Privacy Policy
Explains how we collect, process, store, share, and protect your personal information, affiliate data, cookies, and compliance with GDPR & CCPA.
1. Privacy Commitment & Scope
Cartoix respects your personal privacy. This Privacy Policy details how we collect, use, disclose, and safeguard your personal data when you visit our website, mobile apps, purchase products from third-party Suppliers, or participate in our Affiliate Program.
2. Information We Collect
We collect several types of data to provide marketplace services, fulfill orders, process payments, and track affiliate referrals.
2.1 Personal Identification Data
Includes full name, email address, phone number, shipping address, billing address, tax identification numbers (for high-volume affiliate payouts), and account authentication credentials.
2.2 Technical & Device Data
Includes IP address, browser type, operating system version, device identifiers, time zone settings, referring URLs, screen resolution, and mobile device hardware info.
2.3 Affiliate Tracking & Usage Data
Includes unique affiliate referral tokens, click timestamps, conversion parameters, referrer domain data, commission balances, payout records, and fraud detection flags.
2.4 Payment & Transaction Records
Payment card details are tokenized and processed securely by PCI-DSS compliant gateways (e.g. Stripe). We store transaction history, invoice numbers, purchase items, and fulfillment statuses.
3. Legal Basis & Purposes for Data Processing
We process personal data under legitimate legal grounds as prescribed under applicable laws (e.g., GDPR Article 6).
| Data Category | Processing Purpose | Legal Basis (GDPR / CCPA) |
|---|---|---|
| Account & Order Info | Facilitate transactions, order dispatch with Suppliers, customer support | Contract Performance |
| Payment Records | Process payments, prevent payment fraud, accounting compliance | Legal Obligation & Contract |
| Affiliate Referral Tokens | Attribute sales, calculate referral commissions, detect self-referral fraud | Legitimate Interests & Contract |
| Device & IP Logs | Platform security, bot defense, analytical performance | Legitimate Interests |
| Marketing Subscriptions | Deliver promotional updates, personalized product recommendations | Consent (Opt-in) |
4. Third-Party Data Sharing & Supplier Disclosures
We do not sell your personal information. However, to operate an e-commerce marketplace, we share data with trusted entities under strict confidentiality agreements:
- Independent Suppliers & Logistics Partners: When an order is placed, necessary buyer information (name, delivery address, contact phone, ordered items) is transmitted to the supplying vendor for packaging and shipping dispatch.
- Payment Processors & Gateways: Tokenized transaction details are shared to complete payments and manage refund reversals.
- Affiliate Analytics Partners: Referral parameters are processed to verify transaction validity and calculate affiliate earnings.
- Cloud Infrastructure & IT Service Providers: Data is securely hosted on cloud servers (AWS/GCP/Vercel) enforcing enterprise encryption.
- Legal Requirements: We may disclose data if required by court orders, government subpoenas, or law enforcement investigations.
5. Data Retention & Security Measures
We implement technical and organizational security measures to protect data against unauthorized access, loss, or alteration.
- Security Safeguards: End-to-end TLS 1.3 encryption, AES-256 data storage encryption, web application firewalls (WAF), and routine vulnerability scans.
- Retention Periods: Account data is retained while your account remains active. Transaction and invoice records are stored for 7 years to meet statutory tax obligations.
- Affiliate Logs: Affiliate click logs are purged after 180 days; referral commission ledger records are retained for financial audit compliance.
6. Your Privacy Rights (GDPR & CCPA)
Depending on your location, you hold statutory privacy rights regarding your personal information.
- Right to Access & Portability: Request a copy of your personal data in a structured, machine-readable format.
- Right to Rectification: Correct inaccurate or incomplete profile details.
- Right to Erasure (Account Deletion): Request permanent deletion of your account and personal data (subject to legal record retention requirements).
- Right to Restrict / Object: Object to direct marketing profiling or legitimate interest data processing.
- CCPA "Do Not Sell My Info": California residents can exercise opt-out rights for personalized advertising technologies.
7. Children's Privacy
Our Platform is not directed to children under 16 years of age. We do not knowingly collect or solicit personal data from minors. If we discover a minor has created an account, the profile and associated data will be deleted immediately.
8. International Data Transfers
Personal data may be transferred to and stored on servers located outside your home country. We utilize standard contractual clauses (SCCs) and GDPR-recognized adequacy frameworks to ensure cross-border data protection.
9. Data Protection Officer & Privacy Contacts
For questions regarding this policy or to submit a Privacy Rights Request:
- Data Protection Officer Email: dpo@Cartoix.com
- General Legal Office: legal@Cartoix.com
- Response SLA: We acknowledge requests within 48 hours and process privacy requests within statutory deadlines (30 days).