Privacy policy

Template text: the owner must complete and have it checked before launch. Items in [brackets] are placeholders.

Controller

[Business name, address, email], see imprint.

What we process and why

• Orders: name, shipping address, email and order contents, to fulfil the contract (Art. 6(1)(b) GDPR). Invoices are kept for the statutory retention period [10 years].
• Account (optional): email, password hash, saved addresses. You can export or delete your data in your account at any time.
• Payments are handled by [payment provider]; we never see or store card numbers.
• Problem reports: when you report a wrong card, offer or item, we keep what you send (description, photos with location data removed, and your email if you give one) to correct our catalogue and listings and to answer you (legitimate interest, Art. 6(1)(f); for order problems, the contract). A hash of your IP address is kept for 30 days against abuse. Email and photos are removed 12 months after the report is resolved, unless it led to a refund (accounting retention).
• Usage statistics: we count searches, page views of cards and cart events on our own servers, without cookies and without sharing with third parties, to improve the shop (legitimate interest, Art. 6(1)(f)).

Cookies

We only use cookies that are strictly necessary: your cart, your login session, your language choice (set only when you switch the language) and the admin session. No advertising or tracking cookies are set, so no consent banner is needed. [Re-check if third-party tools are added.]

Hosting

Data is stored in the EU at [hosting provider, region].

Your rights

Access, rectification, erasure, restriction, portability and objection, and the right to complain to a supervisory authority. Contact [email].