Privacy Policy
Version of 04.11.2026. This is a translation; in case of discrepancy, the Ukrainian version prevails.
1. Who we are
This policy explains what personal data the maslotom.com website (the "website") collects, why, who we share it with and how you can control it.
The personal data controller is LIMITED LIABILITY COMPANY "TOM PEANUT BUTTER" (ТОВ «АРАХІСОВА ПАСТА ТОМ»), EDRPOU code 43102909, registered address: 58e Dorozhna St., premises 11, Pasiky-Zubrytski village, Lviv district, Lviv region, 81137, Ukraine ("TOM", "we").
For personal data questions, write to info@maslotom.com with the subject "Personal data".
We process personal data in accordance with the Law of Ukraine "On Personal Data Protection".
2. What data we collect
2.1. Orders
First and last name, phone, e-mail, city, delivery address or branch, delivery and payment method, order contents and total, promo code, comment. For wholesale partners – also company details and payment details.
2.2. Unfinished checkout
As soon as a valid phone or e-mail is entered in the checkout form and the cart contains products, the website saves these contacts, your name and the cart contents – even before you press "Place order". If the order is not placed, we may remind you about the cart by e-mail, chat-bot message or SMS. Once the order is placed, this record is deleted.
2.3. Personal account
Phone (sign-in with a one-time code), name, e-mail, order history, delivery addresses.
2.4. Reviews
Name, e-mail, text and rating. We publish the name, text and rating on the website, but not the e-mail.
2.5. Partnership requests
Name, phone, e-mail, links to your pages, comment.
2.6. Messages
Messages you send us via the chat bot, messengers, social networks or e-mail, and call data (number, date, duration).
2.7. Payment
You enter your card details on the bank's page – we do not receive or store them. From the bank we receive the payment status and amount; for "Pay in instalments" we pass the bank the phone number the application is made for.
2.8. Technical and usage data
IP address, device and browser type, language, pages viewed, actions on the website (product view, cart, checkout, purchase), traffic source (ad campaign, UTM tags, Google, Meta and TikTok click identifiers), cookie identifiers (section 7). Microsoft Clarity also records how you use a page: clicks, scrolling, cursor movement.
3. Why we process data and on what basis
| Purpose | Data | Basis |
|---|---|---|
| Accept, take payment for and deliver the order, issue a fiscal receipt | 2.1, 2.7 | conclusion and performance of the contract (public offer) |
| Notify you of order and delivery status (SMS, chat bot, e-mail) | phone, e-mail, order number | performance of the contract |
| Personal account sign-in, order history | 2.3 | performance of the contract |
| Accounting and tax records | order data | legal obligation |
| Remind you of an unfinished order | 2.2 | TOM's legitimate interests: the reminder concerns your own order; you can opt out at any time |
| Remind you to restock, ask about quality after delivery | phone, e-mail, order history | TOM's legitimate interests; you can opt out at any time |
| News and promotions (e-mail, chat bot, SMS) | name, phone, e-mail | consent; you can unsubscribe at any time |
| Publishing reviews | 2.4 | consent |
| Website analytics and service improvement | 2.8 | consent |
| Measuring and showing ads | 2.8, hashed e-mail and phone | consent |
| Website security, fraud prevention | 2.8 | TOM's legitimate interests |
| Replying to messages | 2.5, 2.6 | consent, performance of the contract |
4. Advertising and analytics
4.1. The website uses Google Analytics 4, Google Tag Manager, Google Ads, the Meta pixel (Facebook, Instagram), the TikTok pixel and Microsoft Clarity. They set their own cookies (section 7) and receive events from the website: page and product views, add to cart, checkout start, purchase (number, total, products).
4.2. Meta advanced matching. The Meta pixel takes the e-mail and phone entered in website forms, turns them into an irreversible code (SHA-256 hash) in your browser and sends it to Meta to link the purchase to a Meta account. Meta does not receive the e-mail and phone in plain form.
4.3. Server-side purchase events to Meta (Conversions API). After an order is placed, our server sends Meta a purchase event: order number and total, IP address, browser data (user agent), the _fbp and _fbc cookie identifiers, and may also send the hashed e-mail and phone.
4.4. We may also send Google Ads the hashed e-mail and phone (enhanced conversions) and purchase data by click identifier (gclid), and use customer lists with hashed contacts to show ads on Meta and Google.
4.5. Sellaction and Kim-affiliates affiliate programmes. If you came to the website via a partner link, after the purchase we send the affiliate network the order number and total, the click identifier and whether it is a first or repeat purchase, so that the partner can be rewarded. Affiliate networks do not receive your contacts.
4.6. How to opt out: block or delete cookies in your browser settings (section 7); change the ad settings in your Google, Meta and TikTok accounts; write to us to remove your data from our customer lists for advertising.
