Privacy policy
This Privacy Policy (“Policy”) has been developed in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (Russian Federation) and, to the extent applicable, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, “GDPR”). The Policy governs the collection, use, and protection of personal data of individuals who use the website https://iba-store.com/ (the “Website”).
The data controller is Limited Liability Company “Vernost Kachestvu” (LLC “Vernost Kachestvu”), INN 3906412640, KPP 390601001, OGRN 1223900004426, registered address: 142205, Moscow region, Serpukhov, 16 Fizkulturnaya str., Russian Federation, email: customer@iba-store.com (hereinafter – the “Operator” or “Controller”).
The Website is operated in Russian and English. Users who access the English-language version of the Website may be located outside the Russian Federation, including within the European Economic Area (“EEA”). Where the Operator offers goods to individuals in the EEA or monitors the behaviour of individuals in the EEA, this Policy applies in full, including the GDPR provisions set out herein.
1. KEY DEFINITIONS
For the purposes of this Policy:
– “Personal Data” means any information relating to an identified or identifiable natural person (“Data Subject”).
– “Processing” means any operation or set of operations performed on personal data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
– “Controller” means the entity that determines the purposes and means of the processing of personal data.
– “Processor” means an entity that processes personal data on behalf of the Controller.
– “Consent” means a freely given, specific, informed, and unambiguous indication of the Data Subject’s agreement to the processing of his or her personal data.
2. PERSONAL DATA WE COLLECT
2.1. When placing an order, registering an account, or contacting us, we may collect the following personal data:
– first name, last name;
– telephone number;
– email address;
– country, city;
– delivery address.
2.2. When you use the Website, we may automatically collect the following technical data through cookies and similar technologies:
– IP address;
– browser type and version;
– device type and operating system;
– pages visited and time spent on the Website;
– anonymised behavioural data collected via Yandex Metrica analytics service.
2.3. We do not collect special categories of personal data (such as data concerning health, racial or ethnic origin, political opinions, religious beliefs, or biometric data).
3. PURPOSES AND LEGAL BASES FOR PROCESSING
3.1. Order fulfilment and contract performance.
Purpose: processing your order, arranging delivery of goods, and managing returns and exchanges.
Legal basis (GDPR): Article 6(1)(b) – processing necessary for the performance of a contract.
Legal basis (RF): Federal Law No. 152-FZ, Article 6(1)(5) – processing necessary for the performance of a contract to which the data subject is party.
3.2. Compliance with legal obligations.
Purpose: fulfilment of tax, accounting, and other statutory obligations.
Legal basis (GDPR): Article 6(1)(c) – compliance with a legal obligation.
Legal basis (RF): Federal Law No. 152-FZ, Article 6(1)(2).
3.3. Marketing communications (with consent only).
Purpose: sending promotional and informational messages about our products, offers, and news via email, SMS, and messaging services (WhatsApp, Telegram).
Legal basis (GDPR): Article 6(1)(a) – consent of the data subject.
Legal basis (RF): Federal Law No. 152-FZ, Article 9; Federal Law No. 38-FZ of 13 March 2006 “On Advertising”, Article 18.
You have the right to withdraw your consent at any time by following the unsubscribe link in any message or by emailing us at customer@iba-store.com.
3.4. Website analytics and improvement.
Purpose: analysing user behaviour on the Website using Yandex Metrica to improve the Website’s functionality and content.
Legal basis (GDPR): Article 6(1)(a) – consent (given via the cookie banner on first visit).
Note: Yandex Metrica collects anonymised statistical data and does not enable the Operator to identify individual users. Data is processed on servers located in the Russian Federation and does not constitute a cross-border transfer of personal data within the meaning of Russian law.
4. RECIPIENTS OF PERSONAL DATA
4.1. We may share your personal data with the following categories of third parties solely to the extent necessary for the stated purposes:
– delivery service providers (CDEK, Yandex.Delivery, Russian Post, EMS, and other courier services) – for the purpose of delivering your order;
– payment service providers – for the purpose of processing your payment. Payments on the Russian-language version of the Website are processed via YooKassa (operated by NBCO “YooMoney” LLC). Payments on the English-language version of the Website are processed via Stripe (Stripe Payments Europe, Limited, a company incorporated in Ireland, and/or Stripe, LLC, United States). Stripe processes payment data as an independent data controller in accordance with its own Privacy Policy available at https://stripe.com/privacy. The Operator does not receive or store your full card details;
– Yandex LLC – for the purpose of Website analytics via Yandex Metrica (anonymised data only);
– competent authorities – where required by applicable law.
