Pukamuka Privacy Policy
Version: 14 October 2026
This Policy explains how personal data is collected, used, disclosed and protected, and how you can exercise your rights. It applies to the website, club applications, your Account, orders for Shopping (“Adresa”) and Personal Buyer, Additional Services and customer support enquiries.
1. Who processes your personal data?
1.1. PERSONAL BUYER LLC, Ukrainian company identification code (EDRPOU) 45849496, 40 John McCain Street, Office 241, Kyiv 01042, Ukraine, administers the club, website and Account, acts as Organiser of Pukamuka services, and is the data controller for club applications, access management, platform administration, the organisation and support of orders, its own Adresa service and the optional Pukamuka Service Guarantee provided to Customers in Ukraine.
1.2. PERSONAL BUYER LOGISTICS S.R.L. (Romania; CUI 54614158; Trade Register number J2026029213001; EUID ROONRC.J2026029213001; registered office: Iaşi County, Municipality of Iaşi, Grigore Ureche Street No. 3, basement, Class Office Center, office no. 10, Romania) is the Romanian technology operator of the Pukamuka platform and provides technical and operational support within its defined functions. In that role, it processes only the data necessary to operate the platform and carry out the relevant operations, on an appropriate lawful basis and under applicable data-protection arrangements. The term “technology operator” describes an operational role and does not, by itself, determine whether the company is a controller or processor of personal data; that status is determined separately for each processing activity. For a particular Personal Buyer order, the same company may also be designated as the Seller. In that case, it additionally processes the buyer’s personal data to perform its own sales contract, process payments, arrange delivery, handle returns and comply with legal obligations, and may act as an independent data controller for purposes it determines within its legal responsibilities.
1.3. Other potential sellers on the platform are SuperGlobal Sp. z o.o. (Poland), SGL Logistics & Delivery GmbH (Germany), SUPERGLOBAL LTD (United Kingdom) and SUPERGLOBAL LLC (United States). Each may act as an independent controller in respect of its own orders and legal obligations. The identity and contact details of the seller for an individual order are provided before the sales contract is concluded. Personal data is shared with warehouses, carriers and technology providers only to the extent necessary for their functions.
1.4. The specific seller or service provider and its details are displayed before payment. Where companies jointly determine the purposes and means of particular processing, they document and disclose the appropriate allocation of responsibilities. Where one company processes data on another’s instructions, an appropriate data processing agreement is put in place. Being part of the same platform does not automatically make every company a controller of all personal data.
1.5. General data protection enquiries: assistant@pukamuka.com. Where necessary, a request relating to a particular sale will be forwarded to the relevant controller, with the requester being informed.
2. What personal data do we process?
2.1. Depending on how you interact with us, we may process:
2.1.1. Club and contact details: first and last name, email address, telephone number, country, city, invitation details, application comments and membership status;
2.1.2. Account details: account identifier, contact and address information, preferences, access history, authentication data and security checks;
2.1.3. Order details: product links, names, models, product references, quantities, prices, country of purchase, selected Additional Services, delivery address and recipient details;
2.1.4. Payment and financial records: amounts, currencies, transaction status, payment-provider references, refunds, receipts, invoices, charges and order accounting records. Full payment card details are processed by authorised payment providers; Pukamuka does not store a complete card number together with its CVV;
2.1.5. Shipping and customs details: customer identification codes, shipment references, warehouse photographs/videos, weight, dimensions, transport and customs documents, and delivery confirmations;
2.1.6. Support records: correspondence, complaints, explanations, evidence and, where applicable, records of communications;
2.1.7. Technical information: IP address, device, browser, usage events, cookies and identifiers, where such technologies are actually in use.
2.2. For sole proprietors and corporate customers, we may also process business registration and tax details and personal data relating to their representatives. Further information or documentation may be needed for customs, sanctions screening, fraud prevention or payment verification, subject to law and necessity.
2.3. Please avoid supplying special-category or unnecessary sensitive data without a valid reason and lawful basis. If you nominate another person as the shipment recipient, you must have a proper basis for providing their contact details; Pukamuka will provide that person with information where required by law.
2.4. We usually obtain personal data directly from the individual. Where necessary to provide the services or comply with law, we may also receive data from retailers or suppliers, the designated Seller, warehouses, carriers, customs brokers, payment and anti-fraud providers, technology providers, authorised representatives or shipment recipients. Where required by law, the individual will be informed about data obtained from other sources.
2.5. Data marked as mandatory during registration, verification or order placement are required, as applicable, to assess an application, enter into and perform a contract, or comply with a legal obligation. If those data are not provided, we may be unable to create or verify an Account, accept or perform an order, process a payment, arrange delivery or customs formalities, or handle a request. Optional data may be omitted without preventing access to the core service unless they later become necessary for a particular operation.
