1. The data controller for the processing activities described in this Policy is:

Morphologic s.r.o., reg. ID no. 05724821reg.
address at Slezská 1487/70, CZ-130 00 Prague 3, the Czech Republic
email: legal@treapl.com

2. We may collect and process the following categories of personal data:

    1. Identification and Contact Information: e.g., name, email address, phone number, billing/shipping address;
    2. Account Information: login credentials (hashed), user settings;
    3. Transaction Data: purchase history, digital product licenses, and payment confirmations;
    4. Technical Data: IP address, device identifiers, browser type, session data, and cookies;
    5. Communication Data: customer service inquiries, messages sent through forms;
    6. Marketing Preferences: newsletter subscriptions and related opt-ins.

3. We may use the following tools to collect and/or process personal data:

    1. Webflow – used as the frontend platform. If forms are used (e.g. contact or waitlist), Webflow may temporarily         store submitted data such as names, emails, and messages.
‍
    2. Outseta – handles user authentication, account creation, and automated email communication. Stores personal         data such as name, email, IP address, and login history. Relies of essential cookies for login functionality (essential         cookies; not consent-based).
‍
    3. Xano – acts as the backend logic and database. It stores usage data (e.g., number of downloads) and may         associate it with user IDs or email addresses.
‍
    4. Bunny.net – delivers downloadable digital products via tokenized links. While it doesn’t set cookies, it may log IP         addresses and download activity for performance and security monitoring. 
‍
    5. Google Analytics – used to analyze website traffic and behavior. May collect IP addresses and browser activity.         Requires explicit user consent, handled via a CookieScript banner. 
‍
    6. Facebook Pixel – used for ad retargeting and marketing analytics. Tracks crosssession and cross-device behavior.         Also requires prior consent before activation. Uses cookies only based on consent (non-essential); requires         explicit        user consent, handled via a CookieScript banner
‍
    7. Foxy.io – powers the shopping cart, checkout, and transactional emails. Collects and processes personal and         billing data including names, emails, product selections, and order history; uses essential cookies. 
‍
    8. Make (Integromat) – used for backend automation (e.g. email workflows, logging downloads). While it doesn’t         interact with the browser, it may process user data server-side as part of these workflows.
‍
   9. CookieScript – a cookie management tool that displays a consent banner to users blocks Google Analytics and         Facebook Pixel by default until consent is explicitly given, loads only essential cookies by default (such as those         used by Foxy and Outseta), and allows you to manage and update your cookie preferences at any time.
‍
   10. Other, similar tools.

4. We do not knowingly collect special categories of personal data (e.g., health, religion, political beliefs).

5. We retain personal data only as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law.

    1. Transactional data: retained for 10 years;
    2. Account and profile data: retained until deleted by the user or following prolonged inactivity;
    3. Marketing data: until consent is withdrawn;
    4. Cookies: see individual cookie lifespans below.

6. Cookies are small data files stored on your device when you visit a website. They help us understand usage patterns, deliver functionality, and personalize your experience.

7. Types of Cookies We Use:

    1. Strictly Necessary Cookies - These cookies are essential for the proper functioning of the Site. They enable core         features such as security, network management, and accessibility.

    2. Performance and Analytics Cookies - These cookies allow us to analyze how users interact with the Site (e.g.,         Google Analytics, Facebook Pixel). Data collected is aggregated and anonymous unless otherwise specified.

    3. Functionality Cookies - These cookies store user preferences and settings to enhance functionality and         personalization.

    4. Marketing Cookies - Subject to your consent, these cookies may track browsing habits to display targeted         advertising via third parties.

8. Upon your first visit to the Site, a cookie banner will inform you about our use of cookies and request your consent for non-essential cookies. You may:

    1. Accept all cookies;
    2. Reject all non-essential cookies;
    3. Customize your preferences.

9. You can change your consent or delete cookies at any time by adjusting the settings in your browser or using our cookie preference tool (see here: [... insert link to CookieScript managemnet tool, when installed ... ]).

10. Please note that disabling certain cookies may affect the availability and functionality of the Site.

11. We may share your personal data with:

    1. Service providers: including payment processors, hosting platforms, IT and analytics vendors;

    2. Legal authorities: where required for compliance or law enforcement;

    3. Third parties: where necessary for digital asset licensing or protection of our rights.

12. Where data is transferred outside the EU and/or the EEA, we rely on standard contractual clauses or other legally valid transfer mechanisms.

13. We use industry-standard technical and organizational measures to secure your personal data from unauthorized access, alteration, disclosure, or destruction. These include data encryption, secure server infrastructure, access controls, and regular audits.

14. You have the following rights under the GDPR:

    1. Access – Obtain a copy of your personal data;

    2. Rectification – Correct incomplete or inaccurate data;

    3. Erasure – Request deletion of your data in certain circumstances;

    4. Restriction – Limit how we process your data;

    5. Portability – Receive your data in a structured, machine-readable format;

    6. Objection – Object to data processing based on legitimate interests;

    7. Withdrawal of consent – Withdraw previously granted consent at any time.

15. To exercise these rights, contact us via email at legal@treapl.com.

16. If you believe that our processing of your personal data violates applicable data protection laws, you have the right to file a complaint with the relevant Czech supervisory authority:-

‍Úřad pro ochranu osobních údajů

‍Pplk. Sochora 27170 00 Praha 7

Czech Republic

+420 234 665 111

posta@uoou.cz

https://www.uoou.cz

17. We reserve the right to modify or amend this Policy at any time. The latest version will always be available on the Site, with the effective date clearly stated. Continued use of the Site following changes indicates acceptance of the updated Policy.

18. This Privacy and Cookies Policy is subject to Czech law; any dispute arising therefrom shall be decided by the competent court or authority in the Czech Republic.

Version 1.0, as of 2025-07-09