Data protection at Goldens Cards
The plain-language version: how we protect your data, how you stay in control, and what we do if something goes wrong.
Privacy by design & default
Optional features are off until you switch them on. We collect the minimum, keep it for the shortest time, and delete it automatically (Art. 25).
You are in control
Download, correct or delete your data yourself, in seconds — online, from your account, or over the phone with your Support ID and PIN.
Security first
TLS everywhere, scrypt password hashing, two-factor authentication, encrypted secrets, lockouts, strict security headers and audit logging (Art. 32).
Your rights at a glance
| I want to… | Where | How fast |
|---|---|---|
| Get a copy of my data | Account · Privacy Center · phone | Instant |
| Take my data elsewhere | Privacy Center (JSON file) | Instant |
| Delete everything | Account · Privacy Center · phone + e-mail confirmation | Instant after confirmation |
| Correct my data | Account (instant) or request | Within one month |
| Stop the newsletter | Unsubscribe link · account · Privacy Center | Instant |
| Restrict or object to processing | Privacy Center | Within one month |
How we verify it’s really you
- Online: a single-use link sent to your e-mail address (valid 48 hours). The link opens a confirmation page — e-mail scanners cannot trigger actions by accident.
- Account: you are already logged in; we ask for your password (and 2FA code) again before exports and deletion.
- Phone: your 8-digit Support ID and 6-digit phone PIN. Results go only to your registered e-mail, and deletions also need e-mail confirmation.
If something goes wrong
If a personal data breach occurs, we contain it, assess the risk, and — where required — notify the Estonian Data Protection Inspectorate within 72 hours (Art. 33) and inform affected people without undue delay when there is a high risk to them (Art. 34). Every breach is documented internally.
Accountability
We keep a record of processing activities (Art. 30), sign data processing agreements with our service providers (Art. 28), log administrative access to personal data, and review these measures regularly.