Privacy Policy

The last update of this Privacy Policy is: 01 May 2025.

This Privacy Policy outlines our practices and procedures regarding the collection, use, and disclosure of your information when you use our service on Picnobi Website (hereinafter – the “Service”), located at picnobi.com (hereinafter – the “Website”) or it explains how the Website collects and utilizes the personal data provided by you for the purpose of accessing our Services. Additionally, it details the options you have regarding the use of your personal information and how you can manage, update, or delete this information.

We utilize your personal data to provide the Service. By using the service, you agree to the collection and use of information in accordance with this Privacy Policy.

The processing of personal data, including but not limited to name, address, email address, telephone number, or billing information, always adheres to the General Data Protection Regulation (GDPR) and relevant country-specific data protection laws. Through this Privacy Policy, we aim to inform the public about the nature, extent, and purpose of the personal data we collect, use, and process. Furthermore, this Privacy Policy serves to educate data subjects (users) about their rights concerning their personal data.

Personal Data Collection and Use

The use of the Website is possible without any indication of personal data; however, if a user wants to use Services via our Website, collecting and processing of personal data could become necessary. If the processing of personal data is necessary, we generally obtain consent from the user as a data subject, except cases when personal data processing is available under other grounds (legitimate interests, contract executing, etc.).

The purpose of our processing your personal data and collection of information about you are as follows (the “Purpose”):

1. Your intention to use Services;
2. To provide the user with Services;
3. For the performance of a contract to which the user is a party, in accordance with Article 6.1.b of the GDPR and the collected data are necessary in order for us to identify and bill the user and to charge its bank card number;
4. Analyze your use of our Website and Services to better understand how they are being used so we can improve our Services and the user experience and engage and retain users.

We may use your personal data to:

1. Improve your browsing experience by personalizing the Website and to improve the Services;
2. Send you communications relating to your use of the Services;
3. Provide our partners with statistical information about our users by secured channels under data processing agreements (DPA);
4. Send you marketing and promotional materials and messages.

Scope and Categories of Personal Data, Lawful Basis for Personal Data Processing and Data Subject Categories

We aim to ensure compliance with GDPR regulations and have integrated principles of minimizing data usage.

The storage of this data takes place against the background that this is the only way to prevent the misuse of Services, and, if necessary, to make it possible to investigate committed offenses. The personal data are not transferred to third parties, except events, when it’s necessary with an aim to provide Services and/or there is a lawful obligation to transfer these data under request of government authorities and/or the transferring is executed in respect of criminal proceedings.
The personal data is stored separately in our database to avoid data subject identification by using depersonalization features in compliance with GDPR storage limitation principle.
We do not authorize the use of your personal data by any third party (only under exceptional conditions as described under "Legal Matters" below). We operate and maintain a variety of online security measures to safeguard and keep your personal information private and secured.

Payment Information. We may offer paid products and/or services through the Service. In such instances, we might utilize third-party services for payment processing, such as payment processors. Your payment card details will not be stored or collected by us. Instead, this information will be provided directly to our third-party payment processors, whose handling of your personal information is governed by their Privacy Policy. These payment processors adhere to the standards outlined by PCI-DSS. If you choose to pay for a product and/or service via bank transfer using our Service, we may request information from you to facilitate the transaction and verify your identity.

Data that we collect automatically. We also collect and store information that is generated automatically as you navigate through our Website to enhance your experience on our Website by using tracking technologies such as Cookies, Log Files and Pixel tags. As you navigate our Website(s) information that we automatically collect is information in "log files" about your device’s connection to the Internet, length of time spent on the Website, and the pages accessed during each visit to the Website. We use this information to analyze trends, administer the Website, track user movement on the Website, and gather broad statistical information for aggregate use.

Our Website uses Cookies. Cookies are text files that are stored in a computer system via an Internet browser. Cookies are small files that your web browser places on your hard drive for record-keeping purposes. By showing how and when visitors use the Website, Cookies help us track user trends and patterns. They also prevent you from having to re-enter your preferences on certain areas of the Website where you have entered preference information before.

Cookies contain a so-called cookie ID. A cookie ID is a unique identifier of the cookie. It consists of a character string through which Internet pages and servers can be assigned to the specific Internet browser in which the cookie was stored. This allows visited Internet sites and servers to differentiate the individual browser of the data subject from other Internet browsers that contain other cookies. A specific Internet browser can be recognized and identified using the unique cookie ID.

Through the use of Cookies, we can provide users of this Website with more user-friendly services that would not be possible without the cookie setting. By means of a cookie, the information and offers on our website can be optimized with the user in mind.

The data subject may, at any time, prevent the setting of Cookies through our Website by means of a corresponding setting of the Internet browser used, and may thus permanently deny the setting of Cookies. Furthermore, already set Cookies may be deleted at any time via an Internet browser or other software programs. This is possible in all popular Internet browsers. If the data subject deactivates the setting of Cookies in the Internet browser used, not all functions of our website may be entirely usable.

If you do not wish to receive Cookies you may be able to refuse them by adjusting your browser settings to reject Cookies. If you do so, we may be unable to offer you some of our functionalities, services or support. If you have previously visited our Website, you may also have to delete any existing cookies from your browser.

Legal Matters

We consider your use of Services to be private. However, we may disclose your personal information in order to:

• comply with the law or legal process served on us;
• enforce and investigate potential violations of this Privacy Policy, Terms of Use; including use of this Service to participate in, or facilitate activities that violate the law;
• investigate potential fraudulent activities;
• or protect the rights, property, or safety of the Picnobi, its employees, its customers or the public.

