Fourth Era
    Sign InCart

    Privacy Policy

    1. Controller

    The party responsible for the processing of personal data within the meaning of the Datenschutz-Grundverordnung (DSGVO) is:

    Prancing Tiger Ltd. – Fourth Era
    Thivas 11, 8560 Pegeia, Cyprus
    Email: annette@prancingtigerhq.com
    Authorized representative: Annette Garcea

    2. Applicable Law

    The processing of personal data is governed by:

    • EU General Data Protection Regulation (DSGVO)
    • Cypriot Processing of Personal Data Law (L.125(I)/2018)
    • for users from Germany, additionally the Telekommunikation-Telemedien-Datenschutz-Gesetz (TTDSG) with regard to cookies and tracking

    3. Categories of Personal Data

    We process in particular the following data:

    • Master data: name, address, email, phone number, access credentials
    • Contract and order data: shopping carts, orders, delivery and billing addresses, payment status
    • Communication data: emails, support requests
    • Usage data: IP addresses, browser information, access times, log files
    • Marketing & newsletter data: newsletter consents, open and click rates
    • Affiliate data: clicks, orders, commission statements
    • Review data: review texts written by customers
    • AI data: text inputs or content that may be processed when using AI-supported systems
    • Social media data: profile data and interactions, insofar as you contact us via social networks

    4. Purposes of Processing

    We process personal data for the following purposes:

    • Processing and delivery of orders
    • Management of customer accounts
    • Payment and shipping processing
    • Sending of newsletters and marketing information (double opt-in)
    • Operation of the affiliate program and settlement of partner commissions
    • Web hosting, IT security, and operational stability
    • AI-supported processing of customer reviews (translation, sentiment analysis, compliance review)
    • Customer service and support
    • Operation of social media presences and community management
    • Fulfillment of statutory retention obligations

    We process order and customer data in order to process orders, handle withdrawals and returns, provide customer service, and document, in a traceable manner, the contractually intended assignment to a referring partner and the resulting commission claims. Insofar as the processing is necessary for the performance of the contract, it is carried out on the basis of Art. 6 Abs. 1 lit. b DSGVO. Insofar as the processing serves the prevention of abuse, commission control, dispute handling, or the long-term traceability of the partner assignment, it is carried out on the basis of our legitimate interest pursuant to Art. 6 Abs. 1 lit. f DSGVO.

    5. Legal Bases

    • Performance of contract (Art. 6 Abs. 1 lit. b DSGVO)
    • Legal obligation (Art. 6 Abs. 1 lit. c DSGVO)
    • Consent (Art. 6 Abs. 1 lit. a DSGVO; Art. 9 Abs. 2 lit. a DSGVO for special categories)
    • Legitimate interest (Art. 6 Abs. 1 lit. f DSGVO), e.g. IT security, marketing, optimization

    6. Services Used and Disclosure to Third Parties

    Hosting & Infrastructure

    • All-Inkl (Germany): hosting of our shop, processing of usage and master data within the EU.
    • Our own shop and affiliate system: storage and processing of order data, clicks, and commission statements.
    • Supabase: database and auth hosting; processing of customer master data, login/auth data, as well as order and commission data.
    • Railway: application hosting for our backend services; transmission of personal data processed through these services.
    • Cloudflare: CDN, DNS, and edge hosting; processing of access and traffic data (IP addresses).

    Email Delivery (Transactional, Lifecycle, and Newsletter Emails)

    • Resend (USA): sending of order, account, and newsletter emails via our own email service; email addresses and email content are processed. Transfer on the basis of Standard Contractual Clauses (SCCs).

    Payment Processing

    • Stripe: payment processing; payment data and billing address are processed.

    Fulfillment & Shipping

    • JTL: fulfillment and inventory management; name, delivery address, as well as order and warehouse data are processed.
    • ShipBob: fulfillment and shipping; name, delivery address, and order data are processed.

    AI-Supported Services

    • Anthropic (USA): AI-supported processing of customer reviews within our review system — translation, sentiment analysis, and compliance review of review texts. The review texts written by customers are processed. Data may be transferred to the USA; safeguarded through Standard Contractual Clauses (SCCs).

