Who is responsible
This website is a personal, non-commercial fashion archive run by an individual:
Yeva Havriuk — contact: fatalinovaya@gmail.com
There is no data protection officer; for a project of this size, none is required.
What this site is
CONTRABOUNDS (the “Site”) shows garments. Nothing is sold here, there are no accounts, no login, no newsletter and no way to upload anything. You can read every page without giving a single detail about yourself.
We collect as little personal data as possible, and we do not sell your data — not now, not later. This policy explains what is processed, why, on what legal basis, who helps process it, and what you can demand of us under the EU and UK GDPR.
What is processed, and why
a. Server logs. Like every website, the Site cannot be delivered to you without your device's IP address. Our host records it together with the time, the page requested, the referring page and your browser's user-agent string, and keeps it briefly to deliver the pages, keep the site available and defend against attacks and abuse. These logs are not used to build a profile of you and are not combined with anything else. Legal basis: legitimate interest, Art. 6(1)(f) GDPR — operating and securing the Site.
b. Your cookie choice. When you answer the cookie banner, that answer is written to your browser's local storage so you are not asked on every page. It contains your decision and its date — no identifier, nothing that says who you are. It never leaves your device. Legal basis: strictly necessary storage, TDDDG §25(2) — it exists only to honour a choice you made; keeping the record is also our legal obligation, Art. 6(1)(c) GDPR.
c. Gallery layout. On a collection page you can rearrange the images. If you do, the arrangement is saved in your browser so the page looks the same when you come back. This is a display preference, stored on your device only, never transmitted to us or anyone else, and it disappears when you clear your browser data.
d. Analytics — only with your consent, and currently switched off. The Site is prepared for Google Analytics 4, which would give aggregate, IP-anonymised usage statistics. At the time of this update no analytics property is connected and no analytics script loads at all, whatever you answer in the banner. If that changes, it will load only after you accept analytics, and this page and the date at the top will be updated first. Legal basis: your consent, Art. 6(1)(a) GDPR and TDDDG §25(1).
e. If you write to us. Email us and we necessarily process your address, your message and anything you put in it, for as long as it takes to deal with the matter. Legal basis: legitimate interest in answering correspondence, Art. 6(1)(f) GDPR; where your message concerns a contract, Art. 6(1)(b).
There is no automated decision-making and no profiling on this Site.
Who processes data for us
- Vercel Inc. — hosting and content delivery; processes server logs as described above.
- Google Ireland Ltd. — analytics, only if analytics are switched on in the future and only with your consent.
- The provider behind our contact mailbox — receiving and storing email.
Each acts as a processor on our instructions, under a data processing agreement. Beyond these, nothing is shared with anyone, and nothing is sold or traded.
International transfers
Some of these providers are established outside the EU/EEA, including in the USA. Such transfers are covered by an EU adequacy decision, the EU–US Data Privacy Framework, and/or Standard Contractual Clauses under Art. 46 GDPR. You may request a copy of the safeguards relied on.
How long data is kept
- Server logs: a short retention period set by the host, on the order of days, then deleted or aggregated.
- Your cookie choice: about 6 months, after which you are asked again. It lives on your device, so clearing browser data removes it immediately.
- Gallery layout: until you clear it or your browser does.
- Analytics: not applicable while analytics are off. If enabled: up to 14 months.
- Email: as long as the correspondence is live, then archived only as long as needed.
Your rights
Under Art. 15–22 GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to processing, and to receive it in a portable form. Where processing rests on consent, you may withdraw that consent at any time, which does not affect the lawfulness of what happened before.
To exercise any of these, write to fatalinovaya@gmail.com. We answer within one month.
You may also complain to a supervisory authority — in Germany, the authority of your federal state; elsewhere in the EU/UK, your national authority.
Changing or withdrawing cookie consent
Open cookie settings at any time, on any page, to change or revoke your choices. The banner reappears with the same three options and your new answer replaces the old one.
Security
The Site is served exclusively over HTTPS. It is static: there is no database, no login, no password and no user account to compromise, which removes most of what could go wrong. No system is completely secure, but we take measures proportionate to what is at stake here — which, deliberately, is very little.
Children
The Site is not directed to children under 16 and does not knowingly process their data. If you are under 16, please involve a parent or guardian as your local law requires.
Changes
This policy may be updated as the Site grows — in particular when analytics are switched on, or when the archive becomes a shop. The last updated date at the top always shows the version in force.
Contact
Yeva Havriuk
fatalinovaya@gmail.com