Privacy Policy
The purpose of this Privacy Policy is to provide you with basic information about how Mind Well Ltd. processes your data when you visit and use our website. This Privacy Policy helps you better understand how we use your personal data, for what purposes, and with whom we share it.
1. Contact Details of the Data Controller
- Name: Mind Well Ltd.
- Head Office: Sveti Duh 166/C, 10109 Zagreb, Croatia
- Company Registration Number: 04548884
- VAT ID: 53750354005
- info@mindwell.hr
2. Purpose and Legal Basis of Processing; Retention Period
Please find detailed information below on the data processing activities of the Controller.
| Purpose of Processing | Processed Personal Data | Legal Basis | Retention Period |
|---|---|---|---|
| Operation and maintenance of the website and management of your visit | End-user data (including cookies and technical data related to website visits, in particular IP address, browser language and version). | GDPR Art. 6(1)(f) – legitimate interest of the Data Controller relating to the storage of certain data necessary for the basic functioning of the website. | For as long as necessary to achieve the purpose, primarily until the end of the website visit. |
| Customer support activities (Zendesk) | (i) Identification data (e.g., name, username if registered); (ii) Contact details (e.g., email, phone, address); (iii) Communication content. | GDPR Art. 6(1)(b) – processing is necessary for the performance and fulfillment of the Terms of Use as a contract and for accessing website services. | 5 years from termination of the contract or as long as necessary for the processing purpose (if no contract is concluded); or up to 5 years from account deletion (general statute of limitations). |
| Managing/continuing communication where there is general interest in products and services | (i) Identification data (e.g., social media username); (ii) Contact details (e.g., email); (iii) Communication content. | GDPR Art. 6(1)(f) – legitimate interest of the Data Controller (ensuring smooth communication with users). | As long as needed to provide a response. |
| Website registration | Name, address, phone number, Skype, email, titles, qualifications. | GDPR Art. 6(1)(b) – processing is necessary for concluding and performing a contract. | 5 years from deletion of the user account (until the expiry of the general 5-year limitation period). |
| Data analysis to improve the website and services, marketing activities, and enhancement of user relationships and experience | End-user data (e.g., cookies, technical data about website visits, in particular IP address, browser language and version). | GDPR Art. 6(1)(a) – consent. | Until consent is withdrawn. Withdrawal does not affect the lawfulness of processing prior to withdrawal. |
| Processing and fulfillment of online purchases (order tracking, records, identification, confirmation) | (i) Identification data (e.g., name, company name, username); (ii) Contact details (email, phone, address); (iii) Transaction data (e.g., payment details); (iv) Tax ID; (v) Delivery address. | GDPR Art. 6(1)(b) – processing is necessary for the performance and fulfillment of the relevant contract. | General limitation period (5 years). |
| Online payments and invoicing | (i) Identification data (e.g., name, company name, username); (ii) Contact details (email, phone, address); (iii) Transaction data (e.g., payment details); (iv) Tax ID; (v) Billing address. | GDPR Art. 6(1)(c) – legal obligation. | For invoice-related data: 8 years (in accordance with accounting regulations). |
| Delivery of purchased products | (i) Identification data (e.g., name, username); (ii) Contact details (email, phone, address). | GDPR Art. 6(1)(b) – processing is necessary for the performance and fulfillment of the relevant contract. | General limitation period (5 years). |
| Downloading purchased books or other materials from the website | Name, address, qualifications (optional); place of residence (country). | GDPR Art. 6(1)(b) – processing is necessary for the performance and fulfillment of the relevant contract. | 5 years from deletion of the user account (until the expiry of the general 5-year limitation period). |
| Handling complaints related to purchased products | (i) Identification data (e.g., name, username); (ii) Contact details (email, phone, address); (iii) Transaction data; (iv) Consumer complaint details and resolution. | GDPR Art. 6(1)(c) – legal obligation. | 3 years – in accordance with consumer protection regulations governing the retention period for complaint documentation. |
| Contacting and sending newsletters about the Data Controller’s and others’ products/services | (i) Identification data (e.g., name, username); (ii) Contact details (email). | GDPR Art. 6(1)(a) – consent. | Until consent is withdrawn. Withdrawal does not affect the lawfulness of processing prior to withdrawal. |
| Creating advertising audiences based on browsing activity using Meta Pixel | Data generated by the Meta Pixel during a user’s logged activity on the website: IP address, time of use, browser, viewed content, and actions such as add-to-cart and purchase. Meta identifies advertising audiences in aggregated form. | GDPR Art. 6(1)(a) – consent. | Until consent is withdrawn. Withdrawal does not affect the lawfulness of processing prior to withdrawal. |
If your personal data is required to fulfill a legal obligation or to enter into/perform a contract, and you refuse to provide such data, the Data Controller may not be able to execute the contract or provide the requested service.
