PRIVACY POLICY AND USE OF COOKIES

This Privacy Policy is an integral part of the Public Agreement concluded with us at the time of ordering the service (creating an order).

It also applies if you have ordered a derivative service (e.g. a cash on delivery) from another company (e.g. a partner). In this case, these third parties may also have their own privacy policies (other similar documents) that apply when collecting information about you. In addition, this Privacy and Cookie Policy applies to the personal data of the recipient for whose benefit the sending is made.

I. GENERAL INFORMATION

1. This Privacy and Cookie Policy is a set of rules for the processing of personal data and the collection of cookies (hereinafter: the Policy) of Nova Post LLC with its registered office at 103 Stolychne Shosse, Kyiv, 03026, building 1, floor 9, EDPOU code 31316718 (hereinafter: Nova Post LLC or the Administrator or the Company), including on the website.including on the website https://novaposhta.ua/ (hereinafter referred to as the "Service"), defines what data we collect about consumers who use our services, as well as about other persons whose personal data we process as part of our activities, including job candidates. This Policy also applies to the processing of personal data and communication on the Company's social media accounts (e.g. Facebook, Instagram, LinkedIn, Google), by phone, email or letter, how we use it and with whom we share it. This information also describes the measures we take to protect your personal data.

2. Users may contact the Administrator in the following ways:

A. by letter to the following address: Nova Post LLC, 103 Stolichnoye Shosse, building 1, floor 9, 03026, Kyiv, Ukraine;

B. e-mail: info@novaposhta.ua;

C. by phone: +380-800-500-609

To ensure better protection of personal data, the Company has appointed a Data Protection Officer (DPO). If you have any questions, comments or requests regarding the protection and processing of your personal data, you may contact the DPO:

Sergey Zimenkov
Company - Limited Liability Company "Nova Post"
103, Stolichnoye Shosse, Kyiv, 03026, Ukraine,
e-mail: dpo@novaposhta.ua

Be sure to include your name, surname, email address, as well as detailed questions, comments, complaints or requests in all correspondence.

3. Personal data is any information relating to an identified or identifiable natural person. The scope of this type of data includes, but is not limited to: first name, last name, address, telephone number and email address. Information that cannot be traced back to an identified or identifiable individual (e.g., statistical data) is not considered personal data.

II. CURRENT LEGISLATION ON PERSONAL DATA PROTECTION

"Nova Post" LLC complies with the requirements of the Law of Ukraine "On Personal Data Protection" dated 01.06.2010 No. 2297-VI. In addition, the company applies the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) as the best practice for the protection of personal data.

III. PROTECTION OF INFORMATION

1. By applying appropriate technical and organisational measures, Nova Post LLC makes all physical and technical efforts to protect personal data from loss, damage, disclosure to unauthorised persons, alteration or improper use.

2. All communications regarding personal data protection are recorded and explained in detail and analysed in accordance with applicable law.

IV. RIGHTS OF DATA SUBJECTS

1. We are pleased to inform you of your rights regarding the processing of personal data in accordance with the laws of Ukraine:

• 1
  To know about the sources of collection, location of their personal data, purposes of their processing, location or place of residence (stay) of the owner or manager of personal data or to give a corresponding order to obtain this information to persons authorised by them, except in cases established by law;
• 2
  Receive information about the conditions for granting access to personal data, including information about third parties to whom his/her personal data is provided;
• 3
  To access their personal data;
• 4
  To receive a response no later than thirty calendar days from the date of receipt of the request, except in cases provided for by law, on whether his or her personal data is processed, as well as to receive the content of such personal data;
• 5
  To submit a reasoned request to the personal data controller with an objection to the processing of their personal data;
• 6
  To submit a reasoned request to change or destroy their personal data by any owner and manager of personal data if such data is processed illegally or is unreliable;
• 7
  To protect their personal data from unlawful processing and accidental loss, destruction, damage due to intentional concealment, failure to provide or untimely provision, as well as to protect against the provision of information that is inaccurate or defamatory of the honour, dignity and business reputation of an individual;
• 8
  File complaints about the processing of their personal data with the Ukrainian Parliament Commissioner for Human Rights or a court;
• 9
  Apply legal remedies in case of violation of personal data protection legislation;
• 10
  To make reservations about the restriction of the right to process their personal data when giving consent;
• 11
  Withdraw consent to the processing of personal data (if granted);
• 12
  Know the mechanism of automatic processing of personal data;
• 13
  To be protected against an automated decision that has legal consequences for him or her.

