1. DATA CONTROLLER
This Privacy Policy governs the processing of personal data by:
Mycotopia DOO Divoš
PIB: 111488299
MB: 21489689
Registered Address: Lekina 37, 22232 Divoš, Republic of Serbia
Email: info@themycotopia.com
The Company acts as Data Controller for personal data processed through the website
and related digital services.
For payment-related data, Paddle (Merchant of Record) may act as an independent
Data Controller, as described below.
2. SCOPE OF THIS POLICY
This Privacy Policy applies to:
• Website visitors
• Customers purchasing Digital Products
• Newsletter subscribers (if applicable)
• Users contacting the Company
• Individuals interacting with affiliate links
This Policy does not apply to third-party websites linked from this platform.
3. CATEGORIES OF PERSONAL DATA PROCESSED
The Company may process the following categories of personal data:
3.1 Identification Data
• Name
• Billing information (if provided)
3.2 Contact Data
• Email address
• Communication content
3.3 Transaction Data
• Purchase records
• Product type
• Payment status
Note: Full payment card data is not processed or stored by the Company.
3.4 Technical Data
• IP address (anonymized where applicable)
• Browser type
• Device type
• Operating system
• Access timestamps
3.5 Usage & Analytics Data
Collected via Google Analytics (GA4):
• Pages visited
• Time spent
• Interaction behavior
• Referral sources
3.6 Affiliate Attribution Data
Where affiliate links are used:
• Referral identifiers
• Conversion attribution
• Timestamp data
No sensitive personal data is intentionally collected.
4. PURPOSES OF PROCESSING
Personal data is processed for the following purposes:
• Order fulfillment
• Contract execution
• Customer communication
• Legal and accounting compliance
• Fraud prevention
• Platform security
• Website analytics
• Affiliate commission attribution
The Company does not engage in automated profiling producing legal effects.
5. LEGAL BASIS FOR PROCESSING (ARTICLE 6 GDPR)
Processing is based on:
• Article 6(1)(b) – Performance of contract
• Article 6(1)(c) – Legal obligation
• Article 6(1)(f) – Legitimate interest (security, fraud prevention, analytics in
aggregated form)
• Article 6(1)(a) – Consent (analytics and marketing cookies)
Users may withdraw consent at any time without affecting the lawfulness of prior
processing.
6. MERCHANT OF RECORD – PADDLE
All transactions are processed via Paddle.com Market Limited and affiliated entities.
Paddle acts as:
• Merchant of Record
• Independent Data Controller for payment and tax data
Paddle is responsible for:
• Payment processing
• VAT calculation and remittance
• Invoicing
• Fraud detection
• Chargeback handling
Customers are subject to Paddle’s Privacy Policy in relation to payment data.
The Company does not store full credit card information.
7. GOOGLE ANALYTICS (GA4)
The website uses Google Analytics 4 with:
• IP anonymization enabled
• Consent-based activation
• Aggregated reporting
• Data minimization principles
Analytics cookies are not activated prior to user consent.
Data may be processed by Google outside the EU under appropriate safeguards.
Retention period: up to 14 months unless configured otherwise.
8. DATA RETENTION
Personal data is retained only for as long as necessary:
• Contractual data: up to 10 years (accounting compliance)
• Communication data: up to 3 years
• Analytics data: up to 14 months
• Affiliate attribution: per partner retention policy
After retention periods expire, data is securely deleted or anonymized.
9. DATA SHARING
Personal data may be shared with:
• Paddle (Merchant of Record)
• Hosting providers
• Analytics providers (Google)
• Legal and accounting advisors
• Regulatory authorities when required by law
Data is not sold to third parties.
10. INTERNATIONAL DATA TRANSFERS
Certain service providers may process data outside Serbia or the European Economic
Area.
Where applicable, transfers are conducted using:
• Standard Contractual Clauses (SCCs)
• Adequacy decisions
• Contractual safeguards
11. DATA SECURITY
The Company implements appropriate technical and organizational measures,
including:
• SSL encryption
• Access controls
• Role-based permissions
• Secure hosting infrastructure
• Fraud monitoring
However, no system can guarantee absolute security.
12. DATA SUBJECT RIGHTS
Under applicable law, Users have the right to:
• Access personal data
• Rectify inaccurate data
• Erase personal data (right to be forgotten)
• Restrict processing
• Data portability
• Object to processing
• Withdraw consent
• Lodge complaint with supervisory authority
Requests may be submitted to:
info@themycotopia.com
13. CHILDREN’S DATA
The website is not intended for individuals under the age of 16.
The Company does not knowingly collect personal data from children.
If such data is discovered, it will be deleted promptly.
14. THIRD-PARTY LINKS
The website may contain links to third-party websites.
The Company is not responsible for their privacy practices.
Users are encouraged to review external privacy policies.
15. AFFILIATE RELATIONSHIPS
The website may include affiliate links.
Affiliate tracking may involve cookies activated only upon consent.
No sensitive financial information is collected through affiliate mechanisms.
16. AUTOMATED DECISION-MAKING
The Company does not conduct automated decision-making producing legal or similarly
significant effects.
17. COMPLAINTS
If you believe your data protection rights have been violated, you may:
• Contact the Company directly; or
• Lodge a complaint with the Commissioner for Information of Public Importance
and Personal Data Protection (Republic of Serbia), or with the relevant
supervisory authority in your jurisdiction.
18. CHANGES TO THIS POLICY
The Company reserves the right to amend this Privacy Policy at any time.
The updated version will be published on the website with the effective date.
19. CONTACT
Mycotopia DOO Divoš
Lekina 37, 22232 Divoš
Republic of Serbia
Email: info@themycotopia.com