Privacy policy

Welcome to Agathia Devotional Arts (“Company,” “we,” “us,” or “our”). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and make purchases from us.

Please read this policy carefully. If you disagree with its terms, please discontinue use of our site.

This Privacy Policy has been designed to comply with applicable laws in the jurisdictions where we operate, including:

• The General Data Protection Regulation (GDPR) — European Union
• The California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) — United States
• Federal Law No. 152-FZ “On Personal Data” — Russian Federation

We collect personal information that you voluntarily provide when you:

• Create an account or register on our website
• Place an order or make a purchase
• Sign up for our newsletter or marketing communications
• Contact us with inquiries or support requests
• Participate in surveys, promotions, or events

This information may include:

• Identity data — full name, username or similar identifier
• Contact data — email address, phone number, shipping and billing address
• Financial data — payment card details, processed securely through our payment provider; we do not store full card numbers
• Transaction data — details of products you have purchased from us
• Communications data — your preferences for marketing materials and other communications

When you visit our website, we automatically collect certain technical data, including:

• Device and browser data — IP address, browser type and version, operating system, device identifiers
• Usage data — pages visited, time spent on pages, links clicked, referring URLs
• Cookie data — see Section 09

We may receive personal information about you from third parties, including:

• Payment processors (e.g., Stripe, PayPal)
• Shipping and logistics partners
• Analytics providers (e.g., Google Analytics)
• Social media platforms, if you interact with our social media pages

If you are located in the European Economic Area (EEA), we process your personal data only when we have a valid legal basis to do so:

Where we rely on legitimate interests, we have assessed that our interests do not override your fundamental rights and freedoms.

We use the personal information we collect for the following purposes:

• Order fulfilment — to process and deliver your purchases, send order confirmations, and manage returns and refunds
• Account management — to register and maintain your customer account
• Customer support — to respond to your questions, complaints, and requests
• Marketing — to send promotional emails, newsletters, and information about new products, only where you have given consent or where we have a legitimate interest under applicable law
• Personalisation — to tailor the website experience and product recommendations based on your preferences
• Legal compliance — to comply with applicable laws, regulations, court orders, and governmental requests
• Security and fraud prevention — to detect, investigate, and prevent fraudulent transactions and other illegal activities
• Business analytics — to analyse usage trends and improve our website and services

We will not use your personal data for purposes incompatible with those described above without notifying you and, where required, obtaining your consent.

We do not sell your personal information. We may share your data with the following categories of third parties:

• Service providers — companies that provide services on our behalf, including payment processors, shipping carriers, email service providers, hosting providers, and analytics platforms. These parties are contractually obligated to process your data only on our instructions and in accordance with applicable law.
• Business partners — where necessary to fulfil your order, e.g. customs agents for international shipments
• Legal authorities — where required by law, court order, or governmental regulation, or to protect our rights, property, or safety, or that of others
• Business transfers — in connection with a merger, acquisition, sale of assets, or other corporate transaction, in which case we will notify you before your personal data is transferred

All third-party service providers are required to maintain appropriate security measures to protect your personal data.

Agathia Devotional Arts operates internationally. Your personal data may be transferred to and processed in countries other than your country of residence, including the United States and countries where our service providers are based.

When we transfer your personal data outside the EEA, we ensure appropriate safeguards are in place, including transfers to countries recognised by the European Commission as providing an adequate level of protection, Standard Contractual Clauses (SCCs) approved by the European Commission, and Binding Corporate Rules where applicable.

Personal data of Russian citizens is stored on servers located within the Russian Federation, in accordance with Article 18 of Federal Law No. 152-FZ. Cross-border transfer of personal data may be carried out only after ensuring that the recipient country provides adequate protection of personal data rights, or after obtaining your explicit consent.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, and to comply with legal, tax, and accounting obligations.

When personal data is no longer needed, we securely delete or anonymise it.

Depending on your country of residence, you may have the following rights regarding your personal data.

• Access — obtain a copy of the personal data we hold about you
• Rectification — request correction of inaccurate or incomplete data
• Erasure — the right to be forgotten — request deletion under certain circumstances
• Restriction — request that we limit how we use your data
• Data portability — receive your data in a structured, machine-readable format and transfer it to another controller
• Object — to processing based on legitimate interests or for direct marketing
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing
• Lodge a complaint — with your local data-protection supervisory authority

• Know — request disclosure of the categories and specific pieces of personal information collected, the purposes, third parties involved, and whether it has been sold or disclosed
• Delete — request deletion, subject to certain exceptions
• Correct — request correction of inaccurate personal information
• Opt-out of sale or sharing — we do not sell personal information; if this ever changes you will be notified and given the opportunity to opt out
• Limit sensitive information — restrict use of sensitive personal information to only what is necessary for the service
• Non-discrimination — we will not discriminate against you for exercising any of these rights

To submit a CCPA request, you may designate an authorised agent by providing written permission; we may verify the identity of the agent before fulfilling the request.

• Access — obtain information about the processing of personal data
• Clarification & correction — request updates or corrections to inaccurate, incomplete, or outdated data
• Blocking & deletion — request that we cease processing or delete data if it is unlawfully processed, incomplete, or no longer necessary
• Withdrawal of consent — at any time; withdrawal does not affect processing that has already taken place
• Objection — to the processing of personal data for marketing purposes

Personal data of Russian citizens collected via our website is processed with the consent of the data subject, as required under Article 9 of Federal Law No. 152-FZ. Consent is obtained electronically at the time of registration or order placement. We are registered as a personal-data operator and comply with all applicable requirements of Roskomnadzor.

We will respond to verified requests within 30 days, or within the timeframe required by applicable law. We may ask you to verify your identity before processing your request.

Our website uses cookies and similar tracking technologies to enhance your browsing experience, analyse site traffic, and deliver personalised content.

Cookie consent. On your first visit you are presented with a cookie consent banner. Strictly necessary cookies are placed automatically; all other cookies are set only with your consent. You may withdraw or change your cookie preferences at any time via the cookie settings link in the footer.

You can also control cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the website.

Our website and services are not directed at children under the age of 16, or 13 in the United States. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected information from a child, please contact us immediately and we will delete it promptly.

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

• SSL / TLS encryption for all data transmitted between your browser and our servers
• Encrypted storage of sensitive data
• Access controls and authentication procedures for our staff
• Regular security assessments and audits

However, no method of electronic storage or transmission over the internet is completely secure. We cannot guarantee absolute security, but we are committed to addressing any data breach in accordance with applicable law and notifying affected individuals as required.

Our website may contain links to third-party websites. We have no control over the content or privacy practices of those sites and are not responsible for their privacy policies. We encourage you to review the privacy policy of any third-party site you visit.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Post the updated policy on this page with a revised “Last updated” date
• Notify you by email, if you have an account with us, or by displaying a prominent notice on our website

We encourage you to review this policy periodically to stay informed about how we protect your information.

If you have questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact us:

If you are not satisfied with our response, you have the right to lodge a complaint with your local supervisory authority. A list of EU data-protection authorities is available at edpb.europa.eu.

You may lodge a complaint with Roskomnadzor — the Federal Service for Supervision of Communications, Information Technology and Mass Media — at rkn.gov.ru.

You may contact the California Privacy Protection Agency (CPPA) at cppa.ca.gov.