Privacy policy

1. Who is responsible

The controller of your personal data is:

Фізична особа-підприємець Лореш Ольга Юріївна (individual entrepreneur Olha Yuriivna Loresh), проспект Лесі Українки, 71, кв. 41, м. Кременчук, Полтавська обл., 39600, Ukraine. Registration № 2 585 000 0000 028268 of 20 April 2018. Telephone +380 98 282 60 66. Email: [email protected].

The same person also trades as a sole trader (Einzelunternehmerin, Gewerbe) in Germany — Moorgrund 63, 22047 Hamburg — and that is the business that sells to customers in the European Union. Because there is an establishment inside the Union, no separate EU representative under Article 27 GDPR is appointed: that article applies to controllers who have no establishment in the Union at all. Details of both registrations are in the imprint.

2. What we collect, and why

When you send an enquiry

The form asks for your name, email address, country or city, the subject of your enquiry and your message. We use them for one purpose: to answer you and, if it goes further, to agree the terms of a purchase.

• One extra line: if you reached the page through a tagged link — one that carries utm_ parameters, as links we publish on social networks do — the enquiry also tells us which link it was, so we know which posts are worth making. If there are no tags, it says which site sent you, when the browser reveals that. Nothing is stored on your device and nothing is remembered between pages: the label is read from the address of the page you are on and travels only with the message you chose to send.
• Legal basis: your consent, which you give by ticking the box on the form (Article 6(1)(a) GDPR), and — once we are discussing an actual order — the steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).
• How it travels: the form posts to a small script on our own web server, which emails the enquiry to Olga's mailbox. There is no third-party form service in between. A copy is also written to a log file on the server so that nothing is lost if the mail fails.
• Retention: enquiries that do not lead to a purchase are deleted within 24 months, and the server log copy is cleared on the same schedule. Where a purchase follows, the correspondence is kept for as long as tax and accounting law requires.
• Consequence of not providing it: we cannot reply. Nothing else depends on it.
• Please leave out health and intimate details. An enquiry never needs them, and the form says so under the message field. If a message contains them anyway, we use them only to answer you and delete them together with the enquiry; they are not recorded anywhere else.

When you ask for the free guide

The guide form asks for your name and email address. The guide itself is shown for download straight away; nothing is sent to your mailbox automatically. We keep the name and address so that Olga can write to you now and then about upcoming tables.

• Legal basis: your consent, given by ticking the box on that form (Article 6(1)(a) GDPR).
• Withdrawing consent: reply to any letter with “unsubscribe”, or write to the address in section 1. We stop writing and delete the address.
• Retention: until you withdraw consent, and at most 24 months after the last letter you answered.

When you buy a set

To fulfil an order we process your name, delivery address, contact details, the language your set is printed in, and payment reference data.

• Legal basis: performance of a contract (Article 6(1)(b) GDPR) and compliance with legal obligations such as tax record-keeping (Article 6(1)(c) GDPR).
• Retention: for the statutory retention period applicable to commercial and tax records.

When you simply visit the site

The hosting provider records the usual server log data — IP address, date and time, the page requested, the referring page, browser and operating system — for the security and technical operation of the site.

• Legal basis: our legitimate interest in operating the site securely (Article 6(1)(f) GDPR).
• Retention: web server logs are written to our own disk space at the hosting provider and rotate automatically, so older entries are overwritten in the ordinary course — in practice within about a month. No fixed period is set by the hosting contract, and the provider's documentation does not state one either. The provider keeps its own backups for 7 days. At Cloudflare, which sits in front of the site, connection data is kept for short periods that depend on the type of record — of the order of 72 hours for firewall records and up to 30 days for traffic statistics. Beyond that we keep nothing from the logs, except that visits are counted in our own analytics if you agreed to it, and those records are deleted after 18 months (see section 3).

