[{"data":1,"prerenderedAt":84},["ShallowReactive",2],{"legal:privacy":3},{"frontmatter":4,"html":23,"toc":24},{"id":5,"title":6,"shortTitle":6,"slug":5,"docType":7,"publicationClass":8,"status":9,"version":10,"effectiveDate":10,"lastReviewed":10,"owner":11,"reviewers":12,"relatedDocs":14,"publicationGate":15,"copySource":16,"disclaimer":17,"toc":18,"clauseNumbering":19,"noindex":19,"changelog":20},"privacy","Privacy Policy","policy",1,"published","2026-10-13","Legal",[13],"Tomas Moral Parra",[],[],null,"none",true,false,[21],{"version":10,"date":10,"summary":22},"Approved by the owner and published. VAT number added to the company details. Text otherwise as version 2026-09-25.","\u003Ch2 id=\"1-who-we-are-and-what-this-policy-covers\" tabindex=\"-1\" data-clause=\"1-who-we-are-and-what-this-policy-covers\">1. Who we are and what this policy covers\u003C\u002Fh2>\n\u003Cp>\u003Cstrong>Onbold Commerce Limited\u003C\u002Fstrong> is the controller responsible for the personal data described in this policy.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Cyprus company number:\u003C\u002Fstrong> HE497763\u003Cbr>\n\u003Cstrong>Cyprus VAT number:\u003C\u002Fstrong> CY60401989J\u003Cbr>\n\u003Cstrong>Registered office:\u003C\u002Fstrong> Prodromou 75, Oneworld Parkview House, 4th Floor, 2063 Nicosia, Cyprus\u003Cbr>\n\u003Cstrong>Privacy contact:\u003C\u002Fstrong> \u003Ca href=\"mailto:privacy@onbold.com\">privacy@onbold.com\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>This policy covers our websites, including \u003Cstrong>onbold.com, onbold.ai and onbold.io\u003C\u002Fstrong>, and other websites, applications, hosted product pages, checkouts and portals operated by Onbold Commerce Limited that link to this policy. It covers visitors, prospective and approved suppliers, business representatives, beneficial owners, buyers, delivery recipients, partners and people who contact us.\u003C\u002Fp>\n\u003Cp>Onbold operates a merchant-of-record commerce business. For purchases sold by Onbold, we act as the seller in our own name. Suppliers provide the products, services or fulfilment. We use personal data to assess suppliers, administer purchases and subscriptions, take payment, calculate and report taxes, manage delivery and returns, handle buyer rights and disputes, and pay amounts due to suppliers.\u003C\u002Fp>\n\u003Cp>The sections relevant to you depend on your interaction with us. A website visitor does not provide the same information as a supplier applicant or buyer. A product-specific notice may give additional information when a particular feature is used. This policy does not automatically cover websites operated by another group company or by an independent supplier.\u003C\u002Fp>\n\u003Cp>This is a privacy notice, not a request for consent. Using a website or accepting purchase terms does not constitute consent to optional marketing, advertising cookies or other processing for which separate consent is required.\u003C\u002Fp>\n\u003Ch2 id=\"2-personal-data-we-collect\" tabindex=\"-1\" data-clause=\"2-personal-data-we-collect\">2. Personal data we collect\u003C\u002Fh2>\n\u003Ch3 id=\"website-visitors-enquiries-and-partners\" tabindex=\"-1\" data-clause=\"website-visitors-enquiries-and-partners\">Website visitors, enquiries and partners\u003C\u002Fh3>\n\u003Cp>We collect contact details and information you provide through forms, messages, calls or other communications. Technical records can include IP address, approximate location inferred from it, browser and device information, pages visited, referral source, timestamps, security events and cookie choices. Where optional analytics or advertising tools are enabled, they may collect interaction and advertising identifiers under the choices described in section 9.\u003C\u002Fp>\n\u003Ch3 id=\"supplier-applicants-and-approved-suppliers\" tabindex=\"-1\" data-clause=\"supplier-applicants-and-approved-suppliers\">Supplier applicants and approved suppliers\u003C\u002Fh3>\n\u003Cp>We collect business identity, registration and address information; ownership and control information; names and contact details of directors, beneficial owners, representatives and other relevant people; identity and address evidence; bank-account verification; product, website and fulfilment information; trading and processing history; and application answers, documents and correspondence.\u003C\u002Fp>\n\u003Cp>Assessment records can include company-registry results, verification and screening outcomes, public-source evidence, risk indicators, scores, reviewer notes, decisions and their reasons. For approved suppliers, we also maintain agreement and product-schedule records, orders, settlement and reconciliation records, deferred consideration, reserves, refund and dispute adjustments, and information needed for ongoing monitoring.\u003C\u002Fp>\n\u003Cp>Business information is personal data where it relates to an individual, including a sole trader or named company officer. We request documents according to the checks relevant to the application; not every applicant is asked for every category.\u003C\u002Fp>\n\u003Ch3 id=\"buyers-and-delivery-recipients\" tabindex=\"-1\" data-clause=\"buyers-and-delivery-recipients\">Buyers and delivery recipients\u003C\u002Fh3>\n\u003Cp>We collect names, contact details, billing and delivery addresses, relevant location and tax information, VAT or business identification where applicable, product selections, order details, subscription instructions, invoices and receipts, and communications about the purchase.\u003C\u002Fp>\n\u003Cp>Payment records can include payment-method type, masked card details, tokens or payment references, authentication results, transaction status and risk indicators. Payment providers process the payment credentials required to complete or authenticate a transaction. Do not send full card details, card security codes or account passwords through support messages or free-text forms.