Privacy Policy

Cardique — a sole proprietorship (eenmanszaak) registered in the Netherlands — is the controller of the personal data described in this policy. Our details are: Keizerskroon 27, 2631 VX Nootdorp, Netherlands · Chamber of Commerce (KvK) 42105508 · VAT NL005497333B90.

For any privacy question, or to exercise your rights, email contact@cardiqueofficial.com.

• Order and contact details — your name, email address, phone number, and shipping and billing address.
• Personalization content — the text and details you enter to be engraved on your card.
• Payment information — processed securely by Stripe. We never see or store your full card number (see “Payments”).
• Configurator usage — when you use the card configurator we record anonymous usage events (which finish you view and how far you get), and, if you enter them, the design details you type — your name, job title, company, and website. We do not store the contact fields (email, phone) you enter in the configurator unless you place an order.
• Technical data — basic information your browser sends, such as your IP address and device type, and a session identifier that remembers your configuration while you shop.

• To perform our contract with you — producing, personalizing, and shipping your order, and providing support. (Legal basis: performance of a contract.)
• To meet legal obligations — for example, keeping invoices for tax and accounting purposes. (Legal basis: legal obligation.)
• To protect against fraud and keep the site secure. (Legal basis: legitimate interests.)
• To understand and improve how the configurator is used — including the design details entered while configuring (not contact details) — so we can see what people create and make the product better. (Legal basis: legitimate interests.)
• To send you marketing only if you have asked us to. (Legal basis: consent, which you can withdraw at any time.)

Payments are handled by Stripe. Your card details are sent directly to Stripe over an encrypted connection and never touch our servers. Stripe processes this data as an independent controller under its own privacy policy.

We do not sell your data. We share it only with the service providers that help us run the shop, and only as far as needed:

• Stripe — payment processing.
• Supabase — secure database hosting for your order and customer record.
• Vercel — website hosting.
• Shipping partners — to deliver your order.

Some of these providers may process data outside the European Economic Area. Where they do, the transfer is covered by appropriate safeguards, such as the European Commission’s Standard Contractual Clauses.

We keep order and invoice data for as long as the law requires — currently seven years for financial administration under Dutch tax law. Data we no longer need is deleted or made anonymous.

Under the GDPR you can ask us to: access the data we hold about you; correct it; delete it; restrict or object to how we use it; or receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. To exercise any of these, email contact@cardiqueofficial.com.

You also have the right to complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

We use only the cookies and local storage needed for the site to work — for example, to remember your card configuration during checkout — and cookies that Stripe sets to process payments and prevent fraud. We do not use advertising cookies.

We protect your data with encryption in transit, access controls, and trusted processors. No method of transmission is completely secure, but we take reasonable measures to keep your information safe.

We may update this policy from time to time. The “last updated” date above shows when it last changed; significant changes will be highlighted on this page.

Questions about your privacy? Email contact@cardiqueofficial.com.