We ask for personal information only when we need it.

Controllers and contact

Olivier Schildgen, 11 rue Belair, L-4713 Pétange, Luxembourg, controls the website intake and can be reached at hello@cardbuyer.eu. Once an offer identifies its legal buyer, that named buyer becomes an independent controller for the purchase workflow. The offer provides the buyer's identity and address before you agree.

When you request an offer

We collect your email address, preferred email language, and card list so we can review the cards and send your offer. We do not ask for your address or payment details at this stage.

Imported CSV files are read in your browser and are not retained. If you save a draft, its card selections are stored behind a private, unguessable link and deleted after 31 days of inactivity. Collection enquiries may include your message, contact details and up to eight photographs; these are kept in protected storage and deleted 31 days after closure or inactivity.

If you send a bulk request, we collect your email address, email language, your card counts per language, your answer on the share of energy cards and, if you add them, a note and up to three photographs. We use them to answer your request and prepare a price, as steps taken at your request before a contract (Article 6(1)(b) GDPR). A bulk request and its photographs are kept in protected storage like other enquiries and deleted 31 days after closure or inactivity.

After you accept

We collect your name, address, acceptance record, and only the payment details needed for your chosen method. We also keep the offer, inspection, purchase record, and payment history needed to complete and document the purchase.

Purposes and legal bases

We process offer requests, communications and the purchase workflow to take steps at your request and perform the sale contract (Article 6(1)(b) GDPR). We keep invoices, purchase records and payment evidence to meet legal obligations (Article 6(1)(c)). Security logs, fraud prevention, service improvement and cookieless audience measurement rely on our legitimate interests in operating a safe and useful service (Article 6(1)(f)). Providing the data marked as required is contractually necessary; without it we cannot prepare the requested offer or complete an accepted purchase.

Recipients and processors

Hetzner hosts the service and its data. A contracted SMTP/email provider delivers transactional messages. DHL receives the shipping details required to create and track a label. PayPal receives payout information only when you choose PayPal. Umami Software, Inc. processes anonymous website usage data on our behalf as a processor (see “Anonymous audience measurement”). Access is otherwise limited to the identified buyer and people who need it to operate the service.

International transfers

PayPal may process personal data outside the European Economic Area. According to PayPal's privacy disclosure, it uses applicable safeguards such as adequacy decisions, approved standard contractual clauses or other legally recognized transfer mechanisms. Choose bank transfer if you do not want PayPal used for your payout.

Our audience measurement provider, Umami Software, Inc., is based in the United States, and data may be processed there. These transfers are safeguarded by the EU Standard Contractual Clauses (Article 46(2)(c) GDPR) under our data processing agreement with Umami.

Private order links

Your order link is created for that order and checked whenever you respond. After you submit your personal and payment details, the link does not display them again. Our internal market research and reference prices are not shown through it.

Anonymous audience measurement

We use Umami Cloud, provided by Umami Software, Inc., 1362 42nd Ave., San Francisco, CA 94122, USA, to understand page views and use of the offer journey. Umami acts as our processor under Article 28 GDPR. The measurement uses no cookies, no cross-site tracking and no identifiers in your browser's local storage. When a page loads, your browser fetches the measurement script from cloud.umami.is and sends data to gateway.umami.is, so Umami's servers receive your IP address and user agent as part of that connection. The IP address is processed transiently to derive an anonymous session identifier and approximate location and is not stored as such. Umami's servers are located in the USA and the EU, and Umami uses sub-processors, including companies based in the USA.

The script sends the public path without query parameters, the page title and, with events, the referring page, screen size and browser language; from the connection Umami derives browser, operating system, device type and approximate location (country and region). Our events contain a fixed event name, the site language, device class, a controlled source label and, where relevant, the number of card lines, the import format (CSV or plain text) or the enquiry type. For key steps of the offer process (for example when an offer is opened or a payment is completed) our server also sends an event containing only the language, device class, source label, the number of card lines and an aggregated reference value. We do not send email addresses, names, order references, private offer links, or payment details to Umami. Anonymous analytics data is deleted after 6 months.

You can prevent the measurement by blocking scripts from cloud.umami.is, for example with a content blocker, or by objecting as described under “Your rights and complaints”.

Server logs and retention

Security and server logs contain technical request data such as timestamp, path, status, IP address and user agent and are retained only as long as needed for security and fault diagnosis. Completed purchase records remain for the statutory retention period that applies to the buyer. For abandoned orders and outcomes where no purchase completes, personal information is removed 31 days after the order ends; only an anonymized operational record remains. Anonymous Umami data is deleted after 6 months.

Your rights and complaints

Subject to the legal conditions, you may request access, rectification, erasure, restriction, portability, or object to processing under Articles 15–21 GDPR. You may object at any time to processing based on our legitimate interests (Article 21 GDPR), including audience measurement. You may also complain to Luxembourg's Commission nationale pour la protection des données (CNPD), 15 Boulevard du Jazz, L-4370 Belvaux, Luxembourg, cnpd.public.lu. Email hello@cardbuyer.eu to exercise a right; include the short order reference where relevant but never send payment details by email.