5. Who we share data with
We do not sell personal data. We share it only with those who help us fulfil the order or provide services to us, and only to the extent necessary.
| Who | Why | What data |
|---|---|---|
| Nova Poshta, Ukrposhta, Meest | delivery | name, phone, address or branch, parcel details, cash-on-delivery amount |
| Universal Bank JSC (monobank), PrivatBank JSC CB | payment, "Pay in instalments" | order total and number; for "Pay in instalments" – phone |
| Checkbox | fiscal receipts (software cash register) | products and order total |
| Vodafone Ukraine, Momentum, SendPulse, Google Workspace | SMS, chat-bot messages, e-mails and newsletters | name, phone, e-mail, order number and contents |
| Binotel | telephony | phone number, call data |
| HostPro | hosting of the website and database | data processed by the website |
| Hosting provider of the 1C accounting system | accounting | order and counterparty data |
| Cloudflare | website protection and fast delivery | IP address and technical request data; form data passes through the Cloudflare network in transit |
| backups (Google Drive), analytics, advertising | backups – website database; analytics and advertising – sections 2.8 and 4 | |
| Meta Platforms, TikTok, Microsoft | advertising and analytics | sections 2.8 and 4 |
| Sellaction, Kim-affiliates | affiliate programmes | order number and total, click identifier |
| Website development and maintenance contractors | keeping the website running | only to the extent necessary for the work |
| Public authorities | upon lawful request | within the scope of the request |
6. Transfers outside Ukraine
Some recipients – in particular Google, Meta Platforms, Microsoft, Cloudflare and TikTok – process data outside Ukraine, including in the USA. By placing an order or using the website with analytics and advertising cookies enabled, you consent to such transfer.
7. Cookies and browser storage
Cookies are small files the website stores in your browser. You can block or delete them in your browser settings; some website features (personal account, cart) may then not work. Safari and iPhone may themselves shorten the lifetime of cookies set by scripts to 7 days.
| Name | Set by | Purpose | Lifetime |
|---|---|---|---|
| tom_acc, tom_in | website | personal account sign-in; tom_in is only a "signed in" flag with no data | until the browser is closed, with "Remember me" – 30 days |
| tom_ab | website | unfinished checkout: reminder and cart recovery | 14 days |
| tom_pp | website | "Pay in instalments" application | 1 day |
| tom_attr_*, tom_utm | website | traffic source (ads, UTM tags), saved with the order | 90 days, tom_utm – 30 days |
| SAuid, utm_source-sell | website for Sellaction | affiliate programme | 30 days |
| _ga, _ga_850X6Q8J2L | Google Analytics | visit statistics | up to 400 days |
| _gcl_au, _gcl_aw | Google Ads | ad measurement | 90 days |
| _fbp, _fbc | Meta | advertising and measurement | 90 days |
| _ttp, _tt_enable_cookie, ttcsid, ttclid | TikTok | advertising and measurement | up to 390 days, ttclid – 1 day |
| _clck, _clsk, CLID | Microsoft Clarity | page usage analysis | up to 1 year, _clsk – 1 day |
| browser storage | website | cart, checkout form draft, analytics service flags | until the browser is cleared; draft – until the tab is closed |
8. How long we keep data
- Order data and primary documents – as long as tax and accounting law requires.
- Personal account – while you use it or until you ask us to delete it.
- Unfinished checkout – until the order is placed, but no longer than 30 days.
- Newsletter data – until you unsubscribe.
- Reviews – while they are published on the website.
- Analytics and advertising data – for the periods set in those services.
- Database backups – up to 15 days.
9. Your rights
Under Article 8 of the Law of Ukraine "On Personal Data Protection", you have the right to:
- know who processes your data, what data, why and who it is shared with;
- access your data;
- have inaccurate data corrected;
- have your data deleted if there is no longer a basis for processing it;
- withdraw your consent at any time – this does not affect processing carried out before the withdrawal;
- object to processing for advertising;
- unsubscribe from newsletters – via the link in the e-mail, in the chat bot or by writing to us;
- complain to the Ukrainian Parliament Commissioner for Human Rights or go to court.
To exercise your rights, write to info@maslotom.com with the subject "Personal data". We will reply within 30 calendar days.
10. How we protect data
- The connection to the website is encrypted (HTTPS).
- Only employees and contractors who need it for their work have access to the data; key systems require two-step sign-in.
- The database accepts connections only from our server.
- We back up the database every day.
11. Children
The website is not intended to collect data from children under 14. If you believe a child has given us their data, write to us and we will delete it.
12. Changes to this policy
A new version takes effect when it is published on this page; the version date is shown at the top.
