Privacy policy

Privacy Policy

Last updated: September 20, 2026

AtticTreasuresUA is operated by Individual Entrepreneur Iryna Shramko, Ukraine.

This Privacy Policy explains how we collect, use, disclose, store, and otherwise process personal information when you visit our website, communicate with us, create an account, or make a purchase through AtticTreasuresUA.

Our store is powered by Shopify, which provides the e-commerce platform used to operate the website and process certain customer information.

For the purposes of applicable data protection laws, including the General Data Protection Regulation (“GDPR”) and UK GDPR where applicable, Individual Entrepreneur Iryna Shramko is the data controller of personal information processed in connection with operating AtticTreasuresUA, except where Shopify, a payment provider, or another service provider acts as an independent controller under its own privacy terms and applicable law.

Personal Information We Collect

Depending on how you interact with the store, we may collect or process the following categories of personal information:

• name;
• billing and shipping address;
• email address;
• phone number;
• payment and transaction information;
• account information and preferences;
• products viewed, added to cart, saved, purchased, returned, or cancelled;
• communications with us;
• device, browser, IP address, and similar technical information;
• information about how you use and interact with the website;
• cookie identifiers and similar online identifiers where applicable.

We do not intentionally collect more personal information than is reasonably necessary for the purposes described in this Privacy Policy.

Sources of Personal Information

We may collect personal information:

• directly from you when you place an order, create an account, contact us, subscribe to communications, or otherwise provide information;
• automatically through the website, including through cookies and similar technologies;
• from Shopify and other service providers that support the operation of the store;
• from payment processors, delivery providers, fraud-prevention providers, analytics providers, and other business partners where necessary.

How We Use Personal Information

We may use personal information to:

• process and fulfill orders;
• process payments;
• arrange shipping and delivery;
• provide customer support;
• administer returns, refunds, and cancellations;
• maintain customer accounts;
• communicate about orders and transactions;
• detect and prevent fraud, abuse, and security incidents;
• comply with legal, accounting, tax, and regulatory obligations;
• improve the website, products, and shopping experience;
• provide product recommendations and remember customer preferences;
• send marketing communications where permitted by law and, where required, with your consent;
• measure the effectiveness and performance of the website and marketing activities;
• maintain and defend legal claims and enforce our Terms and policies.

Legal Bases for Processing

Where the GDPR, UK GDPR, or equivalent legislation applies, we process personal information on one or more of the following legal bases.

Performance of a contract

We process personal information where necessary to enter into or perform a contract with you, including processing orders, payments, shipping, returns, refunds, and customer service requests.

Legal obligations

We may process personal information where necessary to comply with applicable tax, accounting, consumer protection, anti-fraud, regulatory, or other legal obligations.

Legitimate interests

We may process personal information where necessary for our legitimate business interests, including:

• operating and improving the store;
• protecting the store, customers, and transactions from fraud and misuse;
• responding to customer enquiries;
• maintaining appropriate business records;
• obtaining analytics about store performance;
• securing our systems and services;
• establishing, exercising, or defending legal claims.

Where we rely on legitimate interests, we consider and balance those interests against the rights and interests of the individuals concerned.

Consent

Where required by applicable law, we rely on consent for activities such as certain marketing communications, non-essential cookies, targeted advertising, or similar processing.

Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Payments

Payments may be processed with the assistance of Western Bid, Inc. and third-party payment service providers made available through Western Bid, as well as other payment providers available through Shopify.

These providers may receive information necessary to process transactions, prevent fraud, comply with legal requirements, and provide payment-related services.

The payment processor or payment recipient shown during checkout or on a payment statement may therefore differ from the AtticTreasuresUA trading name.

Payment providers may process personal information under their own privacy policies and may act as independent data controllers for certain processing activities.

We do not receive or store complete payment card credentials where payment information is processed directly by third-party payment providers.

Shopify

Our store is hosted and powered by Shopify.

Shopify processes personal information to provide, operate, secure, and improve the e-commerce services used by AtticTreasuresUA.

Information submitted through the store may be transmitted to Shopify and its service providers, including in countries outside your country of residence.

Depending on the service and processing activity, Shopify may process certain personal information on our behalf and may also process certain information as an independent controller under its own privacy terms.

You can learn more about Shopify’s privacy practices through Shopify’s Consumer Privacy Policy and Privacy Portal.

How We Disclose Personal Information

We may disclose personal information where reasonably necessary to:

• Shopify;
• Western Bid, Inc.;
• payment processors and financial service providers;
• postal operators, couriers, and shipping providers;
• IT, hosting, cloud, analytics, and technical service providers;
• customer support providers;
• fraud-prevention and security providers;
• marketing and advertising providers where permitted by law;
• professional advisers such as lawyers, accountants, or consultants;
• public authorities, regulators, courts, or law enforcement where legally required.

We may also disclose information in connection with a business restructuring, transfer, sale, merger, or similar transaction, subject to applicable law.

