Who is responsible
The controller for the processing of personal data on the Wickerz website and in connection with Wickerz services is BT2 Technology Solutions LTD, Kosta Anaxagora 30, 2014 Nicosia, Cyprus. You can reach us about anything concerning your data at [email protected]. Full company details are in our legal notice.
Summary
- We collect only what we need to sell, deliver and support our services, and to meet our legal obligations.
- Our product and information pages set no cookies. We use no analytics and no advertising trackers.
- Your card number and security code never reach our servers: they are encrypted in your browser. We do not store your card.
- We do not sell personal data and we do not share it for advertising.
Visiting the website
When you open a page, your browser sends technical information such as your IP address, the date and time, the page requested, the referring page and your browser type. We use it to deliver the website, to keep it secure and to detect abuse. The legal basis is our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR). Server logs are deleted after a short period unless they are needed to investigate a security incident.
The website may be delivered through Cloudflare, which protects it against attacks and speeds it up. Cloudflare processes connection data, including your IP address and the country it belongs to, for this purpose on our behalf.
Cookies
Our product and information pages set no cookies. If you switch the currency, your choice (USD or EUR) is stored in a small cookie so the prices stay in that currency; it contains nothing else.
Pages with a form, such as checkout, the contact form and your customer area, set a session cookie and a security token cookie. They are strictly necessary for the form or the sign-in to work and expire after a short time, or when you sign out. If you choose “keep me signed in”, a cookie keeps you signed in on that device.
If the contact form shows a Google reCAPTCHA check to protect us from spam, Google may set cookies and process your IP address and browser data as described in Google’s privacy policy. The legal basis is our legitimate interest in keeping the form free of automated abuse (Art. 6(1)(f) GDPR).
Orders and your account
When you order, we process your name, email address, billing address, country, phone number (optional), the order details and the notes you give us, your IP address, browser and the country derived from your IP address. We need this to conclude and perform the contract with you (Art. 6(1)(b) GDPR), to issue receipts and invoices, and to determine the VAT that applies (Art. 6(1)(c) GDPR). Your billing country, the country of your IP address and the country your card was issued in are kept as evidence of your location, which tax law requires for electronically supplied services.
Your customer account is created with your first order. In it we store your details, your services, their access details (encrypted), your payments and the history of each order.
Card payments
The card form on our checkout and renewal pages is provided by our payment security provider, which encrypts your card number and security code in your browser before they are sent. Our servers only ever handle the encrypted values.
Before a card is charged, your bank confirms the payment with 3-D Secure. For this, our payment security provider passes the card details, the amount and our merchant details to the card network and your bank; we receive only the result. The card details are then decrypted in transit to our payment service provider, a regulated card payment processor, which processes the payment. The payment service provider and the card schemes process your data also as controllers in their own right, under their own privacy policies. On request we tell you which providers processed your payment.
Every payment is a single charge that you start yourself; we do not store your card for later charges. We keep only the card brand, the last four digits and the country the card was issued in, for your receipts, to answer your questions and to determine the VAT that applies. The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR) and our legitimate interest in preventing fraud (Art. 6(1)(f) GDPR).
Emails we send
We email you what you need for your services: order confirmations, the link to set your password, access details being ready, renewal reminders, receipts and important notices. These emails are part of the service and are sent on the basis of our contract with you. We do not send newsletters or advertising.
Contacting us
When you write to us through the contact form or by email, we process your name, email address, your message, the order number you give us, and the IP address and browser the form was sent from, to answer your request (Art. 6(1)(b) or (f) GDPR). Messages are stored in our support system and forwarded by email to the responsible team.
Data on your services
We do not look at the content you store on your servers and webspace, except where you ask us to, where it is necessary to fix a fault or to investigate a credible abuse report, or where we are legally obliged to. For personal data you process on our services, you are the controller and we act as your processor; on request we conclude a data processing agreement with you.
Service providers
We work with carefully selected service providers who process data on our behalf, bound by our instructions and by contracts that protect your data:
- Our payment security provider: encryption of card data and 3-D Secure authentication.
- Our payment service provider: processing of card payments and refunds.
- Our email service provider: delivery of the emails described above.
- Cloudflare: delivery and protection of the website, where used.
- Google: reCAPTCHA on the contact form, where shown.
We also pass data to authorities where we are legally obliged to, and to our tax advisers and auditors as far as necessary.
Transfers outside the EU
Some of the providers above are based outside the European Economic Area or may process data there, for example in the United States. Where this happens, the transfer is based on an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework) or on the European Commission’s standard contractual clauses.
How long we keep data
We keep your account and order data for as long as you have services with us, and afterwards for as long as tax and commercial law require us to keep records of transactions, usually up to ten years for invoices, receipts and payment records. Contact-form messages are kept for up to three years after your request has been dealt with. Server logs are kept for a few weeks. Data we no longer need is deleted.
Your rights (GDPR)
You have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, and to object to processing based on our legitimate interests. Where processing is based on your consent, you may withdraw it at any time with effect for the future. To exercise these rights, email [email protected]. We may ask you to confirm your identity before we answer.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work.
California residents
If you live in California, you have the right under the California Consumer Privacy Act to know which categories and pieces of personal information we collect, use and disclose, to have it deleted or corrected, and not to be discriminated against for exercising these rights. We do not sell or share personal information as these terms are defined by that Act. To make a request, email us at the address above.
Children
Our services are not intended for anyone under 18, and we do not knowingly collect their personal data. If you believe a child has given us personal data, please contact us and we will delete it.
Security
The website is only available over encrypted connections. Access details of your services are stored encrypted. Access to customer data is limited to the people in our team who need it for their work. No system is perfectly secure, so please protect your own devices and keep your password to yourself.
Data breaches
If a breach of security leads to your personal data being disclosed, altered or lost, we inform the competent authority as required by law and, where there is a high risk to your rights, inform you by email without undue delay.
Changes to this policy
We update this policy when our services or the law change. The current version is always on this page, with the date of the last update at the top. If a change affects how we use data you have already given us, we inform you by email.
How to reach us
Questions, requests or complaints about your data: [email protected] or the contact form. We answer within one month at the latest, as data protection law requires.