Privacy Policy & GDPR Data Protection Notice

1. Data Controller Identity

2. Categories of Personal Data Processed & Legal Basis (Art. 6 GDPR)

• VIP Waitlist Data (Email Address & Product Preference): Processed based on your explicit consent (Art. 6(1)(a) GDPR) solely to notify you of Batch 01 availability and send your early-access invite code.
• Order, Delivery & Fiscal Invoicing Data (Name, Shipping Address, Email, Phone, Order Items): Processed for the performance of a distance sales contract (Art. 6(1)(b) GDPR) and compliance with Romanian accounting and fiscal retention laws (Art. 6(1)(c) GDPR).
• Payment Data: Processed directly by Stripe Payments Europe Ltd. via encrypted TLS connections. YESTOALL S.R.L. never stores raw payment card credentials.
• Biometric Wearable Telemetry (CYOK App): Processed locally on your device using on-device physiological baselines under your explicit consent (Art. 9(2)(a) GDPR). We never sell or monetize biometric or health data.

3. Your Rights Under GDPR (Articles 15–22)

• Right of Access (Art. 15 GDPR): Obtain confirmation and a copy of the personal data we hold about you.
• Right to Rectification (Art. 16 GDPR): Request correction of inaccurate or incomplete personal data.
• Right to Erasure / 'Right to be Forgotten' (Art. 17 GDPR): Request immediate deletion of your waitlist email or personal data where no statutory fiscal retention obligation applies.
• Right to Restriction of Processing (Art. 18 GDPR) & Right to Data Portability (Art. 20 GDPR).
• Right to Object & Withdraw Consent (Art. 7 & 21 GDPR): Withdraw your waitlist consent at any time with immediate effect.
• Right to Lodge a Complaint with the Supervisory Authority: In Romania, you may contact the National Supervisory Authority for Personal Data Processing (ANSPDCP — B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, Romania, https://www.dataprotection.ro).

4. Data Retention Periods