Effective as of 23rd April 2021
1. Purpose, Scope, and Users
1.1. At Cult of Whatever (COW) we value your rights to privacy and will do our best to make sure they are maintained. Cult of Whatever does not collect personal information from individuals unless when specifically supplied by individuals. We make efforts to comply with applicable laws and regulations related to personal data protection in countries where we operate. This Policy sets forth the basic principles by which we process your personal data, and indicates the responsibilities while processing personal data.
1.2. We are a data processor, as we provide services to companies who collect personal data. In some cases, we may be a data controller and in this case we acknowledge our direct responsibility before users of the site. Regardless of our status, we will treat any personal data as required by any applicable regulation, including but not limited to, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) available here.
1.3. We do not knowingly attempt to solicit or receive information from children.
2. Terms for the legal bases of the processing
2.1. Consent – your clear agreement to the processing of your personal data for a specific purpose.
2.2. Contract – the reason why the processing is necessary based on a contract you have with us, or because we have asked you to take specific steps before entering into that contract.
2.3. Legitimate Interests – the reason why the processing your data is necessary which is based on the legitimate interests or the legitimate interests of a third party, provided those interests are not outweighed by your rights and interests.
3. Consent rule
3.1. If you have given consent to the processing of your data you can freely withdraw such consent at any time by emailing us or contacting via the contact form.
3.2. If you do withdraw your consent, and if we do not have another legal basis for the processing of your data, then we will stop the processing of the personal data.
3.3. If we have another legal basis for the processing of your data, then we may continue to do so subject to your legal interests and rights.
4. Our responsibilities
4.1. If you are a registered user or a visitor to the website who is a data subject, we act as the ‘data controller’ of personal data. This means we determine how and why your data are processed.
5. Your responsibilities
5.2. Make sure you understand all your rights;
5.4. Treat your personal data confidential and secure.
6. Collected data
6.1. We collect data when you interact with its website, especially when:
6.1.1.you browse any page of the website;
6.1.2.you use the website;
6.1.3.you receive emails from us;
6.1.4.you chat with us for support;
6.1.5.you opt-in to marketing emails;
6.1.6.you make a comment;
6.1.7.we run competitions;
6.1.8.we measure site traffic;
6.1.9.in cases which do not depend on you but we have a legal basis to collect such data (see articles 6 and 9 of the GDPR)
6.2. We collect the following types of data:
6.2.1.contact details such as you’re your first name, last name, email address, home address;
6.2.2.data that identifies you such as your IP address, login information, browser type and version, time zone setting, browser plug-in types, geolocation information about where you might be, operating system and version;
6.2.3.data on how you use the website such as your URL clickstreams (the path you take through the website), goods/services viewed, page response times, download errors, how long you stay on webpages, what you do on those pages, how often, and other actions.
6.3. The recipients of the collected data are the owner of the website, and other third party service providers mentioned below.
7. Purposes and Legal Basis for the processing
7.1. We process the data for:
188.8.131.52. Details: we need to provide services accessible via the website.
184.108.40.206. Legal basis: Consent; Legitimate Interests.
7.1.2.Keeping the website running:
220.127.116.11. Details: managing your requests, login and authentication, remembering your settings, processing payments, hosting and back-end infrastructure.
18.104.22.168. Legal basis: legitimate Interests.
22.214.171.124. Details: we may ban you in some cases.
126.96.36.199. Legal basis: legitimate Interests.
188.8.131.52. Details: we may run competitions and if you win we need to contact you.
184.108.40.206. Legal basis: legitimate Interests.
7.1.5.Measuring site traffic:
220.127.116.11. Details: we need some analytics to evaluate indicators of the site activity.
18.104.22.168. Legal basis: legitimate Interests.
7.1.6.Improving the website
22.214.171.124. Details: testing features, interacting with feedback platforms, managing landing pages, heat mapping the website, traffic optimization and data analysis and research, including profiling and the use of machine learning and other techniques over your data and in some cases using third parties to do this.
