Privacy Policy

Effective Date: July 30, 2026

"Castle Emerald" is the shared trading name of two related but legally distinct entities that jointly operate this website: GROMADSKA ORHANIZATSIIA "Smarahdove Misto" ("the Organization"), which publishes our free educational content, and Individual Entrepreneur Mykola Pastushenko (ФОП Пастушенко Микола Вікторович), which operates our online store ("the Seller"). Where this Policy refers to "we", "our", or "us", the applicable entity is the Organization for anything relating to educational content, the blog, or our educational newsletter, and the Seller for anything relating to orders, payment, shipping, returns, customer accounts, or our store newsletter, as clarified throughout this Policy. Both entities are committed to protecting your personal information.

Our website serves two purposes. It is both an informational platform operated by the Organization, sharing educational content about creative production, and an online store operated by the Seller, offering custom-made costumes, props, accessories, and related products.

This Privacy Policy explains what information we collect, how we use it, how we protect it, and the choices and rights available to you when you visit our website, place an order, contact us, or otherwise interact with our services.

1. Who We Are and Who Controls Your Data

Through this website we:

• publish educational and informational materials (the Organization);

• operate an online store for custom-made products (the Seller);

• communicate with customers and partners (either entity, depending on the subject);

• provide customer support before and after purchase (the Seller).

Proceeds from the store support the Organization’s educational mission and organizational activities.

Data Controllers

Depending on which part of our services you use, one of the following two entities acts as the data controller responsible for your personal information:

• GROMADSKA ORHANIZATSIIA "Smarahdove Misto" (ГРОМАДСЬКА ОРГАНІЗАЦІЯ «Смарагдове місто»), officially registered in Ukraine, official English name "Emerald City" ("EC") — controller for data relating to our educational content, blog, and educational newsletter subscriptions.

• Individual Entrepreneur Mykola Pastushenko (ФОП Пастушенко Микола Вікторович), Ukrainian taxpayer ID (ІПН) 3220812159 — controller for data relating to your orders, account, payments, shipping, returns, and our store newsletter.

Both entities operate this website and communicate with customers under the shared trading name "Castle Emerald". Section-by-section, this Policy notes which entity is the controller where it is not otherwise clear from context.

Data Protection Officer

Given the scale and nature of our processing activities, neither entity is required by applicable law to appoint a formal Data Protection Officer (DPO). If you have questions about how we handle your personal data, please contact us using the details in Section 20.

If you have questions regarding this Privacy Policy or your personal information, please contact us:

Email: manager@castleemerald.org

2. Information We Collect

Depending on how you use our website, we may collect:

Contact information (the Seller, for orders and accounts; the Organization, for newsletter subscribers)

• name;

• email address;

• phone number;

• billing address;

• shipping address;

Order information (the Seller)

• products ordered;

• customization requests;

• measurements;

• sizing information;

• production notes;

• delivery details;

• communication related to your order.

Reference materials (the Seller)

To produce custom-made items, you may provide:

• reference photographs;

• screenshots;

• artwork;

• design references;

• technical sketches;

• other materials necessary for production.

Photographs for custom fitting (the Seller)

Some customers choose to provide photographs instead of, or in addition to, body measurements to help us achieve a better fit.

These photographs are used solely for creating your custom product and are accessible only to team members directly involved in production. Production files containing photographs are stored and shared using our access-controlled Google Workspace (Google Drive) account, on workshop devices used exclusively for order fulfilment, with access limited to staff directly working on that order.

We do not share these photographs with any party other than our Google Workspace cloud storage provider, which acts solely as our data processor under a signed Data Processing Agreement and does not use them for its own purposes. These photographs are not processed using AI tools.

We do not publish these photographs or share them with unrelated third parties, except as described in this Policy.

By submitting photographs for custom fitting purposes, you provide your consent for us to use them solely for creating your custom product. You may withdraw this consent at any time by contacting us; we will delete the photographs within 7 business days of your request, though withdrawal may affect our ability to complete an order already in progress.

As with all information you provide to us, we rely on your confirmation under our Terms of Service that you are at least 18 years old and that any photograph you submit is your own.

Account information (the Seller)

If you create an account on our website, we may store your login information, saved preferences, wishlist, and order history.

Technical information (joint — both the Organization and the Seller, for their respective pages)

When you visit our website, we may automatically collect information such as:

• IP address;

• browser type;

• operating system;

• device information;

• pages visited;

• referring website;

• approximate location;

• website interactions.

Communications (either entity, depending on the subject)

We collect information you provide when contacting us through:

• email;

• contact forms;

• Tidio contact requests;

• social messaging platforms that you choose to use (such as WhatsApp, Instagram, Facebook Messenger, Telegram, Signal, or Viber).

Email is our primary and recommended channel for order-related communication, including sensitive information such as measurements or reference photographs. Where you choose to contact us via social messaging platforms instead, please note that these platforms are operated by third parties and are subject to their own data protection and international transfer practices.