4.2. We do not sell, rent, or otherwise transfer your personal data to third parties for their own marketing purposes.
5. INTERNATIONAL DATA TRANSFERS
5.1. The Operator does not carry out cross-border transfers of personal data within the meaning of Russian Federal Law No. 152-FZ.
5.2. For users located in the EEA: the Operator is established in the Russian Federation. Russia is not recognised by the European Commission as providing an adequate level of data protection. Where your personal data is transferred to or processed in a third country, we rely on appropriate safeguards, including standard contractual clauses adopted by the European Commission, or we process data on the basis of your explicit consent (Article 49(1)(a) GDPR). Stripe, as payment processor, transfers data in accordance with its own Data Processing Agreement and standard contractual clauses. Further information is available at https://stripe.com/legal/dpa. Where personal data is transferred by the Operator itself to third countries, we rely on appropriate safeguards, including standard contractual clauses. Stripe, as an independent data controller, is solely responsible for its own international data transfers under its Data Processing Agreement.
6. DATA RETENTION
6.1. We retain personal data for no longer than is necessary for the purposes for which it was collected, or as required by applicable law. The standard retention period is 5 (five) years from the date of collection, or until consent is withdrawn, whichever is earlier, unless a longer period is required by law.
6.2. Anonymised analytics data collected via Yandex Metrica is retained for 5 (five) years.
7. YOUR RIGHTS
7.1. Under applicable law, you have the right to:
– access your personal data and receive a copy thereof;
– rectification of inaccurate or incomplete personal data;
– erasure of your personal data (“right to be forgotten”), subject to applicable legal obligations;
– restriction of processing of your personal data;
– data portability (GDPR users);
– object to processing based on legitimate interests or for direct marketing purposes;
– withdraw consent at any time, without affecting the lawfulness of processing prior to withdrawal;
– lodge a complaint with a supervisory authority.
7.2. Users in the Russian Federation may contact Roskomnadzor (rkn.gov.ru).
7.3. Users in the EEA may contact the supervisory authority in their country of residence. A list of EEA supervisory authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.
7.4. To exercise any of the above rights, please contact us at: customer@iba-store.com.
8. COOKIES
8.1. The Website uses cookies and similar technologies. For detailed information on the types of cookies used and how to manage them, please refer to our Cookie Policy available at https://iba-store.com/.
8.2. On your first visit to the Website, a cookie consent banner will be displayed. Analytical cookies (Yandex Metrica) are only set upon your acceptance. Technical (strictly necessary) cookies are set without additional consent.
9. DATA SECURITY
9.1. We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include, without limitation, access controls, encryption of data in transit, and regular security assessments. In the event of a personal data breach, we will notify the relevant supervisory authority within 72 (seventy-two) hours of becoming aware of the breach, and, where required, notify the affected data subjects without undue delay, in accordance with applicable law.
9.2. In the event of a personal data breach, we will notify the relevant supervisory authority and, where required, the affected data subjects in accordance with applicable law.
10. CHILDREN
10.1. The Website and its services are not directed at children under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected personal data from a child under 18 without verifiable parental consent, we will take steps to delete that information.
11. CHANGES TO THIS POLICY
11.1. We reserve the right to update this Policy at any time. The current version is always available on the Website. Material changes will be communicated via a banner on the Website.
12. CONTACT DETAILS
Data Controller: Limited Liability Company “VERNOST KACHESTVU” (LLC “Vernost Kachestvu”)
INN: 3906412640, KPP: 390601001, OGRN: 1223900004426
Registered address: 142205, Moscow region, Serpukhov, 16 Fizkulturnaya str., Russian Federation
Email: customer@iba-store.com
Website: https://iba-store.com/
Last updated: 12.05 2026