2. In addition to the Ukrainian legislation on personal data protection, "Nova Post" LLC is committed to ensuring your rights under the GDPR. The rights of personal data subjects in accordance with the GDPR:

A. to receive information and have access to data concerning him/her (data subject's right of access under Article 15 of the GDPR);

B. to correct their personal data that is incorrect and to update their data (right to data rectification, Article 16 GDPR);

C. request the deletion of your personal data (right to data erasure under Article 17 of the GDPR);

D. requests for termination of processing (right to restrict processing under Article 18 of the GDPR);

E. to request the transfer of data to another controller (right to data portability pursuant to Article 20 of the GDPR);

F. objecting to the processing of his/her personal data (right to object under Article 21 of the GDPR).

V. REALISATION OF THE RIGHTS OF PERSONAL DATA SUBJECTS

• 1
  Access to personal data. You shall have the right to request confirmation from us as to whether we are processing personal data relating to you and, in such cases, to request access to your personal data that we are processing, or to provide information about the personal data if direct access is unavailable.
• 2
  Correction of personal data. If you believe that information about you is inaccurate or incomplete, you shall have the right to request us to correct it.
• 3
  Withdrawal of consent. Since we process your personal data based on your consent, you shall have the right to withdraw your consent to the processing of personal data at any time.
• 4
  Objection to data processing for the purpose of providing direct marketing and sending commercial & marketing information. You shall have the right to object to the processing of your personal data for the purpose of targeted advertising at any time.
• 5
  Objection to processing based on legitimate interests. You shall have the right to object to the processing of personal data that we process based on our legitimate interests, however, we will continue to process your data even though you object unless we have legitimate reasons to continue processing it. To exercise the above rights, please send a written request to us or our DPO as set out in Section 1 hereof.
• 6
  Removal. In certain circumstances, you have the right to ask us to delete your personal data, but this does not apply where the law requires us to retain the data. To exercise the above rights, please send a written request to us or to our DPO as specified in Section 1 of this Policy.
• 7
  Restrictions on processing. Under certain circumstances, you shall have the right to restrict the processing of your personal data. Please note that if you make a request to restrict the processing of your data, this may affect your ability to receive our services. To exercise the above rights, please send a written request to us or our DPO as specified in Section 1 hereof.
• 8
  Data transfer. Finally, you shall have the right to receive or transfer your personal data to another Data Administrator. These rights only include data that you have provided to us based on your consent or contract and where the processing is automated. To exercise the above rights, please send a written request to us or our DPO as specified in Section 1 hereof.

VI. CATEGORIES OF PERSONAL DATA. PURPOSES OF THEIR PROCESSING AND LEGAL FRAMEWORK

1. In order to provide services and perform the contract (in accordance with clause 3, part 1, article 11 of the Law of Ukraine "On Personal Data Protection"), "Nova Post" LLC as the Administrator processes the following necessary personal data:

A. Sender's data: sending address, necessary contact details, signature, payment information and other data required to perform the service ordered by the sender;

B. Recipient's data: name and surname, signature, address, postal code, city, country, as well as, optionally, other data necessary for the implementation of the service provided by the sender or specified by the recipient, in particular, e-mail address, telephone number;

C. Other data: registration and contact details of persons acting on behalf of the sender or recipient (e.g. name, surname, telephone number, email address, signature).

2. Providing personal data is voluntary, but necessary for the performance of the Services provided by "Nova Post LLC". If the Sender provides additional personal data of the Recipient in connection with the choice of one of the Additional Services, the Sender is responsible for the correct collection of this data, in particular for obtaining the Recipient's consent to their transfer to "Nova Post" LLC.