3. Purposes and lawful bases of processing
3.1. We use personal data to review club applications and grant access; create and protect accounts; arrange purchases, process payments, handle goods at warehouses and deliver orders; communicate and provide support; process returns, complaints and guarantee claims; maintain security and prevent fraud; meet accounting, tax, customs and sanctions obligations; and conduct analytics and marketing where permitted.
3.2. Depending on the company, purpose and applicable law, processing may rely on performance of a contract or steps requested before entering into it, a legal obligation, legitimate interests (including security, fraud prevention and proper administration, balanced against individual rights), or consent where required. No single lawful basis automatically applies to all processing.
3.3. Service messages about applications, orders, payments, delivery or security are not automatically marketing messages. Promotional communications are sent on the basis of separate consent or another basis expressly permitted by law, with an option to opt out.
4. Who receives the data?
4.1. Where necessary and lawful, data may be shared with authorised staff and service providers of the Organiser; the seller for a particular order; warehouses, carriers, postal operators and customs brokers; banks and payment providers; fraud-prevention services; CRM, hosting and IT providers; and professional advisers, in accordance with their functions and legal bases.
4.2. A seller or service provider receives only the data objectively required for its order. Submitting a club application does not automatically disclose the applicant’s details to every company associated with the platform.
4.3. Data may also be disclosed to competent authorities, courts, tax and customs authorities and law-enforcement bodies where a proper legal basis exists.
5. International data transfers
5.1. Fulfilment of orders may require transfers of personal data between Ukraine, Romania, Poland, Germany, the United Kingdom, the United States and countries where technology suppliers operate. The legal basis and transfer mechanism depend on the originating and receiving jurisdictions and applicable law.
5.2. Where required by the GDPR, UK GDPR or other mandatory rules, appropriate transfer mechanisms are used, such as adequacy decisions, relevant standard contractual clauses together with supplementary safeguards, or other expressly permitted grounds. Publishing this Policy does not replace any required international transfer mechanism.
5.3. Information about the mechanism applicable to a particular transfer may be requested using the contact details in this Policy, subject to applicable legal requirements.
6. How long is data kept?
6.1. Data is kept for as long as needed for the relevant purpose and, where required, for statutory accounting, tax, customs, contractual and claims-related retention periods.
6.2. Indicative periods for club applications are: inactive or rejected applications — up to 12 months after the last relevant interaction; waiting-list or deferred applications — up to 24 months; member data — for the duration of access and thereafter only where another justified basis applies.
6.3. Records of orders, payments, sales, exports, refunds and disputes are retained for the periods required by the laws applicable to the relevant company. Marketing-consent records are kept while the consent remains valid and for any additional period necessary to demonstrate its status and respect an opt-out.
6.4. After the applicable period, data is erased, anonymised or its processing restricted where continued retention is lawfully necessary.
7. Security
7.1. We apply appropriate technical and organisational safeguards, which may include role-based access controls, secure connections, activity logs, backups, restrictions on contractor access and incident-response procedures. Specific measures depend on the risks and the systems actually deployed.
7.2. You should safeguard your login credentials and report suspected unauthorised access. No method of transmitting data can guarantee absolute security.
8. Your rights
8.1. Depending on applicable law, you may have rights to receive information about processing and access your data; request correction, erasure or restriction; object to certain processing; withdraw consent; obtain data portability; and lodge a complaint with the competent supervisory authority or bring proceedings before a court.
8.2. Where decisions with legal or similarly significant effects are made solely by automated means, the applicable legal rights and safeguards are respected. Routine technical security scoring does not remove those rights.
8.3. To exercise your rights, email assistant@pukamuka.com with the subject “Personal Data”. We may verify your identity before releasing information. Responses are provided within the period prescribed by law; a request may be refused only on lawful grounds.
9. Cookies and advertising technologies
9.1. Necessary technologies support website functions, security and account sign-in. Optional analytics or marketing cookies are used in accordance with applicable consent requirements. Categories, preference controls and information about providers are set out in our Cookie Policy.
10. Changes to this Policy
10.1. An updated Policy is published with its effective date. We will give additional notice of material changes where required by law. Changes do not retrospectively legitimise processing that required prior consent or another lawful basis.
11. Contact details
11.1. Platform administrator contact: PERSONAL BUYER LLC, Ukrainian company identification code (EDRPOU) 45849496, 40 John McCain Street, Office 241, Kyiv 01042, Ukraine; assistant@pukamuka.com. An order-related enquiry may be referred to the seller or service provider concerned. Seller details are displayed before payment and in the relevant order documentation.