    Monitoring & Operational Stability

    • Sentry: error monitoring; technical error data is processed, error payloads may incidentally contain personal data.
    • Axiom: log aggregation; application logs are processed, log lines may incidentally contain personal data.
    • PagerDuty: internal incident alerting; alert metadata is processed, as a rule no customer data.

    Lovable

    We use Lovable for the technical development and optimization of web and application functions. In doing so, personal data (e.g. IP addresses, technical usage data, or content provided by the user) may be processed.

    A data processing agreement pursuant to Art. 28 DSGVO is in place.

    Social Media Presences

    We maintain presences on platforms such as Facebook, Instagram, LinkedIn, Pinterest, TikTok, YouTube, Snapchat, Discord, Telegram, or Signal.

    • When visiting our social media pages, the privacy policies of the respective providers apply.
    • No social media pixels or automatic plug-ins are currently used on our website.

    Other Providers

    We reserve the right to use further comparable services in the future (e.g. for analytics, advertising, communication, or AI). Should this be the case, this privacy policy will be updated accordingly.

    7. Third-Country Transfers

    Data may be transferred to third countries, in particular the USA.

    We safeguard such transfers through:

    • Standard Contractual Clauses (SCCs) of the EU Commission,
    • additional protective measures (e.g. encryption, pseudonymization),
    • or, where available, adequacy decisions of the EU Commission.

    8. Retention Period

    • Contract & invoice data: 10 years (statutory retention)
    • Customer account: until deletion or 10 years of inactivity
    • Newsletter data: until consent is withdrawn
    • Tracking & marketing data (newsletter): max. 24 months
    • Affiliate data: up to 10 years (tax-law retention)
    • Log files (hosting and operations): up to 12 months
    • AI data (e.g. text inputs, review texts): max. 24 months, then anonymization

    9. Cookies & Tracking

    We use cookies and similar technologies that are necessary for the operation of our shop (e.g. shopping cart, session).

    • Necessary cookies: enable core functions (login, shopping cart).
    • Storage of the selected language (i18nextLng) and the sidebar's expanded/collapsed state (sidebar:state), each for the current session only (sessionStorage), plus a flag (fe-explicit-lang-choice) noting that the language was deliberately chosen via the language switcher, also for the current session only.
    • Preferences & personalization (recently viewed products, fourth-era-recently-viewed): this feature is prepared in the code but is not currently switched on — no corresponding data is collected or stored at this time. Before it is activated, this notice will be updated with purpose, retention period, and withdrawal options, and your consent will be obtained via the consent management tool (Art. 6 Abs. 1 lit. a DSGVO, TTDSG).
    • No analytics or marketing cookies are currently active.
    • If further cookies or tracking technologies are used, we will obtain your consent via a consent management tool (Art. 6 Abs. 1 lit. a DSGVO, TTDSG).

    10. Newsletter

    • Sent only after double opt-in
    • Unsubscribe possible at any time via the unsubscribe link
    • Sent via our own email service with Resend (USA) as the delivery provider; transfer with SCCs
    • Tracking (open/click rates) only where consent has been given

    11. Rights of the Data Subject

    Under the DSGVO, you have the following rights:

    • Access (Art. 15 DSGVO)
    • Rectification (Art. 16 DSGVO)
    • Erasure (Art. 17 DSGVO)
    • Restriction (Art. 18 DSGVO)
    • Data portability (Art. 20 DSGVO)
    • Objection (Art. 21 DSGVO, in particular against direct marketing)
    • Withdrawal of consent (Art. 7 Abs. 3 DSGVO)
    • Right to lodge a complaint with the competent supervisory authority:

    Office of the Commissioner for Personal Data Protection
    1 Iasonos Str., 1082 Nicosia, Cyprus

    12. Security

    We employ technical and organizational measures to protect your data, including:

    • SSL/TLS encryption
    • Access restrictions and role-based permissions
    • Regular backups
    • Monitoring and intrusion detection
    • Procedures in the event of data breaches pursuant to Art. 33, 34 DSGVO

    13. Changes

    We reserve the right to amend this privacy policy if the legal situation or the services used change. The version published on our website at any given time shall apply.

    We use cookies and similar technologies to improve your experience. For more information, see our Privacy Policy.