In case there might be a risk of unauthorized disclosure of personal data the controller communicates the personal data breach to the data subject without undue delay.

WHERE DATA SUBJECT’S PERSONAL DATA ARE STORED

Usually, Personal data, which are provided by users are stored on the servers in Germany and Netherlands. Personal data, which are provided by users may be stored outside the EU. In some cases, these personal data and information may be stored in Canada. We adopted all necessary security measures for protection of your Personal Data according to the best practices of security, protection and confidentiality. If we transfer your Personal data to third party service providers, we will compel each third-party service provider to adopt necessary security measures for protection of your Personal Data according to our data protection agreement.

Your Rights as a Data Subject

1. Right of Confirmation:
   Data subjects have the right to request confirmation from the controller, as defined by European legislation, regarding the processing of their personal data. If such a request is made, and the data subject wishes to have their personal data erased, they may contact us at any time, as instructed at the end of this Privacy Policy. We will promptly comply with any erasure requests.
2. Right of Access:
   Data subjects are entitled, under European legislation, to obtain free information from the controller about their personal data stored at any time, along with a copy of this information. This includes details such as the purposes of processing, categories of personal data, recipients, storage period, rights to rectification, erasure, and restriction of processing, right to lodge complaints, source of data, and details of any automated decision-making. Data subjects also have the right to know if their personal data is transferred to a third country or international organization, and if so, to be informed of the appropriate safeguards.
3. Right to Rectification:
   Data subjects have the right, under European legislation, to request the prompt rectification of any inaccurate personal data held by the controller. This includes the right to have incomplete personal data completed, with supplementary statements provided if necessary.
4. Right to Erasure (Right to be Forgotten):
   Data subjects have the right, under European legislation, to request the erasure of their personal data without undue delay, provided certain conditions are met. If such conditions apply and a data subject wishes to request erasure, they may contact us at any time, as instructed at the end of this Privacy Policy.
5. Right of Restriction of Processing:
   Data subjects have the right, as defined by European legislation, to request restriction of processing in certain circumstances. If such circumstances apply, data subjects may contact us at any time, as instructed at the end of this Privacy Policy.
6. Right to Data Portability:
   Data subjects have the right, under European legislation, to receive their personal data in a structured, commonly used, and machine-readable format from the controller. They also have the right to transmit this data to another controller, where technically feasible and without hindrance.
7. Right to Object:
   Data subjects have the right, as granted by European legislation, to object to the processing of their personal data under certain conditions. If such conditions apply, data subjects may contact us at any time, as instructed at the end of this Privacy Policy.
8. Automated Individual Decision-Making, Including Profiling:
   Data subjects have the right, under European legislation, not to be subject to decisions based solely on automated processing, including profiling, where such decisions have legal or significant effects on them. If data subjects wish to request erasure of personal data stored by us under these circumstances, they may contact us at any time, as instructed at the end of this Privacy Policy.
9. Right to Withdraw Data Protection Consent:
   Data subjects have the right, as granted by European legislation, to withdraw consent to the processing of their personal data at any time. If such a request is made, data subjects may contact us at any time, as instructed at the end of this Privacy Policy.

Children's Privacy

Provision of Services generally not aimed at children. This Website is not intended for use by children under the age of adulthood in user’s country.We are acting in compliance with COPPA. We do not knowingly collect information from children and minors. Our Website and Service is not directed to, nor do we knowingly collect personal data from children under the age of 13. If we obtain actual knowledge that we have collected personal data from a child, we will comply with industry guidelines and applicable laws and will promptly delete it, unless we are legally obligated to retain such data.

Data Storage and Removal

The criteria used to determine the period of storage of personal data is the respective statutory retention period. After expiration of that period and when we no longer need personal data, we routinely and securely delete or destroy it, as long as it is no longer necessary for the purposes. As the data controller, we shall process and store the personal data of the data subject only for the period necessary to achieve the purpose of Services provision, or as far as this is granted by the European legislator or other legislators in laws or regulations to which the controller is subject to.
However, in case of conflict situations in progress we may store personal data for 180 days period or more if the processing is necessary for the establishment, exercise or defense of legal claims and for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject in case of an expired account or in case data subject requested to delete his personal data.
If you wish to remove your personal data, send an email to [email protected]. Your Account will be permanently removed within 30 days or earlier from our active systems, servers and back-ups. By deleting your Account all your personal data excluding the billing information for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject.
To opt out of further e-mail communications from us, just click on the opt out button in the e-mail, or contact us as instructed at the end of this Privacy Policy. We may need up to 30 (thirty) calendar days to assure compliance with your request.
To change your personal data that you have provided to us, please contact us as instructed at the end of this Privacy Policy.

Miscellaneous

We may modify this Privacy Policy at any time and post any changes to the Privacy Policy on the Website, so please review it frequently. We indicate the date of the current version of this Privacy Policy, so you know when it was last updated.
Changes to this Privacy Policy may not affect your personal data we have previously collected from you or after such changes.
If you object to the changes, please contact us as provided below.
This Privacy Policy is governed by and construed with the laws of Republic of Cyprus including Regulation 2016/679 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR”), effective as of 25 May 2018.
If you have any questions or propositions, please, get in touch with us by the email [email protected].