Service providers receive personal information only to the extent reasonably necessary for the services they provide or as otherwise permitted by applicable law.

International Transfers

Because AtticTreasuresUA operates internationally and uses service providers located in different countries, personal information may be transferred to, stored in, or processed outside the country where you reside.

Where personal information is transferred from the EEA, United Kingdom, or another jurisdiction that restricts international transfers, legally recognized transfer mechanisms or safeguards may be used where required, including adequacy decisions, Standard Contractual Clauses, or other permitted safeguards.

The specific transfer mechanisms applicable to information processed by Shopify or other independent service providers may be described in those providers’ own privacy and data protection documentation.

Cookies and Similar Technologies

The website may use cookies, pixels, local storage, and similar technologies to:

• operate essential store functions;
• remember preferences;
• maintain shopping cart and account functionality;
• prevent fraud and protect website security;
• measure website performance;
• provide analytics;
• support advertising, marketing, or personalization where permitted.

Where required by law, non-essential cookies or similar technologies will be used only after obtaining the required consent.

You may be able to manage cookie and privacy preferences through the consent tools available on the website and through your browser or device settings.

Disabling certain cookies may affect the functionality of parts of the website.

Marketing Communications

Where permitted by law, and where required with your consent, we may send marketing or promotional communications by email or other channels.

You may unsubscribe from marketing emails at any time using the unsubscribe link included in the message or by contacting us.

Opting out of marketing does not prevent us from sending non-promotional communications necessary to process orders, provide customer service, administer returns, protect transactions, or comply with legal obligations.

Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including:

• fulfilling orders and providing customer service;
• maintaining transaction, accounting, and tax records;
• complying with legal and regulatory obligations;
• resolving disputes;
• preventing and investigating fraud;
• establishing, exercising, or defending legal claims.

Retention periods may therefore vary depending on the type of information, the nature of our relationship with you, and applicable legal requirements.

When personal information is no longer required, it may be deleted, anonymized, or otherwise handled in accordance with applicable law.

Security

We use reasonable administrative, technical, and organizational measures intended to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure.

We also rely on security measures provided by Shopify and other service providers used to operate the store.

However, no electronic transmission, storage system, or online service can be guaranteed to be completely secure.

Please avoid sending unnecessary sensitive information through unsecured communication channels.

Your Privacy Rights

Depending on where you live, you may have rights in relation to your personal information, including the right to:

• access personal information held about you;
• obtain information about how your personal information is used;
• correct inaccurate or incomplete personal information;
• request deletion of personal information;
• request restriction of certain processing;
• object to certain processing;
• receive certain personal information in a portable format;
• withdraw consent where processing is based on consent;
• opt out of certain targeted advertising, profiling, sale, or sharing practices where applicable;
• lodge a complaint with a competent supervisory or regulatory authority.

These rights are subject to applicable legal conditions, limitations, and exceptions.

We may need to verify your identity before responding to a privacy request and may request additional information where reasonably necessary for verification.

We will not discriminate against you for exercising rights available under applicable privacy laws.

Additional Rights for EEA and UK Residents

If you are located in the European Economic Area or United Kingdom, you may in particular have the right to:

• object to processing based on legitimate interests;
• request restriction of processing;
• withdraw consent at any time where consent is the legal basis;
• request data portability where applicable;
• lodge a complaint with the competent data protection supervisory authority.

Information about EU supervisory authorities is available through the European Data Protection Board.

Targeted Advertising and Data Sharing Choices

Depending on your location, applicable law, and the privacy settings enabled for the store, you may have the right to opt out of certain uses or disclosures of personal information for targeted advertising or similar purposes.

Where applicable, you can exercise those choices through privacy or data-sharing controls made available on the website.

Shopify may also provide separate privacy controls for certain data it processes in connection with Shopify services.

Children’s Privacy

The store is not intended for children.

We do not knowingly collect personal information from children under the age at which they can lawfully provide consent or otherwise use the store independently in their jurisdiction.

If you believe a child has provided personal information to us improperly, please contact us so that the matter can be reviewed and appropriate action taken.

Third-Party Websites and Services

The website may contain links to third-party websites or services.

We are not responsible for the privacy, security, content, or practices of third-party websites or services that we do not control.

Please review the privacy policies and terms of those third parties before providing personal information to them.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business, services, technologies, legal obligations, or privacy practices.

The updated version will be posted on the website with a revised “Last updated” date.

Where required by applicable law, we will provide additional notice of material changes.

Contact

For questions about this Privacy Policy, our privacy practices, or to exercise your privacy rights, please contact:

AtticTreasuresUA
Operated by: Individual Entrepreneur Iryna Shramko
Ukraine
Email: hello@attictreasuresua.com 

For the purposes of applicable data protection laws, Individual Entrepreneur Iryna Shramko is the data controller of personal information processed in connection with operating AtticTreasuresUA, except where another provider acts as an independent controller under applicable law.