Privacy Policy

The controller is the sole proprietor trading as Grand Straps, registered in Ukraine: Mykola Bublyk. Enquiries are read and answered by the proprietor personally. There is no staff, no shared access and no call centre.

Two processors act on our instructions — the host this site runs on, and the provider of the mailbox we reply from. Both are named in clause 04, and there are no others. Telegram is not a processor of ours: it carries the enquiry from the form to the phone it is read on, but it does so under its own terms, not on our instructions — clause 04 explains what that means and how to avoid it.

For anything to do with your data, write to sales@grandstraps.com or message us on Telegram. We answer within two working days. A formal request under Articles 15 to 22 of the GDPR is answered within one month, which Article 12(3) allows us to extend by a further two months where a request is complex — if that ever happens we will tell you inside the first month, and why.

name

So a reply can address a person, and so a carrier can release a parcel.

email

The only channel an enquiry is answered on. It is also where terms and any invoice go, because those have to exist as a record.

country

It decides import duty and which carriers can serve you. Without it an answer would be a guess.

message

Whatever you choose to write. If you name a watch model we use it to check the fit, and for nothing else.

shipping address and telephone

Collected later, by email, only once an order is actually going ahead. Neither is asked for on this site. The telephone number exists because an international waybill cannot be created without one; it goes onto the waybill and is used for nothing else.

correspondence

What you send us by email or Telegram stays in that mailbox or chat, as in any other.

We do not collect a date of birth, an identity document, a payment card, a location, or any device profile for advertising. There is no field for any of them and no code that reads one.

• —Article 6(1)(b) — steps prior to a contract, and performance of it. Answering an enquiry about a specific piece, agreeing terms, and shipping it.
• —Article 6(1)(f) — legitimate interests. Two, both narrow: keeping the enquiry form from being used by spam scripts, and keeping a record of what was sold to whom for as long as a warranty or a dispute could arise. Neither involves profiling and both are balanced against your interests.
• —Article 6(1)(c) — legal obligation. Accounting and tax records for completed sales.

We do not process data for marketing, and there is no mailing list to be on. If you receive a message from us it is an answer to yours or the status of your order.

carrier

Name, address and telephone number, for a parcel that is actually being sent. This is the minimum that is physically printed on a waybill.

hosting

The site runs on a self-managed server in the EU. The host sees request logs; it has no access to enquiry content.

Telegram

What you put in the enquiry form is delivered to us as a Telegram message: your name, email, country and text pass through Telegram Messenger Inc. and are handled under its own privacy policy. Telegram is an independent operator, not a processor acting on our instructions. Writing to the email address below instead avoids that route entirely.

email

The mailbox we answer from is operated by our email provider under a processor agreement.

authorities

Only on a written demand made under law, and only within the scope of that demand.

Nobody else. No CRM, no advertising audience upload, no data broker, no analytics processor — because there is no analytics.

Telegram is not merely one of the ways to reach us — it is how the enquiry form itself delivers. If Telegram handling your details is not acceptable to you, send the same enquiry to sales@grandstraps.com and it never touches them.

Start from the size of the thing. One person reads the mail. There is no CRM holding a history of you, no analytics watching you move around the site, no advertising trackers, no audience uploads and no broker anywhere in the chain — all of which is set out in clauses 01 and 04 and is what makes the next sentence what it is.

Your name, your email and your country are read in Ukraine, by one person, in order to answer you. If that is not acceptable to you, do not send the form — and the email route does not avoid it either, because it is read in the same place by the same person.

The controller is in Ukraine, and Ukraine does not hold an adequacy decision from the European Commission. An earlier draft of this page said that it does. That was wrong, and it is corrected here rather than quietly deleted.

Two different things happen, and they are not governed by the same rule:

• —You writing to us. When you fill in the form on this site, or send an email, you are giving your details directly to a trader established in Ukraine. That is direct collection by a non-EU controller, not a transfer under Chapter V of the GDPR — there is no EU exporter in the middle of it.
• —Our own infrastructure. The site is hosted in the EU and the mailbox is with an EU provider, so your enquiry does sit on EU infrastructure before it is read from Ukraine. That leg — from an EU processor back to a controller outside the EEA — is a transfer, and it needs a basis of its own.

The mechanism for that leg is being put in place: the data processing agreements with the host and with the mail provider — which is where the Standard Contractual Clauses for a transfer of this kind sit — are in the course of being accepted. This page will name them, and say from when, once they are; it does not claim them before. What crosses in the meantime is what you sent us yourself — a name, an email and a country — read by one person in order to answer you.

The delivery of the enquiry form through Telegram is a separate leg. Telegram does not enter into Standard Contractual Clauses with individual shops; that transfer rests on Article 49(1)(b) GDPR — it is necessary in order to take the steps you yourself requested by sending the enquiry, it happens once per enquiry, and its scope is the four fields of the form. The email route described in clause 04 remains available to anyone who prefers to avoid it.

• —An enquiry that does not become an order — 12 months, then deleted. Long enough to recognise a returning buyer asking about the same piece; short enough not to be a filing cabinet.
• —A completed sale — 3 years, which is how long a warranty or a description dispute can realistically run.
• —Accounting records for a completed sale — as long as Ukrainian tax law requires, currently 3 years from the reporting period. This period cannot be shortened on request.
• —Server request logs — 30 days.

This site sets one cookie, and it is not about you:

currency

Remembers which of the currencies offered on this site prices are shown in, so the server can render the figure you picked instead of a default that corrects itself after loading. It holds one short word — the code of the currency — and expires twelve months after you last set it.

It is strictly necessary for a service you have explicitly requested, which is the one category that does not require consent under the ePrivacy Directive. There is therefore no cookie banner, and adding one would be theatre.

The language you are reading is not stored at all: it is part of the address — this tree is English, and the Ukrainian one lives under /ua. An earlier version of this page said a second cookie remembered it. That cookie was removed from the site and the sentence should have gone with it.

If analytics or any third-party measurement is ever introduced, that stops being true and a consent mechanism becomes mandatory. It would be added at the same time, not later.

Under the GDPR, and in substance under Ukrainian data protection law, you may:

• —ask what we hold about you and receive a copy (access);
• —have an inaccuracy corrected (rectification);
• —have it erased, subject only to records we are legally required to keep (erasure);
• —receive it in a portable, machine-readable form (portability);
• —object to processing carried out on legitimate interests, or ask that it be restricted;
• —withdraw consent at any time where consent was the basis.

Write to sales@grandstraps.com. No form, no scanned identity document for an ordinary request, and no department to be referred to. We do what was asked and write back saying what was done.

You also have the right to complain to a supervisory authority — the data protection authority of the EU member state where you live or work, the Information Commissioner’s Office in the United Kingdom, or the Ukrainian Parliament Commissioner for Human Rights. You do not have to come to us first, though we would rather you did.

• —Enquiries arrive in a private chat read by the proprietor alone, on his own device. There are no shared logins, no exports and no second reader.
• —The site is served over TLS and sets no third-party script of any kind.
• —No payment credentials exist in our systems: nothing is charged through this site.
• —No paper copies are kept beyond the documents accounting rules require.

If this policy changes, the revision date at the top of the sheet changes with it. The version in force is the one published here when your enquiry was sent. We do not extend what we collect without saying so first, and we do not apply changes retroactively.