Privacy and Cookie Policy

Who processes your data

The data controller is Rafineza, a wedding dress manufacturer, a bridal shop in Orsha and the owner of rafineza.by (“we”, “us”).

This policy follows the Law of the Republic of Belarus No. 99-Z of 7 May 2021 “On Personal Data Protection” and describes how the site actually works.

What data we receive

From the fitting form: your name, phone number, what you are interested in (buying or renting), the preferred fitting date, how you would like us to contact you, and your comment if you wrote one (for example, the wedding date or the dresses you liked).

From the question form: your name, phone number or e-mail, how you would like us to contact you, and your question.

Each request also keeps some details about itself: the site language, the page it was sent from, the IP address and the time.

On every visit the server receives the technical data the site cannot work without: IP address, browser and device details (user agent), the requested page and time.

Only with your consent: analytics and advertising data (see the cookie section): which pages you viewed, where you came from, how you used the site, approximate location by IP, device type.

If you contact us yourself on Instagram, WhatsApp, Telegram, Viber, by e-mail or by phone, we receive what you sent and the profile details that service shows us.

We do not collect special categories of personal data or payment details: there are no payments or accounts on the site. Purchases and rentals are arranged at the showroom, and you give the details a contract needs there.

Why we use it

To book your fitting and reply: contact you the way you chose, confirm the date and time, pick dresses for the fitting, answer your question. The request is stored on the site and e-mailed to our work mailbox.
To run and protect the site: keep your session, protect forms against request forgery and spam (a limit on requests per IP address, an “I’m not a robot” check), investigate errors.

We do not sell personal data, do not share it for other companies’ advertising and do not make decisions with legal effects on you based solely on automated processing.

Legal grounds

We process form data on the basis of your consent, which you give by ticking the box before sending. A form cannot be sent without it, but you can always message us on Instagram or a messenger, or call us instead.

Analytics and advertising cookies are set only after you click “Accept” in the cookie notice. If you choose “Necessary only”, the counters are not loaded at all, and the whole site still works.

Technical data and necessary cookies are processed without separate consent, as the site cannot be shown or protected without them, in the cases provided for by law. If you buy or rent a dress, data is also processed to conclude and perform the contract.

Cookies and similar technologies

Cookies are small files a site stores in your browser. Below is the full list of what this site uses.

Name	Set by	Purpose	Lifetime
Necessary
`rafineza-session`	Rafineza	Session: links your requests together so the catalog and the request forms work.	2 hours
`XSRF-TOKEN`	Rafineza	Protects forms against cross-site request forgery.	2 hours

Fonts, images and the “I’m not a robot” check are served from our own server: until you click “Accept”, the site makes no requests to third-party services and they learn nothing about you. Links to Instagram and the messengers are plain links: the service receives data only when you follow them.

Who we share data with

Requests are available only to the Rafineza staff who book fittings and answer questions. Data is also processed by:

the hosting provider whose servers host the site and its database;
the e-mail service that delivers requests to our mailbox;
public authorities, only when the law expressly requires it.

How long we keep data

requests: while we are in contact, preparing your fitting, or handling a purchase or rental, and no longer than 3 years after the last contact; if you withdraw consent, we delete them sooner, except data we must keep under a contract or the law;
session data (IP address, browser details): up to 2 hours after your last action on the site;
the per-IP request limit record: 1 hour;
web server logs: for the period set by the hosting provider; used only for diagnostics and protection against attacks;
cookies: for the periods in the table above, or until you delete them.

How we protect data

The site works over HTTPS. Requests are available only in a closed admin panel that only authorised staff can sign in to. Forms are protected against request forgery, spam and automated submissions, and third-party scripts are not loaded without your consent.

Your rights

At any time you can:

withdraw your consent to the processing of personal data;
find out what data of yours we process, why and on what grounds;
ask us to correct or complete inaccurate data;
find out which data we have shared and with whom;
ask us to stop processing and delete your data;
complain about our actions to the National Personal Data Protection Center of the Republic of Belarus (cpd.by) or to a court.

Changes to this policy

We update the policy when the way the site works changes, for example when a new service is added. The current version is always on this page, with its date at the top. If a change affects your consent to analytics and advertising, we will ask for it again.

Privacy policy