Straps, registered in Ukraine: Mykola Bublyk. Enquiries are read and answered by the proprietor personally. There is no staff, no shared access and no call centre.

One processor acts on our instructions — Cloudflare, through whose network every visit to this site passes and which counts those visits. It is named in clause 04, and there is no other. The server the site runs on is the proprietor’s own, in Ukraine; no hosting company is involved. Telegram and email are not processors of ours: Telegram carries the enquiry from the form to the phone it is read on, and email to our address is forwarded by Porkbun to a Gmail inbox, but each of them does so under its own terms, not on our instructions — clause 04 explains what that means.

For anything to do with your data, write to [email protected] or message us on Telegram. We answer within two working days. A formal request under Articles 15 to 22 of the GDPR is answered within one month, which Article 12(3) allows us to extend by a further two months where a request is complex — if that ever happens we will tell you inside the first month, and why.

name

So a reply can address a person, and so a carrier can release a parcel.

email

The only channel an enquiry is answered on. It is also where terms and any invoice go, because those have to exist as a record.

country

It decides import duty and which carriers can serve you. Without it an answer would be a guess.

message

Whatever you choose to write. If you name a watch model we use it to check the fit, and for nothing else.

shipping address and telephone

Collected later, by email, only once an order is actually going ahead. Neither is asked for on this site. The telephone number exists because an international waybill cannot be created without one; it goes onto the waybill and is used for nothing else.

correspondence

What you send us by email or Telegram stays in that mailbox or chat, as in any other.

visit statistics

For every page view: the address of the page, the site that linked to it, the browser and device type, the country, and how fast the page loaded. Counted by Cloudflare Web Analytics and shown to us only as totals — per page, per country, per day. Nothing in them is tied to you or to an enquiry, and there is no identifier that would let anyone tie it. See clause 07.

We do not collect a date of birth, an identity document, a payment card, a precise location, or any device profile for advertising. There is no field for any of them and no code that reads one.

• —Article 6(1)(b) — steps prior to a contract, and performance of it. Answering an enquiry about a specific piece, agreeing terms, and shipping it.
• —Article 6(1)(f) — legitimate interests. Three, all narrow: keeping the site and its enquiry form safe from attacks and spam scripts; knowing, in aggregate, which pages are read and whether they load quickly; and keeping a record of what was sold to whom for as long as a warranty or a dispute could arise. None involves profiling and each is balanced against your interests.
• —Article 6(1)(c) — legal obligation. Accounting and tax records for completed sales.

We do not process data for marketing, and there is no mailing list to be on. If you receive a message from us it is an answer to yours or the status of your order.

carrier

Name, address and telephone number, for a parcel that is actually being sent. This is the minimum that is physically printed on a waybill.

Cloudflare

Every request to this site passes through Cloudflare, Inc., which provides the encrypted connection, keeps attacks away from the server, and counts visits through Cloudflare Web Analytics. Because the encrypted connection ends at Cloudflare, an enquiry also passes through it on its way to us. Cloudflare acts as our processor under its data processing addendum and does not use the data for its own purposes.

server

The site itself runs on the proprietor’s own server in Ukraine. Its request logs — address, time and page asked for — stay on that machine.

Telegram

What you put in the enquiry form is delivered to us as a Telegram message: your name, email, country and text pass through Telegram Messenger Inc. and are handled under its own privacy policy. Telegram is an independent operator, not a processor acting on our instructions. Writing to the email address below instead avoids that route entirely.

email

Mail to our address is forwarded by our domain registrar, Porkbun (United States), to a Gmail inbox, where Google stores it and from which we reply. Both handle it under their own terms and privacy policies; neither is a processor acting on our instructions.

authorities

Only on a written demand made under law, and only within the scope of that demand.

Nobody else. No CRM, no advertising audience upload, no data broker, and no analytics beyond the aggregate counts described in clause 07.

Telegram is not merely one of the ways to reach us — it is how the enquiry form itself delivers. If Telegram handling your details is not acceptable to you, send the same enquiry to [email protected] and it never touches them.

Start from the size of the thing. One person reads the mail. There is no CRM holding a history of you, no analytics following you from page to page, no advertising trackers, no audience uploads and no broker anywhere in the chain — all of which is set out in clauses 01 and 04 and is what makes the next sentence what it is.

Your name, your email and your country are read in Ukraine, by one person, in order to answer you. If that is not acceptable to you, do not send the form — and the email route does not avoid it either, because it is read in the same place by the same person.

The controller is in Ukraine, and Ukraine does not hold an adequacy decision from the European Commission. An earlier draft of this page said that it does. That was wrong, and it is corrected here rather than quietly deleted.

