Privacy Policy
Last updated: 24 October 2026
Who is responsible for your data
Kira Shabanova PR Beograd, Višegradska 1, 11000 Belgrade, Serbia, registration number 67990820, tax number 114968522. For all privacy questions, write to hello@kirabat.art.
I process personal data under the Serbian Law on Personal Data Protection and, for visitors from the EU and the UK, the GDPR.
What I collect and why
When you buy a work: your name, email, phone, delivery and billing address and the order details — to process the order, ship the work, issue the invoice and contact you about your order. This is needed to fulfil our contract and my legal obligations (accounting and tax).
When you pay: payment is handled by PayPal. I receive the payment confirmation, your name and email, but never your card details.
When you write to me — through the Commission form, by email or on WhatsApp: your name, email and message, to answer you and prepare a commission or a collaboration.
When you visit the website: technical data such as IP address, browser, device and pages visited, collected through cookies by the shop platform — to keep the shop working and secure and, if you agree, to understand how the site is used.
I do not sell your data and do not use it for automated decisions.
Who receives your data
Only the services needed to run the shop: Shopify (the platform hosting the website, the shop and the checkout), PayPal (payments), shipping carriers such as Pošta Srbije (delivery and, where required, customs), Google (Gmail, for our email conversation), my accountant, and public authorities when the law requires it.
Some of these services process data outside Serbia, for example in the EU, Canada or the USA. They are bound by data protection agreements that keep your data protected.
Cookies
The website uses cookies that are necessary for the bag and the checkout to work. Analytics and marketing cookies are only used with your consent, which you can give or withdraw at any time in the cookie banner.
How long I keep your data
Order and invoice data — as long as Serbian accounting and tax law requires, up to 10 years. Messages and commission requests — up to 2 years after our last contact, unless they lead to an order.
Your rights
You can ask me to show you the data I hold about you, correct it, delete it, restrict or object to its use, or send it to you in a portable format. Where processing is based on your consent, you can withdraw it at any time. Write to hello@kirabat.art — I reply within 30 days.
You can also complain to the Serbian data protection authority: the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11000 Belgrade, www.poverenik.rs. If you live in the EU, you can also contact the authority in your country.
Children
The shop is not intended for people under 18.
Changes
I may update this policy. The current version is always on this page.