126.96.36.199. Legal basis: Contract; legitimate Interests.
188.8.131.52. Details: notifying you of any changes to the service, solving issues, any bug fixing.
184.108.40.206. Legal basis: Contract; Legitimate Interests.
7.1.8.Marketing purposes (with your consent)
220.127.116.11. Details: sending you emails and messages about new functions, goods and services, and content.
18.104.22.168. Legal basis: Consent.
8. Data subject’s rights
8.1. You may choose not to provide us with personal data. If you choose to do so, you can continue to visit the website and browse its pages, but we will not be able to process transactions without personal data.
8.2. You may turn off cookies in your browser via settings. You can block cookies on your browser refusing cookies. You may delete cookies. If you turn off cookies, you can continue to use the website and browse its pages, but the website and certain services will not work properly.
8.3. You may ask us to refrain from using your data for marketing. You can opt out from marketing by emailing us or contacting via the contact form.
8.4. You can exercise the following rights by sending us an email or contacting via the contact form.
8.4.1.You have the right to access information about you, especially:
22.214.171.124. the categories of data;
126.96.36.199. the purposes of data processing;
188.8.131.52. third parties to whom the data disclosed;
184.108.40.206. how long the data will be retained and the criteria used to determine that period;
220.127.116.11. other rights regarding the use of your data.
8.4.2.You have the right to make us correct any inaccurate personal data about you.
8.4.3.You can object to using your personal data for profiling you or making automated decisions about you. We may use your data to determine whether we should let you know information that might be relevant to you (for example, tailoring emails to you based on your behaviour).
8.4.4.You have the right to the data portability of your data to another service or website. We will give you a copy of your data in readable format so that you can provide it to another service. If you ask us and it is technically possible, we will directly transfer the data to the other service for you.
8.4.5.You have the right to be “forgotten”. You may ask erasing any personal data about you, if it is no longer necessary for us to store the data for purposes of your use of the website.
8.4.6.You have the right to lodge a complaint regarding the use of your data by us. You can address any complaint to your national regulator (see the list here).
8.5. In the context of the right to access information we shall provide you with the information within one month of your request unless there is a justified requirement to provide such information faster.
9.1. We have security and organizational measures and procedures to secure the data collected and stored.
9.2. Connections to the website are encrypted using 256-bit SSL with integrity assured by the SHA2 RSA algorithm.
9.3. We use servers that comply with strict international data security standards, including ISO 27001.
9.4. You acknowledge that no data transmission is guaranteed to be 100% secure and there may be risks.
9.5. You are responsible of your login information and password. You shall keep them confidential.
9.6. In case if your privacy has been breached, please contact us immediately.
10. Location of the processing of personal data and third party service providers
10.1. The personal data collected by us is processed in the UK.
10.12. From time to time, we may add other services and we will inform you about new services.
11. Retention period
11.1. We store personal data as long as we need it and the retention practice depends on the type of data we collect, regulatory burden, and how we use the personal data. The retention period is based on criteria that include legally mandated retention periods, pending or potential litigation, intellectual property or ownership rights, contract requirements, operational directives or needs, and historical archiving.
12.1. We collect certain types of information when you access or use the website, including cookies and similar tracking technologies, such as pixels.
12.2. Cookies are small data files that are placed on your computer or mobile device when you visit this website. Cookies are used by the website in order to make the website work, or to work more efficiently, as well as to provide reporting information.
12.3. You may always turn off some of the cookies through your browser. If you turn off the cookies, this may influence the functionality of the website.
12.4. The list of cookies we use is listed in your browser and in the list of the third party service providers mentioned above.
13. Transfer of your personal data
13.1. We have servers in the United States. Personal data we collect from you will be processed in the United States. The United States has not sought nor received a finding of “adequacy” from the European Union under Article 45 of the GDPR. We rely on derogations for specific situations as set forth in Article 49 of the GDPR. In particular, we collect and transfers to the United States personal data only: with your consent; to perform a contract with you; or to fulfill a compelling legitimate interest in a manner that does not outweigh your rights and freedoms.