Privacy Policy Version 2026-11-02.2 · 2 November 2026 This notice explains how HYPERVERSE MEDIA LIMITED, trading as AFU PET GOODS, processes personal information in connection with this store. It describes the store's actual account, payment and support services. 1. Who is responsible HYPERVERSE MEDIA LIMITED (HE 497263) is the controller for the processing described here. Registered office: Polyviou Dimitrakopoulou 3, ANELLI COURT, 2nd floor, Flat/Office 201, 1090 Nicosia, Cyprus. For privacy requests contact privacy@afu-pet.store, or write to the registered office marked “Privacy request”. 2. Information and its sources The required checkout fields are needed to process your order and selected delivery method. Without necessary information we may be unable to provide that service. Optional fields are identified. Do not send card security codes, full card numbers, identity documents or unrelated sensitive information in ordinary support messages. - Information you provide: name, email, phone, delivery address, chosen goods and options, account details, withdrawal declarations, support messages and any evidence you choose to provide. - Account security: a salted password hash, verification status, hashed session and one-time token values, relevant timestamps, IP address, user agent and security-attempt records. We do not store your password in readable form. - Order and payment information: order identifiers, item quantities, EUR amounts, payment status, transaction reference and delivery or tracking information. Payment status comes from CentroBill; delivery updates may be entered from the carrier's records. - Technical information: requests and security logs produced when your browser connects to our hosting or external media providers. Browser storage is described separately in the Cookie Policy. - Contract records: accepted terms version, acceptance time, language choice, withdrawal reference, declaration and submission time, and the status of related confirmation emails. 3. Purposes and legal bases We do not use solely automated decisions with legal or similarly significant effects on you in the store application. A payment provider may independently perform fraud or payment screening under its own notice. - Contract and pre-contract steps: taking and fulfilling orders, providing accounts you request, arranging payment and delivery, responding to product or order enquiries, and handling returns. - Legal obligations: complying with consumer rights, recording statutory withdrawal notices, keeping required accounting and tax records, and responding to lawful requests from competent authorities. - Legitimate interests: protecting accounts and the store, preventing fraud and abuse, investigating service faults, and establishing, exercising or defending legal claims. We assess the necessity of this processing against your rights; you may object where applicable. - Consent, where required: any future optional marketing or non-essential tracking would require a separate valid choice. The current application does not enrol checkout or account users in marketing or run an advertising or analytics pixel. 4. Providers and other recipients We do not sell customer personal information. Providers' own privacy notices apply where they act independently. Access by our staff and service providers is limited to the purpose for which it is needed. - Fly.io hosts the application and its persistent database. Our application region is configured as Frankfurt, Germany; this does not mean that every provider support or security operation takes place only there. - CentroBill processes hosted card payments. We send the information necessary to create and reconcile a payment, including your name, email, phone, IP address, order reference, amount, currency and an order description. Card details entered on its hosted page are handled by that provider. - Resend handles transactional account, order and withdrawal emails, including the recipient address, message content and necessary verification or reset links. Resend also receives messages sent to our support and privacy addresses. Email delivery and routing services receive the information needed to deliver messages. - Delivery providers receive the address, recipient contact details and parcel information needed for the delivery we arrange. Professional advisers, authorities or other parties receive information only when necessary for their function or a legal requirement. - Some homepage and gallery images are delivered by the editmysite.com CDN. An optional video is loaded from Cloudflare Stream only when you choose to load it. Direct requests disclose connection information such as your IP address and browser request details to the provider. 5. International processing Some providers operate internationally, so information may be processed outside the European Economic Area. Hosting in Europe alone is not a guarantee against international transfers. Where a transfer subject to GDPR takes place, the applicable requirements must be met, for example through an applicable adequacy decision or appropriate contractual safeguards and any necessary supplementary measures. Contact our privacy address for information about the providers, destinations and safeguards relevant to your data. We do not claim that every provider or transfer is covered by the same mechanism. 6. How long information is kept We determine retention by the specific purpose, the life of the account or order, statutory accounting and tax duties, applicable claim periods, and any unresolved complaint or legal hold. Records needed for a legal obligation or claim may need to be retained after an account closes. We assess deletion or anonymisation when those needs end. A login session is valid for 30 days; verification links are valid for 24 hours and password-reset links for 30 minutes. Expiry prevents use of the credential; it is not a promise that all associated database or audit records are erased at that instant. Withdrawal and contract-confirmation records may be needed to evidence consumer rights and obligations. Cart and favourites remain in your browser until you remove them or clear that browser's site data. Tab-session storage normally ends with the browser tab session. The infrastructure is configured to retain volume snapshots for 14 days; a record may therefore remain in a protected backup until that backup expires. Contact us to discuss the retention basis for a particular record. 7. Your rights and how to request them Depending on the legal conditions, you may request access, correction, erasure, restriction or portability of your information, and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time without changing the lawfulness of earlier processing. Send requests to privacy@afu-pet.store or our postal address. We normally respond within one month. If a request is complex or numerous, the law permits an extension of up to two additional months; we will explain any extension within the initial month. We may ask for proportionate information to verify identity. Requests are normally free; lawful exceptions and reasons will be explained. You can complain directly to the Cyprus Commissioner for Personal Data Protection, or another competent supervisory authority, including in your habitual residence, workplace or the place of an alleged infringement. You do not have to contact us first. Cyprus data-protection complaint information: https://www.gov.cy/dataprotection/en/information-for-the-public/lodge-a-complaint/ 8. Security and children We use safeguards including HTTPS, access checks, hashed account credentials and restricted administrator access. No internet service can promise absolute security. Tell us promptly about suspected misuse without sending your password or a full payment-card number. The shop is intended for people able to make a valid purchase contract, and is not directed at children. If a child has supplied personal information without the necessary authority, contact us so that we can assess and address it. 9. Updates The date and version on this notice identify the current description. Material changes will be communicated where required. A change to this notice does not retrospectively turn an incompatible use of personal data into a permitted one. Browser storage and external media: https://afu-pet.store/cookie-policy Company information HYPERVERSE MEDIA LIMITED, Polyviou Dimitrakopoulou 3, ANELLI COURT, 2nd floor, Flat/Office 201, 1090 Nicosia, Cyprus Customer support: support@afu-pet.store Privacy: privacy@afu-pet.store Telephone: +44 7933884815 Company registration: HE 497263 Tax identification number (TIN): 60396850P