Last updated: 27 October 2025

1. Who We Are

This website (www.powmysterybox.com) is operated by EOWYN LTD, a company registered in the Republic of Cyprus under registration number HE 351440, with VAT number CY10351440Z, and registered office in Nicosia, Cyprus.

For all privacy-related questions, please contact us at:
📧 info@powtheshop.com

2. What Personal Data We Collect

When you use POW! Mystery Box, we may collect and process the following data:

• Your full name
• Your email address
• Your unique Mystery Box code
• Technical information such as IP address, browser type, and device information (for security and analytics purposes)

3. How We Use Your Data

We use your personal data for the following purposes:

1. To verify and process your Mystery Box code and show whether it contains a bonus prize.
2. To contact you if your box qualifies for a prize or if we need to verify your entry.
3. To send you marketing communications (only if you have given your explicit consent).
4. To improve our website experience, analyze traffic, and ensure security.

4. Legal Basis for Processing

We process your data under the following legal bases:

• Performance of a contract: to process your Mystery Box code and display your result.
• Consent: for sending marketing communications and newsletters.
• Legitimate interest: to maintain the security and functionality of the website.

You can withdraw your consent at any time by clicking “unsubscribe” in any marketing email or contacting us directly.

5. Data Retention

We retain your personal data only for as long as necessary:

• Code submissions and verification data: up to 24 months after campaign completion.
• Marketing contacts: until you unsubscribe or withdraw your consent.

After this period, your data will be securely deleted or anonymized.

6. Data Sharing

We do not sell or rent your data.

Your data may be shared only with trusted service providers, such as:

• Email and CRM platforms (for newsletters and campaign communications)
• Web hosting and analytics providers (for site operation and improvement)

All third-party partners are GDPR-compliant and act only under our instructions.

7. International Transfers

If your data is transferred outside the European Economic Area (EEA), we ensure adequate protection using Standard Contractual Clauses (SCCs) or equivalent safeguards approved under GDPR.

8. Your Rights

Under the EU General Data Protection Regulation (GDPR), you have the right to:

• Access your data and obtain a copy
• Request correction or deletion
• Withdraw your consent at any time
• Restrict or object to processing
• Request data portability
• File a complaint with the Office of the Commissioner for Personal Data Protection (Cyprus)

To exercise these rights, contact us at info@powtheshop.com.

9. Cookies

We use cookies to improve your experience and analyze website usage.
Essential cookies are necessary for site functionality; analytics and marketing cookies require your consent.
For more details, see our Cookie Policy.

10. Data Security

We use appropriate technical and organizational measures to protect your data, including:

• SSL encryption for all form submissions
• Secure server hosting within the EU
• Limited access to authorized personnel only

11. Children’s Privacy

This website is not intended for individuals under the age of 16.
If you believe a minor has provided us personal data, please contact us to remove it.

12. Changes to This Policy

We may update this Privacy Policy from time to time.
All updates will be posted here with the revised “Last updated” date.

13. Contact Information

If you have questions or requests about how we handle your data, please contact:
EOWYN LTD
Reg. No. HE 351440
VAT No. CY10351440Z
Registered Office: Nicosia, Cyprus
📧 info@powtheshop.com
🌐 www.pow.shop