Privacy Policy (European Economic Area)
This policy explains how we process personal data of individuals located in the European Economic Area (EEA) and the United Kingdom, in accordance with the General Data Protection Regulation (GDPR) and the UK GDPR.
1. Controller
We, as the operator of this website, are the data controller for the processing described in this policy. Contact details are available in the site footer.
2. Lawful Bases for Processing
We process personal data on the following legal bases: (a) performance of a contract (e.g., account registration, order fulfilment); (b) legitimate interests (e.g., security, fraud prevention, service improvement), balanced against your rights; (c) consent, where we ask for it (e.g., optional marketing); (d) compliance with legal obligations.
3. What We Process
Account data (username, email), usage logs (time, pages, IP, browser type), and order records. Payment is processed by third-party providers; we do not store your payment credentials.
4. Data Subject Rights
You have the right to access, rectify, erase (right to be forgotten), restrict processing, data portability, and object to processing (including profiling). You also have the right to withdraw consent at any time and to lodge a complaint with a supervisory authority.
5. Retention
We keep personal data no longer than necessary for the purposes stated, and in accordance with legal retention periods (e.g., tax/accounting records).
6. International Transfers
Where personal data is transferred outside the EEA/UK, we rely on appropriate safeguards such as the EU Standard Contractual Clauses (SCCs) or adequacy decisions, as applicable.
7. Security & Data Breach
We apply appropriate technical and organizational measures. In the event of a personal data breach, we will notify the relevant supervisory authority and affected individuals as required by Article 33/34 GDPR.
8. Contact & DPO
For any privacy request or question, contact us via the site footer. We will respond within one month as required by the GDPR.