Two different things happen, and they are not governed by the same rule:

• —You writing to us. When you fill in the form on this site, or send an email, you are giving your details directly to a trader established in Ukraine. That is direct collection by a non-EU controller, not a transfer under Chapter V of the GDPR — there is no EU exporter in the middle of it.
• —Our processor. The site’s server is in Ukraine, but every request reaches it through Cloudflare, a US company whose network has servers in the EU and elsewhere. That leg — through a processor and back to a controller outside the EEA — is a transfer, and it needs a basis of its own.

The mechanism for that leg is being put in place: Cloudflare’s data processing addendum — which is where the Standard Contractual Clauses for a transfer of this kind sit — is in the course of being accepted. This page will name them, and say from when, once they are; it does not claim them before. What crosses in the meantime is what you sent us yourself — a name, an email and a country — read by one person in order to answer you.

The delivery of the enquiry form through Telegram is a separate leg. Telegram does not enter into Standard Contractual Clauses with individual shops; that transfer rests on Article 49(1)(b) GDPR — it is necessary in order to take the steps you yourself requested by sending the enquiry, it happens once per enquiry, and its scope is the four fields of the form. The email route described in clause 04 remains available to anyone who prefers to avoid it.

Email is a leg of the same kind. A message you send to our address passes through Porkbun and is stored by Google, neither of which signs Standard Contractual Clauses for a personal inbox; it too rests on Article 49(1)(b), because you sent it in order to be answered.

• —An enquiry that does not become an order — 12 months, then deleted. Long enough to recognise a returning buyer asking about the same piece; short enough not to be a filing cabinet.
• —A completed sale — 3 years, which is how long a warranty or a description dispute can realistically run.
• —Accounting records for a completed sale — as long as Ukrainian tax law requires, currently 3 years from the reporting period. This period cannot be shortened on request.
• —Request logs on our server — no longer than 30 days.
• —Cloudflare’s own request logs and the visit statistics — for as long as Cloudflare’s terms set; the statistics are totals and hold nothing that identifies you.

This site sets one cookie, and it is not about you:

currency

Remembers which of the currencies offered on this site prices are shown in, so the server can render the figure you picked instead of a default that corrects itself after loading. It holds one short word — the code of the currency — and expires twelve months after you last set it.

It is strictly necessary for a service you have explicitly requested, which is the one category that does not require consent under the ePrivacy Directive. There is therefore no cookie banner, and adding one would be theatre.

The language you are reading is not stored at all: it is part of the address — this tree is English, and the Ukrainian one lives under /ua. An earlier version of this page said a second cookie remembered it. That cookie was removed from the site and the sentence should have gone with it.

Visits are counted with Cloudflare Web Analytics, chosen because it needs no cookie. It sets none, stores nothing in your browser’s local storage, and does not fingerprint your browser or device. A small script from Cloudflare (static.cloudflareinsights.com) reports which page was opened, which site linked to it and how quickly it loaded; Cloudflare adds the country and the browser type it already sees on every request. What reaches us is totals — page views per page, per country, per day — never a list of visits and never a visitor.

If a measurement tool that does keep something in your browser, or recognises you from one visit to the next, is ever introduced, a consent mechanism will be added at the same time, not later.

Under the GDPR, and in substance under Ukrainian data protection law, you may:

• —ask what we hold about you and receive a copy (access);
• —have an inaccuracy corrected (rectification);
• —have it erased, subject only to records we are legally required to keep (erasure);
• —receive it in a portable, machine-readable form (portability);
• —object to processing carried out on legitimate interests, or ask that it be restricted;
• —withdraw consent at any time where consent was the basis.

Write to [email protected]. No form, no scanned identity document for an ordinary request, and no department to be referred to. We do what was asked and write back saying what was done.

You also have the right to complain to a supervisory authority — the data protection authority of the EU member state where you live or work, the Information Commissioner’s Office in the United Kingdom, or the Ukrainian Parliament Commissioner for Human Rights. You do not have to come to us first, though we would rather you did.

• —Enquiries arrive in a private chat read by the proprietor alone, on his own device. There are no shared logins, no exports and no second reader.
• —The site is served over TLS. The only third-party script on it is Cloudflare’s visit counter described in clause 07; there are no advertising or social-network scripts.
• —No payment credentials exist in our systems: nothing is charged through this site.
• —No paper copies are kept beyond the documents accounting rules require.

If this policy changes, the revision date at the top of the sheet changes with it. The version in force is the one published here when your enquiry was sent. We do not extend what we collect without saying so first, and we do not apply changes retroactively.