pp – hypneo.online

Article 1: Introduction and Scope

1.1 Purpose of This Policy

This Privacy Policy establishes the framework governing the collection, processing, storage, and protection of personal data by Zekvra MB (hereinafter "the Controller," "we," "us," or "our") in connection with the operation of the Hypneo digital wellness platform.

1.2 Data Controller Identity

Legal Name: Zekvra MB

Company Registration Number: 307845219

Registered Office: Verkių g. 15-3, LT-08221 Vilnius, Lithuania

Contact Email: contact@hypneo.online

1.3 Regulatory Framework

Our data processing activities comply with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, "GDPR"), the Law on Legal Protection of Personal Data of the Republic of Lithuania, and all applicable national and international data protection legislation.

1.4 Policy Updates

We reserve the right to revise this Privacy Policy periodically to reflect changes in our practices, technological developments, or legal requirements. Material changes will be communicated to registered users via email notification or prominent platform notice. Continued use of our services following notification constitutes acceptance of the revised policy.

Article 2: Categories of Personal Data Collected

2.1 Account and Registration Data

When you create an account on our Platform, we collect and process:

Full name (first name and surname)
Email address
Account password (encrypted and hashed)
Date of account creation
Account preferences and settings
Profile customization data
Authentication credentials

2.2 Transaction and Billing Information

For subscription processing and payment fulfillment, we collect:

Payment card information (processed by third-party payment processors)
Billing address
Transaction history and order details
Subscription plan selection
Purchase timestamps and amounts
Currency and payment method preferences
Invoice and receipt data

2.3 Usage and Interaction Data

To enhance service quality and user experience, we collect:

Session duration and frequency
Audio content accessed and completion rates
Feature utilization patterns
Navigation paths within the Platform
Search queries and preferences
Progress tracking and milestone achievements
User feedback and ratings

2.4 Technical and Device Information

For security, optimization, and technical support purposes, we collect:

Internet Protocol (IP) address
Device identifiers and hardware specifications
Operating system type and version
Browser type, version, and language settings
Screen resolution and display characteristics
Mobile network information
Time zone and geographic location data
Referral source and access method

2.5 Communication Records

When you contact our support team or communicate with us, we retain:

Correspondence content (emails, messages, chat transcripts)
Support ticket information and resolution history
Inquiry subject matter and timestamps
Attachments and supplementary documentation
Response records and follow-up communications

2.6 Marketing and Analytics Data

Subject to your consent, we may collect:

Marketing communication preferences
Campaign interaction and engagement metrics
Advertisement click-through data
Conversion tracking information
A/B testing participation data
Social media interaction records

Article 3: Legal Bases and Purposes for Data Processing

All personal data processing activities are conducted in accordance with lawful bases established under Article 6 of the GDPR. Below we specify the legal basis, purpose, and retention period for each processing activity.

3.1 Contract Performance (Article 6(1)(b) GDPR)

Purpose: Service Delivery and Account Management

Data Processed: Account credentials, profile information, subscription details, usage data

Necessity: Essential for providing access to our digital wellness platform and delivering subscribed services

Retention Period: Duration of active subscription plus six (6) years following account closure or final login, whichever occurs later

Purpose: Payment Processing and Financial Transactions

Data Processed: Billing information, payment card details (tokenized), transaction records, purchase history

Necessity: Required to process subscription payments, issue invoices, and maintain financial records

Retention Period: Ten (10) years from date of transaction to comply with accounting obligations

3.2 Legal Obligation (Article 6(1)(c) GDPR)

Purpose: Compliance with Accounting and Tax Regulations

Data Processed: Financial records, invoices, payment documentation, tax-related information

Legal Requirement: Lithuanian Law on Accounting, Tax Administration Law

Retention Period: Ten (10) years from fiscal year end as mandated by Lithuanian legislation

Purpose: Regulatory Compliance and Legal Proceedings

Data Processed: All relevant personal data required for legal compliance, litigation, or regulatory investigation

Legal Requirement: Court orders, regulatory demands, law enforcement requests

Retention Period: Duration of legal proceedings plus three (3) years following final resolution

3.3 Legitimate Interests (Article 6(1)(f) GDPR)

Purpose: Platform Security and Fraud Prevention

Data Processed: IP addresses, device identifiers, authentication logs, suspicious activity indicators

Legitimate Interest: Protecting our Platform from unauthorized access, fraud, and malicious activities; safeguarding user accounts and data integrity

Balancing Test: Security measures are proportionate and do not override user privacy rights

Retention Period: Two (2) years from collection date

Purpose: Service Improvement and Development

Data Processed: Anonymized usage statistics, feature engagement metrics, performance data

Legitimate Interest: Enhancing platform functionality, optimizing user experience, and developing new features