3. How We Use Your Information

We use your information to:

• process and fulfill orders (the Seller);

• manufacture custom products (the Seller);

• create patterns and production files (the Seller);

• provide customer support (the Seller);

• communicate about your order (the Seller);

• arrange shipping and customs documentation (the Seller);

• manage returns or production adjustments (the Seller);

• improve our products and services (the Seller);

• improve our website (joint);

• protect against fraud and unauthorized transactions (the Seller);

• comply with legal, accounting, and tax obligations (each entity, for its own activities);

• send our store newsletter if you have subscribed (the Seller);

• send our educational newsletter if you have subscribed (the Organization);

• send occasional physical greeting cards to existing customers (e.g. for holidays or their birthday) (the Seller);

• respond to inquiries and collaboration requests (either entity).

4. Legal Bases for Processing

Where required by applicable law, we process personal information on one or more of the following legal bases:

• performance of a contract — for example, using your measurements, order details, and shipping address to manufacture and deliver your order, process payment, and manage returns or alterations;

• your consent — for example, sending our store or educational newsletter to subscribers, or using photographs you provide for custom fitting;

• legitimate interests — for example, preventing fraud (such as verifying suspicious payment or delivery details), maintaining the security of our website, sending occasional physical greeting cards to existing customers (with an easy opt-out, see Section 12), and analyzing our own records to improve our measurement-taking process;

• compliance with legal obligations — for example, retaining accounting and tax records for the period required by law.

5. Custom Measurements and Production Data

Because many of our products are individually made, the Seller collects only the information reasonably necessary to manufacture your order.

Measurements, sizing information, and production notes are typically retained for up to one year after order completion to:

• resolve sizing issues;

• provide alterations where appropriate;

• simplify future orders.

You may request deletion of this information at any time unless we are legally required to retain it.

Where measurements need to be converted between unit systems, we may use a de-identified, third-party AI-based conversion tool operating under a signed data processing agreement; this tool receives only the numeric measurement data, not your name, contact details, or photographs.

Once received, your measurements are used together with your name and any photographs you provide to produce your order. This combined production information is stored and shared using our access-controlled Google Workspace (Google Drive) account, on workshop devices used exclusively for order fulfilment, with access limited to staff directly working on your order.

6. Confidentiality of Custom Orders

Many of our customers are private individuals, performers, photographers, filmmakers, creators, or creative teams.

The Seller treats custom orders, measurements, production details, reference materials, and project information as confidential.

We do not disclose information about our customers or their projects without permission unless required by law.

7. Customer Photos, Reviews, and Reference Materials

Photographs and reference materials submitted for production are used solely to manufacture your order.

We do not publish customer photographs received through private communication without the customer’s permission.

If you voluntarily publish photographs of your completed costume or submit a review through our website, that content may become publicly visible. If you would like previously published photographs or reviews removed, please contact us at manager@castleemerald.org; we will remove them within 7 business days of your request.

Reviews or photographs shared privately with us are used internally unless you separately authorize the Organization and/or the Seller to publish them for promotional or educational purposes.

8. Sharing Your Information

We share personal information only where necessary to operate our business.

This may include:

• Shopify;

• payment providers, including Shopify Payments, PayPal, and Hutko (a currency-conversion payment service based outside Ukraine);

• shipping carriers;

• customs authorities where required;

• website hosting providers;

• analytics providers;

• communication service providers, including social messaging platforms you choose to use to contact us (such as WhatsApp, Instagram, Facebook Messenger, Telegram, Signal, or Viber);

• cloud storage providers (Google Workspace / Google Drive) for securely storing production photographs and files;

• a third-party AI-based tool used internally for translation and measurement conversion (see Sections 2 and 5 for details on what data this tool receives);

• professional advisers;

• legal authorities where required by law.

We do not sell your personal information for money. However, our use of advertising technologies such as Google Ads (including the Seller’s commercial remarketing account described in our Cookie Policy, Section 9) may be considered "sharing" of information for targeted advertising purposes under some U.S. state privacy laws. See Section 16 for details on how you can opt out.

9. Payments

Payments are processed by trusted third-party payment providers, including Shopify Payments, PayPal, and Hutko.

Where you pay via Hutko, your payment information is processed by Hutko under its own terms and privacy practices; see our Secure Payments page for details on currency conversion.

We do not store complete payment card information.

10. Shipping

To deliver your order, the Seller may share the information necessary for shipping and customs clearance, including:

• your name;

• shipping address;

• phone number;

• email address;

• package contents where required;

• customs documentation where applicable.

11. Cookies and Analytics

Our website uses cookies and similar technologies to operate the store, remember your preferences, and understand visitor behavior, including through Google Analytics, Google Search Console, Microsoft Clarity, and advertising technologies such as our Google Ad Grants account (the Organization, educational content only) and our separate commercial Google Ads account (the Seller, store remarketing). For full details on the specific cookies and similar technologies we use, why we use them, and how to manage your preferences, please see our Cookie Policy.

12. Marketing Communications

We offer two separate newsletter subscriptions, each with its own consent:

• Educational newsletter (the Organization): updates, articles, and news about our free educational content and blog.

