Privacy policy
Version of 24 September 2026
1. Who is responsible for your data
The data controller is Sosnova Iryna, a sole trader registered in Cyprus, email: witch@mori-norman.com ("we", the "Author"). For any questions about your data, write to witch@mori-norman.com.
We process data in accordance with the EU General Data Protection Regulation (GDPR) and the law of the Republic of Cyprus.
2. What data we collect and why
Orders and payment. Email, contact details (Telegram, WhatsApp or phone — for services), the service or product chosen, amount, language, appointment time (for booked services), recipient name and message (for gift certificates), and the time of your consents at checkout. Purpose: to conclude and perform the contract, deliver the product or contact you to provide the service. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Accounting and tax. Order and payment records are kept for as long as tax law requires. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
Payment. Card details are entered on Stripe's page and wallet details at NOWPayments. We do not receive or store card numbers. From the payment services we receive only the payment status and amount.
Reviews. Name, text, rating and language of the review. Purpose: publishing reviews on the Website after moderation. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw by asking us to delete the review.
Abuse prevention. Your IP address is used briefly (a few minutes, in server memory only) to limit repeated attempts to place orders, enter codes or post reviews. Legal basis: legitimate interest in protecting the Website (Art. 6(1)(f) GDPR). The hosting provider may keep technical request logs (including IP addresses) for security.
Correspondence. If you write to us, we process your message and contact details to reply. Legal basis: legitimate interest or steps prior to a contract.
We do not use your data for automated decision-making or profiling, and we do not sell it.
3. Cookies and browser storage
The Website uses only strictly necessary cookies, with no analytics or advertising trackers:
— mn_cur — the currency chosen for displaying prices (1 year); — mn_offer — when your personal offer started, so the timer does not reset (1 year; signed, contains no personal data); — mn_admin — the Author's login to the admin panel (Author only).
Your "card of the day" is saved in your browser's localStorage so it stays the same for the day; this data stays on your device. Fonts are served from our own server without requests to third parties.
4. Who receives your data
Data is shared only with providers the Website cannot work without, and only to the extent necessary:
— hosting and protection of the Website; — database and file storage (servers in the EU); — payment services — processing payments (they process payment data as independent controllers under their own policies); — a messenger for internal notifications to the Author about new orders, bookings and reviews (includes the client's email, contact and the service name).
For security reasons, specific providers are not named here. The full list of recipients is available on request at witch@mori-norman.com.
Some providers may process data outside the EEA (for example in the USA). In such cases transfers rely on an adequacy decision of the European Commission (including the EU–US Data Privacy Framework) or the EU Standard Contractual Clauses.
We may disclose data to public authorities where the law requires it.
5. How long we keep data
— order and payment records — 6 years, as required by the tax law of the Republic of Cyprus; — download links — valid for 7 days, then they stop working; — reviews — while published or until you ask us to delete them; — correspondence — up to 2 years after it ends; — IP addresses for abuse prevention — a few minutes.
6. Your rights
You have the right to access your data and receive a copy; to correct inaccurate data; to have your data erased (unless we must keep it by law); to restrict processing; to data portability; to object to processing based on legitimate interest; and to withdraw consent at any time (without affecting the lawfulness of processing before withdrawal).
To exercise these rights, write to witch@mori-norman.com. We will reply within one month.
You may also lodge a complaint with a data protection authority — in your country of residence or the Commissioner for Personal Data Protection of the Republic of Cyprus (dataprotection.gov.cy).
7. Age
The Website is intended for persons aged 18 and over. We do not knowingly collect data from minors; if such data reaches us, we will delete it.
8. Security
Connections to the Website are encrypted (HTTPS). The database is closed to public access; the admin panel is password-protected; digital product files are kept in private storage and delivered only through time-limited links.
9. Changes
We may update this Policy. The current version, with its effective date, is always published on the Website.