Privacy policy
Draft. This page has not yet been reviewed by a lawyer and the company details are still being completed. It describes how ecardz is intended to work and may change before launch.
We collect as little personal data as we need to sell and deliver your codes, keep our shop safe from fraud and meet our legal duties. We do not sell your data.
1. Who is responsible
The controller of your personal data is [company name] OÜ, registry code [registry code], [registered address, Estonia]. For any privacy question or request, email [privacy email].
2. What we collect and why
| Data | Why we use it | Legal basis (GDPR) |
|---|---|---|
| Email address | To deliver your codes, send your receipt and handle support | Performance of a contract (Art. 6(1)(b)) |
| Order details (products, amounts, time, payment status) | To process your order, refunds and our accounting | Contract; legal obligation for accounting records (Art. 6(1)(c)) |
| IP address, device and browser information, country | To prevent fraud and to defend against payment disputes | Our legitimate interest in preventing fraud (Art. 6(1)(f)) |
| Delivery records (email sent, order page opened) | To prove delivery if there is a dispute | Legitimate interest (Art. 6(1)(f)) |
| Cart contents (in a cookie) | To remember your cart | Necessary to provide the service |
| Marketing emails, only if you tick the box | To send offers and news | Consent (Art. 6(1)(a)), which you can withdraw at any time |
We do not receive or store your full card number. Payment details are handled by our payment provider, [payment provider]. We do not ask for your date of birth or identity documents in normal purchases. For a small number of high-risk orders we may ask for additional verification, which is explained to you at that time.
3. Automated fraud checks
Orders are checked automatically for signs of fraud, for example unusual amounts or mismatched countries. An order may be paused for manual review or limited. If an order is cancelled because of these checks, you are refunded in full and you can contact us to have the decision reviewed by a person.
4. Who we share data with
We share only what each service provider needs to do its job, under data-processing agreements:
- our payment provider ([payment provider]), to process payments;
- the issuers of the codes and our authorised suppliers, where needed to obtain and deliver the codes you order;
- our email provider, to send order emails;
- our hosting and database providers, to run the website;
- our accountant, for bookkeeping;
- authorities, where the law requires it.
Some providers may process data outside the European Economic Area. Where they do, we rely on safeguards such as the European Commission’s standard contractual clauses or an adequacy decision.
5. How long we keep data
- Order and accounting records: 7 years, as required by Estonian accounting law.
- Fraud-prevention and dispute evidence: up to 18 months after the order, the period in which payment disputes can be raised.
- Cart cookie: 30 days.
- Marketing consent: until you unsubscribe.
6. Your rights
You have the right to access your data, correct it, have it deleted, restrict or object to its use, receive it in a portable format, and withdraw consent at any time. To use these rights, email [privacy email]. We reply within one month. Note that we must keep order and accounting records for the legal period even if you ask for deletion; we will delete everything else.
You can also complain to a data protection authority: in Estonia the Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee), or the authority in the country where you live (in Poland, UODO).
7. Children
Our shop is intended for adults. If you are under 18, please ask a parent or guardian to buy for you.
8. Cookies
We only use cookies that are necessary for the shop to work. See our cookie policy.
9. Security
We protect your data with encryption in transit, restricted access and regular review of our systems. Gift card codes are shown only to the buyer.
10. Changes
We may update this policy. The current version is always available on this page.