6. PRIVACY POLICY – DATA COLLECTION & STORAGE

1. Data Controller

CARDHΞ↓R is owned and operated by Kalani® Amsterdam, based in The Netherlands.
As a data controller under the General Data Protection Regulation (GDPR), we are responsible for the processing and protection of your personal data.

2. Data Collected

• Registration Data: Name, email, shipping address, and payment details.
• Purchase & Order Data: Items purchased, dates, shipping status, and invoice details.
• Support or Contact Data: Stored messages and contact information.
• Analytics: Anonymous data via Google Analytics; no personal tracking.
• Device Information: IP address and browser type for anti-fraud and security purposes.

3. Storage & Hosting

All servers are hosted within the EU by a GDPR-compliant provider. Data is securely stored and never transferred outside the EU.

4. Use of Personal Data

Data is used exclusively to:

• Process and ship orders
• Provide customer support
• Verify purchase identity
• Send transactional emails
• Comply with legal obligations
• Prevent abuse and fraud

5. Data Sharing

We do not sell or rent personal data. We only share with third parties necessary for services:

• Shipping partners
• Zoho Mail (email)
• Google Analytics (anonymous use only)

All providers adhere to GDPR regulations.

6. User Rights

Under GDPR, you have the right to:

• Access your data
• Request corrections or deletions
• Object to processing
• Withdraw consent
• Request data portability

To exercise your rights, contact: info@cardheir.com

7. Cookies

We use cookies for essential functionality and anonymous analytics. By using the site, you consent. You may disable cookies in your browser settings.

Necessary Cookies (all visitors):

• cfduid (Cloudflare)
• PHPSESSID (session identification)

Additional Cookies (for logged-in users):

• wp-auth, wordpress_logged_in_{hash}
• wordpress_test_cookie
• wp-settings-{UID}, wp-settings-time-{UID}

8. Data Retention

• Customer data is stored for up to 7 years (Dutch tax law).
• Newsletter and inactive user data is deleted when no longer needed.

9. Data Protection Officer

If you have concerns, email our Data Protection Officer: info@cardheir.com

10. Embedded Content

Our site may include embedded content (e.g., YouTube). These sites may collect data, cookies, or track interactions, just as if you visited them directly.

11. Who Has Access to Your Data

• If you’re not registered: no personal data is retained.
• If you are a registered client:
  • Our system administrators
  • Our support team (only when needed)

12. Third-Party Access to Your Data

We do not share your data to reveal personal info. We may share limited data with third-party services to deliver your services (e.g. email, hosting, analytics). All third parties are GDPR-compliant.

13. How Long We Retain Your Data

• Support messages/comments are stored until deletion request.
• Registered users can access, edit, or delete their data (except username).
• Admins can also edit that information.

14. Security Measures

We use SSL/HTTPS encryption for all communication. In case of breach, system integrity will be restored, affected users contacted, and passwords reset if needed.

15. Your Data Rights

• You can request exported data we hold about you.
• You can request deletion of your data (except what we need legally).

Under GDPR: We fully support your privacy rights and comply with EU standards.
For more info: https://gdpr.eu/

16. Third Party Websites

CARDHΞ↓R may include links to external websites. These are not covered by our privacy policy.
If you click a third-party link, your interaction is governed by their privacy terms.
We encourage users to review privacy policies before sharing personal data.

For more information and consent management:  Cookiebot Cookie Declaration

For more information and consent management of our website: CARDHEIR Cookie Declaration