3. In some cases, data is also processed:

А. In accordance with the requirements of Article 6 of the Law of Ukraine "On Personal Data Protection", we process your personal data on the basis of your explicit consent. This may include, but is not limited to, processing your date of birth to send you birthday greetings or to provide you with marketing materials such as discounts or promotions. We may also process your contact details, such as telephone or e-mail, to send you marketing offers or company news.
You have the right to withdraw your consent at any time, and this will not affect the lawfulness of the data processing that has been carried out prior to the withdrawal.

B. In accordance with Article 11 of the Law of Ukraine "On Personal Data Protection", we process your data on the basis of our legitimate interests. This may include, among other things, verifying your solvency to prevent fraud and ensure the proper operation of the company. We also process data as part of our compliance programmes and to comply with legal requirements, including sanctions. We may conduct surveys about your satisfaction with the services we provide, including telephone surveys, to analyse your responses and provide feedback. In addition, we maintain video surveillance at our branches to ensure the safety of our customers, employees and property.

4. As a registered postal operator, "Nova Post" LLC also processes personal data in order to fulfil its legal obligations arising from the requirements of the Law of Ukraine "On postal service" and the Law of Ukraine "On Accounting and Financial Reporting in Ukraine". This includes, in particular, proper payment for services rendered, handling complaints and fulfilment of other obligations arising in the course of providing services.

5. The use of the business account and the application of "Nova Post LLC" may involve the processing of personal data for the following purposes:

А. Placing an order and providing services necessary for its execution.

B. Tracking of shipments - the number of the shipment information about its status.

C. Contact via the contact form - data sent via the contact form, such as name and surname, address, postal code, city, e-mail address, necessary for processing and responding to the request. Consent to the processing of data such as e-mail address, telephone number may be necessary for communication and submission of a commercial offer.

D. Communication with a consultant via chat - the data sent during a conversation with a consultant, such as e-mail address, name and surname, address, postal code, city, are processed in order to verify the question asked and provide an answer to the question.

E. Shipment forwarding - through the business account and the application of "Nova Post LLC", the Sender or the Recipient can change the delivery address. For this purpose, we collect the following personal data:

• 1
  name and surname of the recipient;
• 2
  street / house number;
• 3
  postal code / place of residence;
• 4
  email address.

6. Geolocation. Your personal data, including information about your location, is processed to help you find the nearest branch or parcel locker. The use of this function is not mandatory and is not required for the proper use of the application.

The legal basis for processing your data is your consent, which you provide when you install the mobile application and authorise the use of geolocation services for your mobile device. You have the opportunity to change or withdraw your consent at any time via your phone settings, which will not affect the lawfulness of the data processing until the consent is withdrawn.

7. Direct marketing and sales promotion. In order to inform you about promotions, new products and services, as well as other special offers, "Nova Post LLC" may process your personal data provided during registration in the mobile application or business account posted on the website. Such data may be processed in the following ways:

• 1
  on the basis of the legitimate interest of the Administrator when it comes to direct marketing of its own goods and services of "Nova Post LLC", in accordance with Article 11 of the Law of Ukraine "On Personal Data Protection". Within the framework of this interest, general contact information may be used to display personalised banners, notifications or recommendations in the application or business account. You can object to such processing at any time by using the appropriate profile settings or by contacting the Administrator.
• 2
  on the basis of your separate consent, when it comes to sending marketing information by electronic means of communication, such as e-mail, SMS, public communication channels (in particular, in messengers such as Telegram, Viber or other similar applications). In particular, this may include: birthday greetings, information about promotions, special offers, as well as notifications about goods and services promoted both in cooperation with partners and independently by third parties. Such consent is provided voluntarily by activating the appropriate option in the settings or other interaction with the mobile application or business account.

8 . Selection of candidates. During the recruitment process, the following categories of your data will be processed for the purposes and on the lawful basis.

