Privacy when buying cards

Controller

XARC Solutions SHPK, represented by its administrator Xhonatan Çopani, Rruga Ali Demi, Ndërtesa P.263, Hyrja 1, Ap. 1, 1000 Tiranë, Albania, NUIS M62025025R. Email: kontakt@trufy.de

Your order

When you order NFC review cards, we process the order and billing data you provide (name, company, address, email address, telephone number, a different delivery address if applicable, VAT ID) as well as the link to your Google profile that you provide. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

Payment

You can pay in advance by bank transfer or with Visa, Mastercard, American Express, Apple Pay, Google Pay and Klarna. With payment in advance, no payment data is passed to a payment service provider: you transfer the amount from your account to the account named in the invoice, and we match the payment ourselves. All other payment methods are handled by the payment service provider Stripe; for this the necessary data (name, email address, billing address, amount, order number) is transmitted to Stripe, and you enter your payment details only in Stripe’s payment window, not with us. If you choose Klarna, the information required for this is also passed to Klarna.

Shipping

For shipping, we pass your name and delivery address to the postal service that carries the parcel (as a rule Posta Shqiptare sh.a., Tirana, Albania, and for delivery in the country of destination the local postal service there), so that the parcel can be delivered and tracked. The cards are shipped from Albania.

Order emails and order status

We send the order confirmation, the invoice and shipping notifications to the email address you provide. To send these emails we use the service Resend (Resend, Inc., USA); your email address, your name and the content of the message are transmitted, and data may be transferred to the USA. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

You can check the status of your order via a link that we send you by email. This link contains a random string and is the only requirement for access; we do not create a user account for you. Please do not pass the link on to third parties.

Retention period

We keep billing data for ten years because of commercial and tax law obligations (Art. 6(1)(c) GDPR).

Processing in Albania (third country)

The controller is based in Albania, i.e. outside the European Union. Your data is therefore transferred to a third country with every order. Albania has a data protection law aligned with European requirements; there is currently no adequacy decision by the EU Commission under Art. 45 GDPR. The transfer is based on Art. 49(1)(b) GDPR because it is necessary for the performance of the contract concluded with you.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). Complaints can be addressed to the competent supervisory authority.

Questions about data protection: kontakt@trufy.de. What is processed when you visit the website (Cloudflare, Google Analytics only with your consent) and all further information can be found in the full privacy policy at trufy.de/datenschutz.