3. Cookies and measurement

This site sets one cookie of its own: it records whether you accepted or declined optional measurement, so you are not asked again on every page. It contains no identifier and expires after six months. It is strictly necessary in the sense of the ePrivacy rules and cannot be switched off.

No analytics or advertising cookies are set unless you accept them in the banner. If you decline, nothing is loaded and no measurement takes place. You can change your mind at any time by clearing the site's cookies in your browser, which brings the banner back.

If you do accept, the site loads Matomo, an analytics tool we run on our own server at olgaloresh.com. It is not Google Analytics and no measurement data goes to an advertising company. Matomo here is configured to set no cookies at all, so accepting buys us a count of visits rather than a way to follow you: it records the page you opened, the page that sent you, your approximate location, and your browser and device type. Your IP address is shortened before it is stored — the last part is replaced with zeroes, so it no longer identifies your connection. The individual records are deleted automatically after 18 months; what remains after that is anonymous totals, such as how many people opened a page in a given month, which cannot be traced back to a visit.

4. Who else sees your data

Your data is not sold, rented or passed to anyone for their own purposes. It is handled by:

• hostpro.ua, the hosting provider that runs this website and stores its files and server logs on servers in Ukraine, and processes that data to keep the site running.
• Cloudflare, Inc., which sits in front of the site to serve it quickly and filter malicious traffic, and therefore processes connection data. Records are kept only briefly — see the retention note in section 2. Cloudflare processes this data on our behalf under its Data Processing Addendum, which is part of its customer agreement on every plan and incorporates the EU Standard Contractual Clauses; Cloudflare is also certified under the EU–US Data Privacy Framework.
• Google, because enquiries are read in a Gmail account. There is also a mailbox on the loreshgames.com domain, but it forwards to the same Gmail account, so either way your message ends up on Google's servers, which are partly outside the EU, and Google's own terms apply to it. The form deliberately delivers straight to Gmail rather than through the domain mailbox: forwarding adds a hop that breaks sender authentication, and enquiries were being filed as spam.
• The postal or courier service that carries your parcel, which needs your name and delivery address to deliver it.

Production and dispatch are handled by the seller's own German business, so your order details are not passed to any printing or fulfilment company along the way.

The two typefaces on this site are served from our own server, not from Google Fonts. No font request leaves for a third party, and no IP address reaches Google when a page loads.

5. Where your data is processed

The controller is established in Ukraine, which the European Commission has not recognised as offering an adequate level of data protection, and this website is hosted there. What you send through the site goes directly to us in Ukraine and is read and answered from there. Your messages and order details are processed there because that is necessary to answer you and, if you order, to prepare and perform the contract you ask for (Article 49(1)(b) GDPR). The GDPR applies to everything we do with your data, and the rights in section 6 apply in full.

Orders from the European Union are fulfilled by the seller's German business. That business and the Ukrainian sole trader are the same person; order details pass between them only as far as fulfilment, invoicing and tax records require.

6. Your rights

Under the GDPR you may ask us to:

• confirm what data about you we hold, and give you a copy of it (Article 15);
• correct anything inaccurate (Article 16);
• delete it (Article 17), unless we are legally required to keep it;
• restrict how we use it (Article 18);
• hand it over in a portable format (Article 20);
• stop processing carried out on the basis of legitimate interest (Article 21).

Where processing is based on consent, you can withdraw it at any time. Withdrawal does not affect what was lawfully done before it. Write to the contact above and you will receive an answer within one month.

You also have the right to complain to a supervisory authority — in the EU, the data protection authority of the country where you live or work.

7. What we deliberately do not do

• No newsletter is sent unless you separately ask for one.
• No advertising or profiling cookies, and no automated decision-making.
• No sessions are recorded or photographed, and no participant is named in anything we publish. Stories from games are published only when the participant has given written permission, and details are changed.
• Nothing you write in an enquiry is used as marketing material.

8. Changes

If this policy changes, the new version appears on this page with a new date below.

Last updated: 22 October 2026