• 1
  Basic data (name, date of birth), if possible;
• 2
  Contact information (address, telephone number, email address, etc.), if available;
• 3
  Application details (CV, motivation letter, certificates, references, interview notes and any data you provide to us or wish to provide during the interview);
• 4
  Photos, videos, if possible;
• 5
  Citizenship and work permit, if applicable;
• 6
  Health information for work, if available;
• 7
  A criminal record if it relates to a vacancy advertised, for example, for drivers;

Data that you have provided through publicly available platforms used for professional purposes, in accordance with the applicable terms and conditions of the company responsible for managing the platform;

Communication and means of communication (e.g. confirmation of your application or information about a telephone/video interview, if applicable).

In addition to these categories of data, to evaluate each job application, we need data that tells us how well you fit the position.

To manage our relationship with you, including:

• 1
  To assess your suitability for the job (purpose), the legal basis for processing is the performance of a contract;
• 2
  To organise and conduct (video) interviews (purpose), the legal basis for processing is the performance of a contract;
• 3
  To verify your data against applicable sanctions lists and laws (purpose), the lawful basis for processing is a.) legal obligation and b.) legitimate interest.

We collect data directly from you when you provide your details on our careers website or through other communication channels. When you use another channel, for example through publicly available platforms used for professional purposes, such as LinkedIn, we will process your data in accordance with the applicable terms and conditions of that platform. When we work with recruitment agencies, we receive your data indirectly. In this case, these agencies are responsible for ensuring the accuracy of the data and transferring it to us in accordance with applicable law.

9. Video cameras and video surveillance. We monitor and process your personal data when you visit our branches, both for your personal safety and for the safety of our employees, customers and property. Video surveillance is carried out in compliance with strict security and confidentiality rules using state-of-the-art technology and equipment. Video surveillance recordings are stored in our systems for up to 30 calendar days.

10. Registration and recording of telephone conversations. Personal data and categories of data subjects in the register.

The following identification data of telephone calls are recorded:

• 1
  Call start and end times;
• 2
  Call start and end times;
• 3
  Subscriber number;
• 4
  I called the service number;
• 5
  Name and telephone number of the official.

All calls to service numbers are recorded. Recordings are made in a predefined manner. The recording starts after the call is answered and ends with a ring tone.

The following details of chat and chatbot sessions are recorded:

• 1
  Time of the session
• 2
  Name of the consultant and client in the chat

Chat sessions store the content of the session between the client and the consultant, and chatbot sessions store the content of the session between the automated chatbot and the client.

The content of the chatbot's responses is mainly collected from the website and other publicly available sources accessible to everyone. At the beginning of the session, customers are provided with instructions for use.

The customer is not asked any personal questions, and the customer cannot resolve personal issues using the chatbot service. If a customer provides digital identification data, such as a phone number, to the chatbot service, the data is automatically deleted after one hour.

If we send an SMS request to a customer who has contacted our service number by telephone, the following data is recorded:

• 1
  Request time;
• 2
  Customer phone number;
• 3
  Written responses to customer requests.

To identify customers who receive information about the actual beneficial owners, the following data is recorded:

• 1
  Name of the person and identification code.

VII. DATA EXCHANGE AT NOVA POST LLC

1. Nova Post LLC may provide personal data:

A. Your personal data may be transferred to other companies that are directly or indirectly owned or controlled by the same ultimate beneficial owners as Nova Post LLC, as well as to our subcontractors (in particular, involved transport companies, operating points of receipt and delivery of shipments). Such transfer is carried out exclusively for the purpose of proper performance of the delivery service - from the moment of acceptance of the parcel to its delivery to the Recipient. The transfer may be carried out both on the territory of Ukraine and abroad, including in the countries of the European Union.

B. Companies that provide services to or on behalf of Nova Post LLC (e.g. IT service providers).

C. Other persons or organisations in accordance with applicable law;

D. Banks and payment operators for the transaction (including payments made using codes);

E. to law enforcement officials and authorities to comply with national security requirements or as part of legal proceedings to protect property, or to continue to investigate violations of the principles and policies of "NOVA POST" LLC, unauthorised access to or use of NOVA POST LLC equipment or any other illegal activity.

