For orders, terms and withdrawal: psytarot20@gmail.com. Checkout shows whether ordering and payment are available.
Version: 2026-10-31.v11-release-9
1. Who is responsible
The controller is Ukrainian sole proprietor ФОП Шевченко Євгенія Вікторівна, tax identification number 3131205090. Address: Ukraine, 07301, Vyshhorod, 11-B Kurhuzova Street, office 272. The practice operates remotely, including from a stable working base in Czechia, and may also operate from Ukraine and other countries. GDPR applies under Article 3(1) to personal data processing in the context of this base. Ukrainian personal data law also applies where relevant. For data rights or consent withdrawal: psytarot20@gmail.com. Acknowledging this policy is not blanket consent to all processing.
2. The website now
Enquiry forms send your name, contact, format and short question to Evgeniya at psytarot20@gmail.com for a response and pre-contract steps. Checkout stores the order, total and currency, active acknowledgement wording and timestamps, terms version, bank status and technical notification history. Server functions and persistent Netlify Blobs storage are used; these records are not stored on the provider’s personal computer. The current store uses the US us-east-2 region. Google Calendar receives the appointment time, order reference and minimal contact for a confirmed meeting; the private question is not sent there. Test mode does not create a real purchase. Your full card number and CVC are entered on mono’s official page; PsyTarot does not receive or store them.
3. Direct enquiries and service delivery
If you contact the provider through a website form, by email or an agreed messenger, your name, contact, correspondence and necessary enquiry details are processed to reply and prepare/perform a contract. For real sales, order and payment records serve performance, statutory accounting and handling claims; the website does not request card credentials. GDPR bases are pre-contractual steps and contract, legal obligation, and legitimate interests assessed against your rights for necessary security and claims protection. Mailing lists and advertising use of personal stories are outside these purposes. Do not send other people’s names or contacts, medical records or unnecessary detail.
4. Sensitive data and recording
Health, sex-life, belief information and other special categories are not requested in the payment form. If genuinely needed for agreed work, the categories, purpose, recipients and retention are separately explained before collection and explicit consent is obtained outside checkout. Without the necessary lawful basis, these data are not collected or used. Recording Zoom or Google Meet audio/video requires separate voluntary consent before recording begins; refusal still allows an unrecorded consultation. Recording consent does not authorise publication, advertising, AI training or automatic transcription. Consent may be withdrawn by email as easily as it was given, without affecting the lawfulness of processing before withdrawal.
5. File storage and delivery
Reading videos, card photographs and consultation recordings are stored on the provider’s personal computer hard drive. These files are to be deleted 30 calendar days after delivery of the result. Delivery is by email or an agreed Google Drive link, according to customer convenience. If a cloud copy or attachment in the provider’s sent email is created for delivery, provider-controlled copies are deleted and link access ends within the same period; material is not made public. Save your file before that period ends. Copies downloaded by the customer are under their control. Third-party service backups follow their own policies; instant erasure at third parties is not promised. Automatic deletion is not configured; the provider must carry out deletion manually.
6. Other retention, recipients and transfers
The 30-day period covers service videos, photos and recordings. Minimal payment and accounting records are kept for statutory periods; order and consent evidence and complaint-related correspondence are kept only as needed for performance and lawful claims. Ordinary correspondence is deleted when its enquiry purpose ends unless a lawful reason for further retention exists. Access to personal materials is restricted by the provider. Netlify hosts the website, Resend sends enquiries and service notifications, Gmail handles receipt and correspondence, and Zoom or Google Meet hosts meetings; agreed delivery may use Google Drive. mono handles payments under its banking obligations and policies. Processing terms, technical log retention and international transfers depend on the actual service and account settings. Applicable GDPR transfer grounds and safeguards are used; exclusive EU storage is not promised.
7. Your rights
Email psytarot20@gmail.com for access, correction, erasure, restriction, applicable portability, objection or withdrawal of consent. GDPR requests are normally answered within one month, subject to lawful extension with notice. Proportionate identity checks may be needed for security, without an automatic passport requirement. Necessary statutory retention may limit erasure. You may complain to the Ukrainian Parliament Commissioner for Human Rights and, where GDPR applies, a competent data protection authority, including in your EU country of habitual residence.
8. Service providers and international transfers
Netlify for the website and orders, and Resend for service emails, process entrusted data under DPAs incorporated in their service terms. Zoom includes a DPA for meeting data in its terms. A consumer Gmail/Google Drive/Google Meet account does not have a Google Workspace agreement: Google acts under its own terms and privacy policy as an independent controller, rather than our processor under a DPA. Forms need only a general enquiry and contact details; special-category information is not intended for automated enquiries and is discussed separately after the necessary confirmations. Processing may take place outside Ukraine and the EEA, including in the United States. Covered transfers to certified US recipients rely on the EU–US Data Privacy Framework; the applicable agreement's EU standard contractual clauses apply where appropriate. Ask psytarot20@gmail.com for recipient information and a copy of the safeguards for your transfer. Terms: https://www.netlify.com/pdf/netlify-dpa.pdf ; https://resend.com/legal/dpa ; https://policies.google.com/privacy ; https://www.zoom.com/en/trust/gdpr/ .
Cookies, hosting and external pages
Advertising and remote behavioural analytics are not connected, and optional analytics cookies are not set. The order reference and protected access key are stored in this browser to resume checkout for up to 30 days; expired entries are removed the next time checkout opens. A short request draft lasts for the tab session and is removed after continuing to payment. These data are not used for advertising. You can clear them in browser settings; you may then need to contact the provider to access an earlier order. Netlify hosting processes network requests, including IP and technical information, for site delivery and security. External video embeds are disabled. Google, Zoom or Google Meet, Telegram, YouTube and Boosty links open independent services governed by their policies. Optional analytics will require separate consent with an accessible refusal before activation.