3. Data Recipients
A) Meta Pixel
Meta Pixel is a piece of code that enables conversion tracking, audience creation, and provides the website owner with detailed analytics on website usage. With the Meta remarketing Pixel code, it is possible to display personalized offers and advertisements to users on Facebook and Instagram. This data is not used to personally identify users.
The Meta Pixel service is provided by Meta Platforms Ireland Limited (registered office: Block J, Serpentine Avenue, Dublin 4, Ireland; hereinafter: “Meta Ireland”). With respect to the processing of personal data through the Meta Pixel, Mind Well Ltd. and Meta Ireland act as joint controllers, and their respective rights and obligations are defined in the Joint Controller Addendum (“Controller Addendum”).
More information about Meta Pixel and how Meta Ireland processes personal data can be found at the following links:
B) Data Processors
We work with external partners who help us maintain and operate the website and provide services to users. These companies perform, for example, customer support, product delivery, technical system maintenance, and email distribution on our behalf. They act as data processors and, in certain cases, may have access to personal data solely for the purpose of providing their services. Processors are not permitted to use your personal data for their own purposes.
C) Disclosure of Data to Other Controllers
In certain cases, we may share your personal data with other controllers who use it on their own behalf and for their own purposes. Such situations may include compliance with legal obligations (e.g., providing data to the police, courts, or other competent authorities), or other legal bases such as legitimate interest or your explicit consent.
4. Data Transfers Outside the EEA
When we transfer your personal data outside the European Economic Area (EEA), we ensure a similar level of protection by applying at least one of the following safeguards:
- we may transfer personal data to countries that the European Commission has determined provide an adequate level of personal data protection;
- by concluding appropriate data transfer agreements based on Standard Contractual Clauses under Article 46(5) of the GDPR or other suitable mechanisms ensuring that all recipients outside the EEA apply an adequate level of personal data protection, as well as technical and organizational measures to prevent accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, and other forms of unlawful processing.
The Rocket Science Group LLC (operating as MailChimp) is listed on the 'Data Privacy Framework List' (https://www.privacyshield.gov/EU-US-Framework), established under the EU-U.S. Data Privacy Framework. This means it provides an adequate level of data protection, and pursuant to Article 45(1) GDPR, personal data may be transferred to this organization.
If you would like more information about the specific mechanisms we use when transferring your personal data outside the EEA, please contact us using the details provided.
5. Data Subject Rights
| Right | What does it mean? |
|---|---|
| Right of Access | You have the right to access your personal data, including the right to be informed about whether we process your data, what data we process, and for what purpose. |
| Right to Rectification | You have the right to request the correction of your personal data if it is inaccurate or incomplete, ensuring that the information we hold about you is up to date and accurate. |
| Right to Erasure (Right to Be Forgotten) | In certain cases, you have the right to request the deletion of your personal data. This includes situations where the data has been processed unlawfully or is no longer necessary for the purpose for which it was collected. In some cases, we may refuse deletion if there are legal obligations requiring data retention. |
| Right to Restrict Processing | You can request that we restrict the processing of your data, for example if you contest the accuracy of the data, if the processing is unlawful but you do not want it deleted, or if the data is needed for the establishment, exercise, or defense of legal claims. |
| Right to Data Portability | If processing is based on your consent or a contract, you have the right to request the transfer of your personal data that you have provided to us in a structured, commonly used, and machine-readable format, as well as their transfer to another data controller. |
| Right to Object | If your personal data is processed on the basis of legitimate interest, you have the right to object to such processing at any time. In that case, we will stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or if the data is necessary for the establishment or defense of legal claims. |
| Right to Withdraw Consent | You have the right to withdraw your consent at any time if the processing is based on consent. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. You can withdraw your consent through the following channels:
|
| Right to Lodge a Complaint with a Supervisory Authority | If you believe that the processing of your personal data violates the General Data Protection Regulation (GDPR), you have the right to lodge a complaint with a data protection supervisory authority in the EU member state of your residence, workplace, or place of the alleged violation. Supervisory Authority in the Republic of Croatia: Croatian Personal Data Protection Agency (AZOP) Address: Selska cesta 136, 10000 Zagreb Phone: +385 1 4609 000 Email: azop@azop.hr Website: www.azop.hr |
Log Data
Like many website administrators, we collect data that your browser automatically sends each time you visit our website. These records (so-called Log Data) may include information such as your computer’s IP address, browser type and version, the pages you visit on our site, the date and time of your visit, time spent on individual pages, and other related statistics.
Cookies
This website uses cookies to track browsing preferences and enhance functionality. If you allow the use of cookies, a file is saved on your device to help analyze website traffic or notify you when you visit a particular page.
Cookies are small text files that may contain an anonymous unique identifier. They enable web applications to respond to you as an individual and tailor their behavior to your needs, preferences, and interests by collecting and remembering certain information.
Like many other websites, we use cookies to better understand how our site is used and to improve our content and service offerings. You can set your browser to refuse all cookies or to notify you when a cookie is being sent. Please note that in this case, some website functionalities may not be available or may not work properly.