F. Mobile cellular operators (PJSC "VF Ukraine" (EDRPOU 14333937) and/or PJSC "Kyivstar" (EDRPOU 21673832) and/or LLC "Lifecell" (EDRPOU 22859846), which provide telecommunication services to the Client and process data related to the provision of such services (hereinafter referred to as the Operator), information in the following composition the Client's known telephone number in the Operator's mobile (mobile) communication network in order to prevent unauthorised access and protect interests from fraudulent actions by third parties.

2. Only the Sender and the Recipient have the right to receive information about the shipment. Nova Post LLC may provide such information to other persons only in cases specified in the relevant provisions of the law, in particular in the Law of Ukraine "On Personal Data Protection".

VIII. DATA RETENTION AND DELETION PERIOD

1. Nova Post LLC processes personal data only for the time necessary to achieve the purpose for which it was collected. The data retention period is determined based on the following requirements:

A. Operational Requirements: the period during which the information is required to perform the Services provided.

B. Legal requirements: the period during which Nova Post LLC must retain data for a specified period of time to comply with the law.

C. Legitimate interests of "Nova Post" LLC: the period during which the data is processed for the purpose of their implementation, in particular to establish and consider possible claims in connection with the Services provided.

2. What information do we collect about you and how do we use it?

3. Archived data is only available to authorised employees. After the data storage period expires, it is permanently deleted.

IX. TRANSFER OF PERSONAL DATA TO COUNTRIES OUTSIDE THE EUROPEAN ECONOMIC AREA

1. Personal data is transferred to third countries if the services provided by "Nova Post" LLC are also to be performed in a third country. Personal data may also be transferred to subcontractors of "Nova Post" LLC (for example, organisations that deliver shipments to the territory of a third country) and organisations that provide tax, legal, audit and settlement consultations to "Nova Post" LLC, if they operate in a third country. .

2. Nova Post LLC does not transfer personal data to international organisations.

3. Nova Post LLC does not transfer personal data to third countries if it is impossible or contrary to generally accepted law.

4. The level of protection of personal data outside the European Economic Area ("EEA") does not coincide with the level provided for by European legislation. Therefore, Nova Post LLC transfers personal data outside the EEA only when it is necessary, ensuring an adequate level of data protection, mainly through

A. cooperation with personal data processing entities in countries for which a relevant decision of the European Commission has been issued to ensure an adequate level of personal data protection;

B. use of standard contractual clauses issued by the European Commission, provided that an appropriate level of personal data protection is ensured;

5. In the event of a reasonable intention to transfer personal data outside the EEA, other than as stated above, Nova Post LLC will notify this fact at the appropriate stage of data processing in accordance with applicable law.

X. INFORMATION ABOUT THE DATA COLLECTED THROUGH THE WEBSITE OF NOVA POST LLC

1. Event log and cookies. Each time a user visits the website of "Nova Post" LLC, data is stored in a log file. The amount of temporarily stored data includes:

A. IP number of the computer from which the request was received;

B. Domain name;

C. Date and time of the access;

D. Response code http ;

E. Pages visited;

F. Name and version of the operating system;

G. Browser name and version;

H. Screen resolution.

2. The use of the websites of "Nova Post" LLC may be associated with the use of cookies by the servers of "Nova Post" LLC. These files are used by site administrators. Each user can configure the settings of their browser so that it does not accept cookies. In this case, no data will be stored on the visitor's computer. The information stored in cookies will not be sent to "Nova Post LLC".

XI. COOKIES

1. Cookies are Internet data, in particular text files, stored on the User's end device (computer, mobile phone, tablet). First of all, they contain the name of the website of their origin, their unique number and the time of storage on the end device. Cookies are used to provide the Administrator with statistical information about the User's traffic, User activity and the way the Service is used. They allow you to customise content and services in accordance with the User's preferences.

2. In connection with our use of cookies, we provide the most important information about their use:

A. The cookie mechanism is not used to obtain any information about the Users, except for information about their behaviour on the pages of the Service.

