Informativa sulla privacy

1. Who is responsible for your data

The controller of the personal data collected on cartoonandcardoon.com is BCXDE LTD, a Private limited company registered in England and Wales under company number 16897014, registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

For any question about this policy or about your data, write to contact@cartoonandcardoon.com.

We process personal data in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003.

2. What we collect, why, and on what legal basis

Data	Purpose	Legal basis	Retention
Name, delivery and billing address, email, telephone	Taking, preparing, dispatching and following up your order; invoicing	Performance of the contract (Art. 6(1)(b))	Duration of the contract, then 6 years for accounting records
Order history, amounts, payment status	Order management, after-sales service, returns and refunds	Performance of the contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c))	6 years from the end of the accounting period
Payment card details	Taking payment	Performance of the contract (Art. 6(1)(b))	Not stored by us: handled by our payment provider
Email address given to our newsletter	Sending commercial messages about our products	Your consent (Art. 6(1)(a)), withdrawable at any time	Until you unsubscribe, and at most 3 years after your last activity
Messages sent through the contact form or by email	Answering your request	Our legitimate interest in replying to you (Art. 6(1)(f))	3 years from our last exchange
Server logs: IP address, browser, date and time of connection	Keeping the site running and secure, detecting and preventing fraud and abuse	Our legitimate interest in the security of the service (Art. 6(1)(f))	12 months
Connection data, pages viewed, cookie identifiers	Running the site, security, audience measurement	Legitimate interest for what is strictly necessary; your consent for the rest	13 months maximum for cookie identifiers

Fields marked as required in a form are needed to process your request. Without them we cannot take or deliver an order.

We never store your full payment card number: it is captured and processed by our payment provider over an encrypted connection and never reaches our systems.

We do not carry out automated decision-making producing legal effects concerning you, and we do not profile you in that sense.

3. Who receives your data

Your data is accessible to the people within BCXDE LTD who need it, and is shared with the service providers who act on our instructions:

Shopify — hosting of the online store and order management;
our payment providers — taking and securing payments;
our carriers — delivering your parcel and providing tracking;
our email provider — sending order and service emails.

These providers act as processors, on documented instructions, and may not use your data for their own purposes. We do not sell, rent or otherwise pass your personal data to commercial third parties. We disclose it to a public authority only where the law requires us to, and only to the extent required.

4. Transfers outside the United Kingdom

Some of our providers process data outside the United Kingdom, in particular in Canada, in the United States and within the European Union. Those transfers are covered either by UK adequacy regulations, or by the International Data Transfer Agreement, or by the UK Addendum to the European Commission's standard contractual clauses. You may ask us for a copy of the safeguards in place.

5. Your rights

Under the UK GDPR you have the right to:

be informed about how your data is used, and to access it;
have inaccurate data rectified;
have data erased, where one of the grounds in Article 17 applies;
restrict processing, or object to it, in particular to direct marketing, which you may refuse at any time and without giving a reason;
receive your data in a portable format;
withdraw your consent at any time, without affecting processing carried out before;
give directions about what happens to your data after your death.

To exercise a right, write to contact@cartoonandcardoon.com. We reply within one month, extendable by two months for a complex request, and we will tell you if we extend. We may ask for proof of identity where there is real doubt about who is asking.

6. Complaining to the regulator

If you consider that your rights are not respected, you may complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF — ico.org.uk/make-a-complaint, telephone 0303 123 1113.

7. Children

This site is not intended for children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us their data, write to contact@cartoonandcardoon.com and we will delete it.

8. Data protection officer

BCXDE LTD is not required to appoint a data protection officer: it does not carry out large-scale monitoring or process special category data on a large scale. Questions about data protection go to contact@cartoonandcardoon.com, which reaches the person responsible, Anthony PETIDENT.

9. Security

The site is served over HTTPS. Access to order data is restricted to the people who need it. Payment data travels encrypted to our payment provider and is never stored on our systems.