Privacy Policy

Effective date: 4 September 2026. Version 1.0.

1. Who is responsible for personal data

CARDENCER, 15 rue Pierre Laurent, 13006 Marseille, France, acts as controller for website visitors, prospects, merchant representatives, account administration and its own security or compliance activities. For transaction data processed on documented customer instructions, Cardencer may act as processor.

2. Data we process

• Identity and contact data, including names, business contact details and authorized representatives.
• Company, onboarding and compliance data, including registration information and beneficial-owner information when required.
• Account and authentication data, including password hashes, roles, API-key metadata and security events.
• Transaction and payment metadata, such as amount, currency, status, merchant references, card scheme and masked payment identifiers. Cardencer does not intentionally store full card security codes.
• Technical and usage data, including IP address, device, browser, logs, events and fraud signals.
• Support communications and records necessary to handle requests and disputes.

3. Purposes and legal bases

• Provide, secure and support the services: performance of a contract and legitimate interests.
• Onboard customers and perform compliance checks: contract, legitimate interests and applicable legal obligations.
• Prevent fraud, abuse and security incidents: legitimate interests and legal obligations.
• Manage billing, accounting, claims and evidence: contract and legal obligations.
• Send requested communications and, where permitted, relevant business information: consent or legitimate interests with opt-out rights.

4. Recipients

Data may be shared on a need-to-know basis with authorized Cardencer personnel, the merchant concerned, card and payment networks, identity or fraud providers, hosting and support providers, professional advisers and competent authorities. Each recipient acts under its own legal role and obligations.

5. International transfers

Cardencer favors processing in the European Economic Area. Where data is transferred outside it, Cardencer uses an applicable adequacy decision, standard contractual clauses or another lawful safeguard, together with supplementary measures where appropriate.

6. Retention

Data is retained only as long as necessary for the relevant purpose, the contractual relationship, security and fraud prevention, and applicable limitation, accounting or regulatory periods. Retention may be extended for an active claim or legal hold, after which data is deleted or anonymized.

7. Security

Cardencer applies access controls, encryption in transit, logging, monitoring, backups, vulnerability management and incident procedures appropriate to the risks. No system is completely secure; customers must also protect their accounts and integrations.

8. Your rights

Depending on the processing, individuals may request access, rectification, erasure, restriction, portability or object, and may withdraw consent without affecting prior processing. Requests can be sent to privacy@cardencer.eu. Identity verification may be required. Individuals may also complain to the CNIL or their competent supervisory authority.

9. Cookies and changes

See the Cookie Policy for browser storage. Cardencer may update this policy and will publish the new effective date. Material changes will be communicated where required.