Privacy Policy

1. Introduction

ERD Solutions Ireland ("we", "us", or "our") operates Cardx.Digital. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our Service.

We are committed to protecting your privacy and ensuring you have a positive experience on our platform. We act as the Data Controller for the personal data we process.

2. Legal Basis for Processing (GDPR)

Under GDPR, we process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to provide our services to you
• Consent: You have given explicit consent for specific processing activities
• Legitimate Interests: Processing necessary for our legitimate business interests
• Legal Obligation: Processing required to comply with legal requirements

3. Information We Collect

3.1 Information You Provide

• Account Information: Name, email address, password
• Business Card Content: Contact details, business information, photos, social media links
• Payment Information: Billing address, payment card details (processed securely by our payment processors)
• Communications: Messages, support tickets, feedback you send to us
• Profile Information: Optional information you add to your profile

3.2 Information Collected Automatically

• Usage Data: Pages viewed, features used, time spent on platform
• Device Information: IP address, browser type, operating system, device type
• Analytics Data: Card views, clicks, geographic data (country/city level)
• Cookies: See Section 10 for detailed cookie information

3.3 Information from Third Parties

• Payment processors (Stripe, PayPal)
• Authentication services
• Analytics providers

4. How We Use Your Information

We use your personal data for the following purposes:

4.1 Service Provision

• Create and maintain your account
• Host and display your digital business cards
• Process payments and manage subscriptions
• Provide customer support
• Send service-related notifications

4.2 Service Improvement

• Analyze usage patterns to improve features
• Monitor and analyze trends
• Detect and prevent fraud or abuse
• Ensure platform security and stability

4.3 Communication

• Send important service updates
• Respond to inquiries and support requests
• Send marketing communications (with your consent)
• Notify you of new features or changes

4.4 Legal Compliance

• Comply with legal obligations
• Enforce our Terms of Service
• Protect our rights and property
• Prevent illegal activities

5. Data Sharing and Disclosure

5.1 We Share Your Data With:

• Service Providers: Cloud hosting, payment processing, analytics (all GDPR-compliant)
• Business Transfers: In case of merger, acquisition, or asset sale
• Legal Requirements: When required by law or to protect rights and safety
• Public Display: Information on your digital business cards is publicly visible by design

5.2 We DO NOT:

• Sell your personal data to third parties
• Share your data for third-party marketing without consent
• Transfer data outside the EU/EEA without adequate safeguards

6. International Data Transfers

Your data is primarily stored and processed within the European Economic Area (EEA). If we transfer data outside the EEA, we ensure appropriate safeguards such as:

• EU-US Data Privacy Framework participation
• Standard Contractual Clauses (SCCs) approved by the EU Commission
• Adequacy decisions by the European Commission

7. Your GDPR Rights

Under GDPR, you have the following rights:

7.1 Right to Access

You can request a copy of all personal data we hold about you.

7.2 Right to Rectification

You can correct inaccurate or incomplete data through your account settings or by contacting us.

7.3 Right to Erasure ("Right to be Forgotten")

You can request deletion of your personal data, subject to legal retention requirements.

7.4 Right to Restrict Processing

You can request limitation on how we process your data in certain circumstances.

7.5 Right to Data Portability

You can receive your data in a structured, machine-readable format and transfer it to another service.

7.6 Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes.

7.7 Right to Withdraw Consent

Where processing is based on consent, you can withdraw it at any time.

7.8 Right to Lodge a Complaint

You can file a complaint with your local data protection authority (DPA) or the Irish Data Protection Commission.

To exercise your rights, contact us at: privacy@cardx.digital

8. Data Retention

We retain your personal data for as long as:

• Your account is active
• Needed to provide services to you
• Required by law (e.g., tax records for 7 years)
• Necessary to resolve disputes or enforce agreements

After account deletion, we retain data for 30 days for recovery purposes, then permanently delete it unless legally required to retain it longer.

9. Data Security

We implement industry-standard security measures:

• Encryption in transit (TLS/SSL) and at rest
• Regular security audits and penetration testing
• Access controls and authentication requirements
• Employee training on data protection
• Incident response and breach notification procedures

While we strive to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

10. Cookies and Tracking

10.1 Types of Cookies We Use

• Essential Cookies: Required for platform functionality (cannot be disabled)
• Analytics Cookies: Help us understand usage patterns (can be disabled)
• Preference Cookies: Remember your settings and preferences

10.2 Cookie Consent

You can manage cookie preferences in your browser settings. Blocking certain cookies may affect functionality.

11. Children's Privacy

Our Service is not intended for users under 16 years of age. We do not knowingly collect data from children. If we discover we have collected data from a child, we will delete it promptly.

12. Marketing Communications

We will only send you marketing emails if you have consented. You can opt out at any time by:

• Clicking the unsubscribe link in any email
• Updating your email preferences in account settings
• Contacting us at privacy@cardx.digital

Note: You cannot opt out of service-related emails (e.g., account notifications, security alerts).

13. Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours
• Notify affected users without undue delay
• Provide information about the breach and steps taken
• Offer guidance on protective measures you can take

14. Third-Party Services

Our Service integrates with third-party services:

• Payment Processors: Stripe, PayPal (PCI-DSS compliant)
• Analytics: Usage and performance tracking
• Cloud Hosting: Secure data storage and processing

These services have their own privacy policies. We recommend reviewing them. We are not responsible for their privacy practices.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Email notification to your registered address
• Prominent notice on our platform
• In-app notification

Changes become effective 30 days after notification. Continued use constitutes acceptance of the updated policy.

16. Contact Information

Data Controller:
ERD Solutions Ireland
Email: privacy@cardx.digital
Address: Ireland

Data Protection Officer:
Email: dpo@cardx.digital

EU Representative:
ERD Solutions Ireland
Email: eu-representative@cardx.digital

Supervisory Authority:
Irish Data Protection Commission
Website: www.dataprotection.ie
Email: info@dataprotection.ie

17. GDPR Compliance Statement

We are committed to full compliance with the General Data Protection Regulation (GDPR) and other applicable data protection laws. We have implemented appropriate technical and organizational measures to ensure and demonstrate compliance.

This Privacy Policy constitutes our commitment to transparency and accountability in data processing practices.