Retention Period: Three (3) years from collection date

Purpose: Business Operations and Administration

Data Processed: Account records, correspondence, operational metrics

Legitimate Interest: Efficient business management, quality assurance, internal reporting

Retention Period: Five (5) years from last interaction

3.4 Consent (Article 6(1)(a) GDPR)

Purpose: Marketing Communications

Data Processed: Email address, name, communication preferences, engagement history

Consent Mechanism: Explicit opt-in during registration or via preference center

Withdrawal Rights: Users may withdraw consent at any time via unsubscribe links or account settings

Retention Period: Until consent withdrawal or three (3) years of inactivity, whichever occurs first

Purpose: Non-Essential Cookies and Tracking Technologies

Data Processed: Cookie identifiers, browsing behavior, advertising interaction data

Consent Mechanism: Cookie banner and preference management tool

Withdrawal Rights: Users may modify or withdraw consent through cookie settings

Retention Period: As specified in cookie banner; typically 12-24 months

Purpose: Customer Support and Assistance

Data Processed: Support inquiries, correspondence, resolution records

Consent Mechanism: Implicit consent through voluntary submission of support requests

Retention Period: Four (4) years from final communication

Article 4: Data Sharing and Third-Party Recipients

4.1 General Principles

We do not sell, rent, or trade personal data to third parties. Data sharing occurs only when necessary for service provision, legal compliance, or with explicit user consent. All third-party processors are bound by contractual obligations ensuring GDPR compliance and appropriate data protection standards.

4.2 Categories of Recipients

Payment Processing Partners

Purpose: Transaction processing, fraud detection, payment authentication

Data Shared: Payment card information, billing address, transaction amounts

Location: European Union and United States

Safeguards: PCI-DSS compliance, Standard Contractual Clauses, encryption protocols

Cloud Infrastructure Providers

Purpose: Data hosting, storage, backup, and retrieval services

Data Shared: All platform data stored on cloud servers

Location: European Union data centers with redundancy in EEA

Safeguards: ISO 27001 certification, encryption at rest and in transit, access controls

Customer Support Service Providers

Purpose: Technical assistance, inquiry resolution, user communication

Data Shared: Support tickets, user inquiries, account information necessary for resolution

Location: European Union

Safeguards: Confidentiality agreements, limited access protocols, data processing agreements

Analytics and Performance Monitoring Tools

Purpose: Platform performance analysis, user behavior insights, service optimization

Data Shared: Anonymized usage data, aggregated statistics, technical performance metrics

Location: Worldwide (including United States)

Safeguards: Data anonymization, Standard Contractual Clauses, privacy shield frameworks

Marketing and Communication Platforms

Purpose: Email delivery, marketing campaign management, user engagement

Data Shared: Email addresses, names, communication preferences

Location: European Union and United States

Safeguards: GDPR-compliant processors, Standard Contractual Clauses, opt-out mechanisms

Legal and Professional Advisors

Purpose: Legal counsel, compliance audits, regulatory advice

Data Shared: Information necessary for legal representation or compliance verification

Location: Primarily European Union

Safeguards: Professional confidentiality obligations, attorney-client privilege

Regulatory Authorities and Law Enforcement

Purpose: Legal compliance, law enforcement cooperation, regulatory reporting

Data Shared: Information required by law, court order, or regulatory demand

Location: As required by jurisdiction

Safeguards: Verification of legal authority, disclosure limited to legally required information

4.3 International Data Transfers

When personal data is transferred outside the European Economic Area (EEA), we ensure adequate protection through:

European Commission Adequacy Decisions: Transfers to countries deemed to provide adequate data protection
Standard Contractual Clauses (SCCs): EU-approved contractual terms ensuring GDPR-level protection
Binding Corporate Rules: Internal policies ensuring consistent data protection across global operations
Explicit Consent: Where applicable, obtaining user consent for specific international transfers

Article 5: Data Subject Rights

As a data subject under GDPR, you possess the following rights regarding your personal data. These rights are subject to legal limitations and exceptions as specified in applicable data protection legislation.

5.1 Right of Access (Article 15 GDPR)

You have the right to obtain confirmation as to whether we process your personal data and, where applicable, access to such data along with information concerning:

Categories of personal data being processed
Purposes of processing
Categories of recipients to whom data has been disclosed
Retention periods or criteria for determining retention
Sources from which data was obtained
Existence of automated decision-making, including profiling

Response Time: Within one (1) month of verified request receipt, extendable by two (2) months for complex requests

5.2 Right to Rectification (Article 16 GDPR)

You may request correction of inaccurate personal data and completion of incomplete data. We will notify all recipients of rectifications unless doing so proves impossible or involves disproportionate effort.