Privacy Policy and Personal Data Protection

Last updated: October 9, 2026

1. General Provisions

This Privacy Policy describes how personal data is collected, processed, used, shared, stored, and protected when users access services operating under the “Три Пироги” (Three Piroga) trademark.

This Policy applies to:

  • the website https://3piroga.ua, including all its language versions;

  • the “Три Пироги” mobile application for Android, available through Google Play;

  • the “Три Пироги” mobile application for iOS, available through the Apple App Store;

  • user accounts, order processing, loyalty programs, and other related digital services.

Personal data is processed in accordance with the Law of Ukraine “On Personal Data Protection” and other applicable laws and regulations.

Where applicable law requires user consent for specific data processing activities, such consent is requested separately.

2. Personal Data Controller

Personal Data Controller: LIMITED LIABILITY COMPANY T.I.R. (LLC T.I.R.), a Ukrainian limited liability company.

Trademark: “Три Пирога” (3 Piroga).

Official website: https://3piroga.ua

Email: info@3piroga.ua

Phone: +380 (44) 453-33-33

Contact address: 24 Lesi Ukrainky Boulevard, Kyiv, Ukraine.

ТОВ «Т.І.Р.» (hereinafter referred to as the Company, we, or us) determines the purposes and means of processing personal data collected through the services covered by this Policy.

3. Personal Data We Collect

Depending on how users interact with the website or mobile applications, we may process the following categories of information.

3.1. Contact information:

  • first and last name;

  • phone number;

  • email address;

  • delivery address;

  • order comments and special instructions.

3.2. Account information:

  • user identifier;

  • profile contact details;

  • order history;

  • saved delivery addresses;

  • favorite products;

  • loyalty points balance and loyalty program participation;

  • account preferences.

3.3. Order and payment information:

  • order contents, amount, date, and status;

  • payment method;

  • payment confirmation and refund information;

  • discounts, loyalty points, and promotional codes used.

If payment is processed through a third-party payment provider, bank card details are handled according to that provider's terms and privacy practices. The Company receives only the information required to record and confirm the payment.

3.4. Technical information:

  • IP address;

  • browser type, device model, and operating system;

  • interface language;

  • application and session identifiers;

  • service interaction data;

  • technical logs, diagnostic information, and error reports;

  • cookies and similar technologies.

We process only the categories of technical information actually used by the relevant services.

4. Purposes of Personal Data Processing

Personal data is processed for the following purposes:

  1. Creating, authenticating, and managing user accounts.

  2. Receiving, confirming, and fulfilling orders.

  3. Arranging delivery and pickup.

  4. Processing payments and refunds.

  5. Communicating with customers about their orders.

  6. Managing loyalty programs, rewards, and personalized offers.

  7. Providing customer and technical support.

  8. Sending service-related notifications.

  9. Sending marketing communications where an appropriate legal basis exists.

  10. Analyzing service usage and improving functionality.

  11. Preventing fraud and unauthorized access.

  12. Complying with legal obligations.

5. Legal Bases for Processing

Personal data is processed based on:

  • the necessity to enter into or perform a contract or order;

  • user consent where required;

  • compliance with the Company's legal obligations;

  • other legal grounds permitted by applicable law.

Users may withdraw their consent where processing relies on that consent.

6. Data Processing in Android and iOS Applications

The “Три Пироги” Android and iOS mobile applications exchange data with the 3piroga.ua website backend through an Application Programming Interface (API) using JSON format.

Depending on the application's functionality, information exchanged through the API may include product catalog data, account information, shopping cart contents, delivery addresses, orders, and order statuses.

Personal data submitted through the mobile applications is processed within the Company's information system under the principles set out in this Privacy Policy.

An internet connection is required for application features that communicate with the server.

Push notifications. Where supported, applications may send order updates, delivery notifications, service messages, and promotional notifications. Technical push notification tokens may be processed to deliver these messages. Users can manage notification permissions in their device settings.

Location information. If an application provides a location-based delivery feature, access to location information is requested through the device's operating system permission mechanism. Such information is used for the relevant delivery feature and must not be used for unrelated purposes without an appropriate legal basis.

Diagnostics. Applications may process information about technical errors, crashes, and performance to maintain stable operation.

Access to the camera, microphone, contacts, or other protected device resources is not intended unless required by an implemented feature, appropriately disclosed, and authorized where necessary.

