Privacy Policy | Viblyshufflespt MossPod

1. Identity of the Data Controller

The entity legally responsible for personal information collected via the website viblyshufflespt.cyou is Viblyshufflespt Biophilic Systems Ltd. (Company No. 14982041), having its registered office at 74 Willowbrook Court, Green Botanica Quarter, London EC1R 4PN, United Kingdom. Throughout this policy, "we", "our", or "us" designates Viblyshufflespt Biophilic Systems Ltd. Our appointed Data Protection Officer (DPO) can be contacted directly at [email protected].

2. Categories of Data Collected

Depending on your interaction with the MossPod web ecosystem, we process several categories of information:

Directly Provided Identity & Contact Data: Includes your full legal name, delivery address, billing postal code, direct contact telephone number, and email address submitted during hardware reservation or contact form transmissions.
Technical Telemetry & Interaction Data: Includes Internet Protocol (IP) address (anonymized at subnet level), browser user-agent tokens, operating system characteristics, referral HTTP headers, time zone parameters, and interactions with our interactive WebGL desktop pod canvas.
Commercial Transaction Records: Order identification tokens, chosen hardware configuration editions (Studio Classic, Pro Atmosphere, Master Duo), shipping confirmation statuses, and customer service communication records. Please note that raw payment card details (PAN and CVV numbers) are processed exclusively by PCI-DSS Level 1 certified processors; we never store or inspect full credit card numbers on our servers.

3. Lawful Bases for Data Processing (GDPR Article 6)

We operate under strict lawful grounds when handling user data:

Data Purpose	Categories of Data	Lawful Basis under GDPR
Fulfilling MossPod hardware pre-orders & shipping	Identity, Shipping Address, Email, Phone	Contractual Necessity (Art. 6(1)(b))
Technical diagnostics of 3D WebGL pod simulator	Browser Telemetry, Screen Resolution, IP	Legitimate Interests (Art. 6(1)(f))
Optional product newsletter & cultivation alerts	Email Address, Subscribed Flora Profiles	Freely Given Consent (Art. 6(1)(a))
Statutory tax accounting & VAT audit filings	Invoices, Transaction Reference Tokens	Legal Obligation (Art. 6(1)(c))

4. Third-Party Sub-Processors

We do not sell, rent, or lease consumer personal records to marketing data brokers. We share minimal necessary information only with vetted third-party infrastructure providers under signed Data Processing Addendums (DPAs):

Cloud Infrastructure & Hosting: Distributed edge nodes deployed to ensure sub-50ms latency across global geographic regions with AES-256 encrypted data-at-rest.
Logistics & Courier Networks: International freight forwarders and local courier services (e.g. Royal Mail, DPD, DHL Express) receiving only delivery names, physical addresses, and tracking dispatch emails.
Analytics Infrastructure: Privacy-focused anonymized measurement pipelines that discard the last octet of user IP addresses prior to analytics aggregation.

5. Your Rights Under GDPR, UK DPA & California CCPA

Residents of the European Economic Area, United Kingdom, and California hold comprehensive statutory rights regarding their records:

Right of Access & Portability: You may request a machine-readable copy (JSON or CSV format) of all personal data held about your account.
Right to Rectification: You may correct inaccurate or incomplete delivery or contact details at any time.
Right to Erasure ("Right to be Forgotten"): You may request complete purging of your personal records, subject only to statutory tax retention rules.
Right to Restrict or Object: You can challenge processing conducted under legitimate interest grounds or revoke marketing consent instantly.
California "Do Not Sell My Info": We certify that Viblyshufflespt Biophilic Systems Ltd. does not sell personal information as defined by the California Consumer Privacy Act (CCPA).

To exercise any of these protections, submit a signed request to [email protected]. We verify your identity and reply without undue delay within 30 calendar days.

6. Data Retention Protocols & Security Measures