B. The Administrator stores cookies on the Users' computers in order to:

1.a. proper adaptation of the Service to the needs of Users and optimisation of the use of websites;

1.b. remembering the User's preferences and individual settings, recognising the User's device and displaying the Website properly in accordance with the User's needs (full version, mobile version of the Website);

1.c. creating statistics on website views, which helps to understand how Users use the websites, which allows to improve their structure and content;

1.d. support for the User's session (after login), so that the User does not need to re-enter the login and password on each subpage of the Website;

1.e. saving the basket data in the online store so as not to lose it after visiting the Service again.

3. The website uses two main types of cookies: session cookies and persistent cookies. Session cookies are temporary files that are stored on the end device of the Website User until the User logs out, exits the Website or shuts down the software (web browser). Persistent cookies are stored on the end device of the Website User for the time specified in the cookie settings or until they are deleted by the Website User.

4. The Service uses three main types of cookies:

• 1
  "Necessary" cookies that enable you to use the services available on the Website, for example, authentication cookies used for services that require authentication on the Website, security cookies used to ensure security, for example, cookies used to detect authentication fraud on the Website;
• 2
  "Functional and analytical" cookies, which allow to "remember" the settings selected by the User and personalise the User's interface, for example, with regard to the User's chosen language or region, font size, appearance of the Website and allow to collect information on how to use the Website pages, etc;
• 3
  "Advertising" cookies that allow Website Users to be provided with advertising content that is more relevant to their interests.

5. When you first visit the website, you will be shown information about the use of cookies. The use of the website requires the processing of "necessary" cookies. The processing of other cookies is possible after you have given your consent to the use of cookies in accordance with the provisions of this Policy. You can always withdraw your consent by changing the cookie settings in your browser. These settings can be changed, in particular, in such a way as to block the automatic processing of cookies in the browser settings or to inform you about each placement of cookies on the end device of the Website User. Detailed information on the possibilities and methods of processing cookies is available in the software (web browser) settings.

"Advertising" and "analytical" cookies placed on the end device of the Website User may also come from the Administrator's partners and be used for analytical and marketing purposes. Detailed information on this can be found in the privacy policy of this partner. The Administrator uses the following analytical and marketing tools provided by partners:

a. Google Ads – files used by Google to configure advertising in its services, for example in the search engine or to display advertising on the Internet, for more information see: https://policies.google.com/technologies/partner-sites

b. Facebook pixels – files used to match advertising on Facebook services to the individual preferences of the recipient, for more information see: https://www.facebook.com/privacy/policies/cookies/

c. Google Analytics – files used to analyze how users use the website, create statistics and reports, for more information see: https://policies.google.com/technologies/partner-sites

XII. BLOCKING THE USE OF COOKIES

1. In many cases, web browsers allow cookies to be stored on the User's end device by default. Users of the website can change the settings of cookies at any time, for example, in such a way as to block the automatic processing of cookies or to notify them of each time they are published on the website user's device. Detailed information on the possibilities and methods of processing cookies is available in the browser settings or on the following websites:

A. in the Internet Explorer browser;

B. in the Mozilla Firefox browser;

C. in the Google Chrome browser;

D. in the Safari browser;

E. in the Opera browser;

2. However, the Administrator informs you that restricting the use of cookies may affect some of the functions available on the Website pages.

XIII. COMPLAINTS

1. If you have a complaint about how Nova Post LLC processes your data, please send it in writing, providing as much detail as possible, using the contact information in Section I of this Policy. NOVA POST LLC will work with you to resolve any issues without delay.

2. The personal data protection authority in Ukraine is the Office for Protection of Personal Data of the Secretariat of the Commissioner of the Verkhovna Rada of Ukraine for Human Rights. You can address your complaints or suggestions to it if you believe that your rights have been violated in respect of the personal data processing.

XIV. AMENDMENTS TO THIS POLICY

1. Any changes that NOVA POST LLC may make to this privacy policy in the future will be posted on the website https://novaposhta.ua/ or https://novapost.com/. The new terms may be displayed on the screen and you may be required to read and accept them in order to continue using any/all of the Services of "Nova Post LLC".

This version of the Policy was updated on 09.05.2025