7. Cookies and Analytics

The website uses or may use cookies and similar technologies to:

  • maintain shopping cart and login functionality;

  • remember preferences;

  • support security;

  • analyze website traffic;

  • measure advertising campaign performance.

Google Analytics 4 and Google Tag Manager may be used for analytics and tag management where enabled within the relevant service.

Non-essential analytics and advertising technologies are used in accordance with applicable consent requirements.

Users may manage cookies through browser settings and available consent management tools.

8. Sharing Personal Data with Third Parties

The Company does not sell users' personal data.

To provide its services, personal information may be shared with:

  • Company personnel and delivery providers;

  • payment service providers;

  • hosting and server infrastructure providers;

  • technical contractors;

  • SMS, email, and push notification service providers;

  • analytics and advertising platforms where used;

  • public authorities when required by law.

Data sharing is limited to information necessary for the relevant purpose. Service providers processing personal data on the Company's behalf are required to maintain appropriate protection.

9. International Data Transfers

When international technical, payment, or analytics services are used, certain personal data may be processed outside Ukraine.

Such transfers take place on an appropriate legal basis and in accordance with applicable data protection requirements.

10. Data Security

The Company applies appropriate technical and organizational measures to protect personal data, including protection of data transmission, access controls, employee access restrictions, and server infrastructure security measures.

However, no information system can guarantee absolute protection against every possible security risk.

11. Data Retention

Personal data is retained for as long as necessary to fulfill the purposes for which it was collected or for the periods required by law.

Account information is retained while the account remains active or another lawful basis for retention exists.

Order records, payment information, and accounting documents may be retained for mandatory statutory periods.

Technical information is retained for periods necessary for analytics, diagnostics, and security.

Once the applicable retention period expires, personal data is deleted or anonymized unless continued retention is legally required.

12. Account and Personal Data Deletion

Users may initiate the deletion of their accounts and associated personal data.

If a mobile application supports account creation, an accessible option to initiate account deletion must be provided within the application.

Users may additionally send a deletion request to info@3piroga.ua with the subject “Account Deletion”, providing the phone number or email address associated with their account.

Appropriate account ownership verification may be required before deletion.

Following the processing of a deletion request, the account and associated personal data are deleted, except for information that the Company is legally required or otherwise lawfully entitled to retain.

Information retained for legal compliance is not used for incompatible purposes.

Uninstalling the mobile application from a device does not automatically delete the associated account from the Company's servers.

13. User Rights

Users have the right to:

  • receive information about the processing of their personal data;

  • request access to personal data;

  • request correction of inaccurate information;

  • request deletion where provided by law;

  • withdraw consent;

  • object to processing where applicable law provides such a right;

  • submit complaints to competent supervisory authorities;

  • exercise other rights provided by applicable legislation.

Requests concerning personal data may be sent to info@3piroga.ua.

14. Marketing Communications

Where an appropriate legal basis exists, the Company may inform users about promotions, special offers, new products, and loyalty programs through email, SMS, or push notifications.

Users may opt out of non-essential marketing communications through available settings or by contacting the Company.

Opting out of marketing does not affect necessary service notifications related to orders.

15. Children's Privacy

The services are not specifically directed at children and are not intended for children to independently place orders without an appropriate legal basis.

The Company does not knowingly collect children's personal data for targeted advertising.

If personal data belonging to a child is found to have been processed without an appropriate legal basis, the Company will take suitable measures.

16. Third-Party Services and Links

The website and mobile applications may contain links to third-party websites, payment services, social networks, and messaging platforms.

These services operate under their own privacy policies. Users are encouraged to review those policies before providing personal information.

17. Changes to This Privacy Policy

The Company may update this Privacy Policy in response to changes in legislation, service functionality, or personal data processing practices.

The latest version is published at:

https://3piroga.ua/en/polityka-konfidentsiinosti

The last updated date is displayed at the beginning of this document.

18. Contact Information

Personal Data Controller: ТОВ «Т.І.Р.»

Trademark: “Три Пироги” (Three Piroga)

Website: https://3piroga.ua

Email: info@3piroga.ua

Phone: +380 (44) 453-33-33

Contact address: 24 Lesi Ukrainky Boulevard, Kyiv, Ukraine.

This Privacy Policy applies to the 3piroga.ua website and the official “Три Пироги” mobile applications for Android and iOS.