• Store newsletter (the Seller): product news, promotional offers, and store updates.

Subscribing to one does not automatically subscribe you to the other. We may also send existing customers occasional physical greeting cards (e.g. for holidays or their birthday), based on the Seller’s legitimate interest in maintaining customer relationships.

You may unsubscribe from either newsletter at any time using the unsubscribe link included in our emails, and you may opt out of physical greeting cards at any time by contacting us directly; we will action such requests within 7 business days.

Even after unsubscribing from marketing communications, we may still send messages related to your orders.

13. Data Retention

We retain personal information only for as long as reasonably necessary to:

• fulfill orders;

• provide customer support;

• maintain business records;

• comply with legal obligations;

• resolve disputes;

• protect against fraud.

When information is no longer required, it is securely deleted or anonymized where appropriate.

14. International Data Transfers

Both the Organization and the Seller are based in Ukraine, and your order is produced at the Seller’s workshop located in Ukraine. If you are located in the European Union, United Kingdom, or elsewhere outside Ukraine, your personal information (such as contact details, measurements, and shipping information) will be transferred to and processed in Ukraine to fulfill your order.

Where you are located in the EU or UK, this transfer is carried out on the basis that it is necessary for the performance of a contract concluded in your interest (Article 49(1)(b) GDPR / UK GDPR).

We take reasonable technical and organizational measures to protect your personal information during such transfers, and we do not transfer more data than necessary to complete your order.

Because we also use international service providers (such as Shopify, Google, and Microsoft), your information may additionally be processed in other countries in accordance with those providers’ own safeguards. Where you contact us via social messaging platforms operated by third parties outside Ukraine (such as WhatsApp, Instagram, Facebook Messenger, Telegram, Signal, or Viber), those providers process your information under their own international transfer safeguards.

15. Your Rights

Depending on your location, you may have the right to:

• access your personal information;

• correct inaccurate information;

• request deletion;

• request restriction of processing;

• object to processing;

• withdraw consent;

• receive a copy of your information where applicable;

• unsubscribe from marketing communications;

• lodge a complaint with your local data protection authority.

To exercise your rights, please contact:

manager@castleemerald.org

16. Additional Rights for California Residents (CCPA/CPRA)

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including the right to:

• know what personal information we collect about you;

• delete personal information we hold about you;

• correct inaccurate personal information;

• opt out of the "sale" or "sharing" of your personal information;

• limit the use of sensitive personal information;

• not be discriminated against for exercising any of these rights.

We do not sell personal information for money. The Seller’s use of advertising technologies such as its commercial Google Ads account may be considered "sharing" of information for targeted advertising purposes. You can opt out of this sharing by contacting us at the details in Section 20, or by adjusting your preferences at adssettings.google.com.

At this time, we process opt-out requests submitted directly to us rather than through automated browser signals such as Global Privacy Control; we may add automated support for such signals in the future.

As small entities, neither the Organization nor the Seller currently meets the revenue or data-volume thresholds that make most CCPA/CPRA obligations mandatory; we provide this section as a transparency measure and will update it as our business grows.

17. Security

We use appropriate technical and organizational measures to protect personal information from unauthorized access, disclosure, alteration, or destruction. This includes access controls and device-level security measures for production files handled on workshop devices used exclusively for order fulfilment.

However, no method of electronic transmission or storage can be guaranteed to be completely secure.

18. Age Requirements

Our website and store are intended for adults only. We do not knowingly collect personal information from, or enter into a contract with, anyone under the age of 18. By using our website or placing an order, you confirm that you are at least 18 years old (see also Terms of Service, Section 2).

If we become aware that we have collected personal information from someone under 18, we will delete it as soon as reasonably possible. If you believe a minor has provided us with personal information, please contact us using the details in Section 20.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or business practices.

The latest version will always be published on this page together with the effective date.

20. Contact Us

If you have any questions about this Privacy Policy or your personal information, please contact us:

For educational content, the blog, and the educational newsletter (the Organization):

Trading name: Castle Emerald
Legal entity: ГРОМАДСЬКА ОРГАНІЗАЦІЯ «Смарагдове місто» (ГО «Смарагдове місто»)
Official English name: "Emerald City" ("EC")
Director: Mykola Pastushenko (Пастушенко Микола Вікторович)
Physical Address: 49008, Ukraine, Dnipropetrovsk Oblast, Dnipro, Chechelivskyi District, Robocha St., Bldg. 164-A, Apt. 73
Email: manager@castleemerald.org

For orders, payments, shipping, returns, and the store newsletter (the Seller):

Trading name: Castle Emerald
Legal entity: Individual Entrepreneur Mykola Pastushenko (ФОП Пастушенко Микола Вікторович)
Taxpayer ID (ІПН): 3220812159
Physical Address: 49008, Ukraine, Dnipropetrovsk Oblast, Dnipro, Chechelivskyi District, Robocha St., Bldg. 164-A, Apt. 73
Email: manager@castleemerald.org