Privacy

Privacy Policy

This policy explains what data CardWave collects, why we collect it, how it is protected, and what choices customers have. It covers NFC cards, NTAG215 chips, digital profiles, checkout, delivery, account management, support, cookies, and security checks.

Last updated: June 26, 2026

1. What we collect

Account and contact data

Name, email address, account preferences, login method, support messages, and security settings such as additional verification preferences.

Order and delivery data

Products ordered, delivery address, courier choice, selected courier office or automat, order status, delivery preferences, invoices, and support history connected to the order.

Card and profile data

NFC card details, card labels, tap URLs, vCard/profile content, uploaded logos or images, links, social profiles, and card management information needed to keep your cards usable.

Payment data

CardWave stores order and payment status, but raw card numbers, CVC codes, and payment credentials should be handled by the selected payment provider, not by CardWave directly.

Technical and security data

IP address, browser/device information, server logs, captcha verification state, fraud-prevention signals, cookie choices, and error diagnostics needed to protect and operate the platform.

2. Why we use data

We use data to operate the website, process orders, produce customized products, manage NFC cards and profiles, provide support, prevent fraud and abuse, improve the product, comply with legal obligations, and maintain platform security.

3. Legal bases

Depending on the context, data may be processed to perform a contract, comply with legal duties, protect the platform, support legitimate business operations, or act on consent for optional cookies and marketing communications. Optional consent can be withdrawn without affecting the core order flow.

4. Cookies and consent

Essential cookies are required for checkout, cart, security, login sessions, and saving privacy choices. Optional analytics, personalization, and marketing cookies are used only after consent. The Cookie settings control lets you change or withdraw optional consent after your first choice. You can read the cookie categories in our Terms of Service.

5. Payment and courier partners

Payment providers process payment credentials on their own secure systems. Courier providers receive only the delivery information needed to ship or prepare pickup. Each provider may also process data under its own privacy terms.

6. Security measures

CardWave uses server-side validation, CSRF protection for server actions, hashed card management passwords where applicable, guest order tokens, human verification for checkout, and browser security headers including content-type, frame, referrer, permissions, transport, and content-security policies. No website can guarantee absolute security, but security is treated as a core platform requirement.

7. Retention

We keep data only as long as needed for order fulfilment, account access, card management, tax/accounting requirements, legal obligations, security monitoring, and customer support. When data is no longer needed, it should be deleted, anonymized, or archived securely.

8. Your privacy rights

Access a copy of personal data we hold about you.
Correct inaccurate account, order, or profile information.
Request deletion where we no longer need the data for legal, security, delivery, or accounting reasons.
Object to or restrict certain processing where applicable.
Withdraw or change optional cookie consent at any time with the Cookie settings control.
Request portability for data you provided, where technically feasible and legally required.
Complain to the relevant data protection authority if you believe your rights are not respected.

9. Children

CardWave is not intended for children. If we learn that a child provided personal data without appropriate permission, we will take reasonable steps to remove it.

10. International use

If CardWave is used outside Bulgaria or the European Union, data may be processed in locations where our hosting, payment, delivery, analytics, or support providers operate. We aim to use appropriate safeguards where required by law.

11. Contact

For privacy requests, contact privacy@cardwave.bg. For order support, use the support page.

Performance and privacy by design

We avoid unnecessary trackers and heavy scripts. Product images and front-end assets should stay optimized, cached, and bundled cleanly so the website remains fast without sacrificing privacy, accessibility, maintainability, or security.

Consented page views

With your analytics consent, we record public-page categories and a coarse device category using a random per-tab session ID. Sessions reset after 30 minutes of inactivity or at Sofia midnight. We exclude account, admin, login, checkout and builder routes and never send URLs, query strings, contact details, IP addresses or user-agent strings in these events. You can withdraw consent in Cookie settings; this stops future recording but cannot retract events already accepted. Raw events are retained for 90 days and daily totals for 12 months.