Privacy Policy
Last updated: 10 July 2026
This Privacy Policy explains what personal data we collect on the website at nattaliepiano.com (the "Site"), why we collect it, and what your rights are. We try to keep this brief and human-readable.
1. Who controls your data
Your personal data is controlled by Nataliia Kuzmina, a sole proprietor (ФОП) registered in Ukraine ("we", "us"). You can reach us about anything in this policy at privacy@nattaliepiano.com.
2. What we collect, and why
We collect the minimum data needed to run the Site and serve you:
- Contact form. When you write to us via the contact form, we receive your name, email, subject, and message. We use this only to reply.
- Telegram channel. If you follow our Telegram channel, we don't collect anything ourselves — that's between you and Telegram.
- Email list. If you ask for the free songbook, we add your address to our mailing list so we can send you the occasional letter about new sheet music. We also add you when you buy something (see below). Every letter carries a one-click unsubscribe, and you can leave at any time.
- Purchases. When you make a purchase, Paddle.com Market Limited processes the payment on our behalf. Paddle collects your email, billing address, and payment details. We receive from Paddle: your email, the items you bought, and the amount paid (so we can deliver your purchase and answer questions). We never see your card number. Because you're now a customer, we also add your address to our email list to tell you about new sheet music — related to what you bought, never anything else. We tell you this at checkout, before you pay, and you can unsubscribe from the very first letter.
- Server logs. Our hosting and CDN provider keeps short-term technical logs (IP address, browser type, requested URL) for security and to debug problems. These rotate out after a few weeks.
- Analytics (optional). If we have Google Analytics enabled, it loads only after you accept analytics cookies on our consent banner. See our Cookie Notice.
3. Legal basis (GDPR)
If you're in the EU, the UK, or another jurisdiction that recognises a similar framework, the legal bases under which we process your data are:
- Performance of a contract — for delivering purchases you've made.
- Legitimate interest — for keeping the Site running and secure (server logs, fraud prevention), and for emailing existing customers about sheet music similar to what they bought. This is the "soft opt-in" permitted by UK PECR reg. 22(3) and the equivalent ePrivacy rules: we tell you at checkout, and every letter lets you leave in one click.
- Consent — for optional analytics cookies, and for the email list when you sign up for the free songbook. You can withdraw either at any time.
4. Who else sees your data
- Paddle — payment processing and tax handling. See Paddle's Privacy Policy.
- Resend — delivers our emails and stores the mailing list. See Resend's Privacy Policy.
- Hosting and CDN provider — handles request delivery and short-term technical logs (see above).
- Google — if analytics is enabled, anonymised usage data flows to Google Analytics 4. See Google's Privacy Policy.
These providers process data on our instructions only. We do not sell your data, and we do not share it with anyone else for their own marketing.
5. How long we keep it
- Contact-form messages: kept while we may need them to follow up; routinely purged after 24 months.
- Mailing list: kept until you unsubscribe.
- Purchase records: kept for the period required by Ukrainian tax law (usually 3 years), then deleted.
- Server logs: rotated out by our hosting provider within weeks.
- Analytics data (if enabled): retained per Google Analytics 4 defaults (currently 14 months).
6. Your rights
Where applicable law gives you these rights (e.g. under the GDPR), you can:
- request a copy of the personal data we hold about you;
- ask us to correct inaccurate data;
- ask us to delete your data (subject to retention obligations);
- object to processing or ask us to restrict it;
- withdraw consent for any processing based on consent.
Email privacy@nattaliepiano.com with your request. We respond within 30 days.
You also have the right to lodge a complaint with the supervisory authority in your country (in Ukraine, the Office of the Ombudsperson).
7. Children
The Site is not directed at children under 16. If you believe a child has given us personal data, please contact us so we can delete it.
8. International transfers
Some of our service providers (e.g. Paddle, Resend, our hosting/CDN provider, Google) are based outside Ukraine and the EEA. Where data is transferred, we rely on those providers' standard contractual clauses and similar safeguards.
9. Changes to this policy
We may update this Policy. Material changes will be announced on the Site, and the "Last updated" date at the top will change.