\u003C\u002Fp>\n\u003Ch3 id=\"delivery-withdrawal-returns-and-disputes\" tabindex=\"-1\" data-clause=\"delivery-withdrawal-returns-and-disputes\">Delivery, withdrawal, returns and disputes\u003C\u002Fh3>\n\u003Cp>We receive shipment references, carrier and tracking events, dispatch and delivery dates, destination-matching information and, where relevant, proof of delivery. Returns and claims may involve return addresses, dispatch receipts, tracking references, photographs, correspondence and evidence about the product or shipment.\u003C\u002Fp>\n\u003Cp>We also retain the purchase terms and disclosures presented, consent or immediate-performance requests, timestamps, withdrawal declarations, selected items and quantities, cancellation instructions, refund attempts and outcomes, chargebacks and dispute evidence. These records help us administer your purchase, exercise or defend rights, and avoid duplicate or incorrect reimbursements.\u003C\u002Fp>\n\u003Cp>We use shipment information to check fulfilment and whether the related supplier payment meets release conditions. We do not use delivery tracking as a substitute for assessing your statutory rights. Supplier settlement timing does not determine whether you are entitled to a buyer refund.\u003C\u002Fp>\n\u003Ch3 id=\"sensitive-information\" tabindex=\"-1\" data-clause=\"sensitive-information\">Sensitive information\u003C\u002Fh3>\n\u003Cp>Please avoid sending information unrelated to your application or case, particularly health information, identity documents or information about other people unless requested and necessary.\u003C\u002Fp>\n\u003Cp>Identity verification or screening may involve sensitive information. If biometric identification or other special-category data is necessary, we require both a lawful basis and an applicable additional condition under Article 9 GDPR. We provide specific information and obtain explicit consent where that is the applicable condition. Criminal-conviction or offence data is processed only where permitted under Article 10 and applicable law. Legitimate interests alone is not sufficient for either category. Ordinary photographs and identity documents are not automatically biometric data used for unique identification.\u003C\u002Fp>\n\u003Ch2 id=\"3-where-information-comes-from\" tabindex=\"-1\" data-clause=\"3-where-information-comes-from\">3. Where information comes from\u003C\u002Fh2>\n\u003Cp>We receive information directly from you, from people authorised to act for you, and from suppliers, ecommerce integrations, fulfilment providers and carriers involved in a purchase. We also receive information from payment, banking, tax, identity-verification, company-registry, fraud-prevention and dispute-management providers, public authorities, and professional advisers where relevant.\u003C\u002Fp>\n\u003Cp>Supplier assessment can use public company registers, business websites, search results, domain information, sanctions and other authorised screening sources, and public reviews. This may incidentally capture names, photographs or contact details of website staff, reviewers or other individuals. We use that information in the business-verification context, not to market to those individuals or create unrelated personal profiles.\u003C\u002Fp>\n\u003Cp>If you provide another person's data, give them this policy and provide only information you are entitled to share. We remain responsible for our own transparency obligations. Where data is collected indirectly, we provide the required information within the applicable period, normally within one month or earlier when first contacting the person or disclosing the information. We rely on a notification exception only where its conditions are met; public availability alone is not an exception.\u003C\u002Fp>\n\u003Ch2 id=\"4-purposes-and-legal-bases\" tabindex=\"-1\" data-clause=\"4-purposes-and-legal-bases\">4. Purposes and legal bases\u003C\u002Fh2>\n\u003Cdiv class=\"table-scroll\" tabindex=\"0\" role=\"region\" aria-label=\"Table, scrollable\">\u003Ctable>\u003Cthead>\n\u003Ctr>\n\u003Cth>Purpose\u003C\u002Fth>\n\u003Cth>Legal basis and relevant interest\u003C\u002Fth>\n\u003C\u002Ftr>\n\u003C\u002Fthead>\n\u003Ctbody>\n\u003Ctr>\n\u003Ctd>Complete your purchase, provide access or arrange delivery, administer subscriptions and respond to contractual instructions\u003C\u002Ftd>\n\u003Ctd>Contract, where you are personally a party; legitimate interests in administering the transaction where we process a representative's or nominated recipient's data\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Take requested steps towards, or perform, an agreement with an individual supplier or sole trader\u003C\u002Ftd>\n\u003Ctd>Contract or requested pre-contractual steps\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Assess and monitor suppliers, verify representatives and ownership, investigate discrepancies and manage commercial\u002Facquiring risk\u003C\u002Ftd>\n\u003Ctd>Legitimate interests in selecting reliable suppliers, preventing misuse and operating a responsible commerce business; legal obligation where a specific law requires the processing\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Administer payment, authentication, settlement, delivery validation, reconciliation and supplier recovery\u003C\u002Ftd>\n\u003Ctd>Contract where applicable; legitimate interests in accurate payment and fulfilment administration and preventing loss; legal obligation where applicable\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Calculate and report taxes, maintain required accounting records and respond to binding authority requests\u003C\u002Ftd>\n\u003Ctd>Legal obligation; contract or legitimate interests for necessary supporting administration not itself legally required\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Handle withdrawal, returns, statutory remedies, refunds, subscription cancellation and complaints\u003C\u002Ftd>\n\u003Ctd>Contract and applicable legal obligations; legitimate interests for investigation, case administration and discretionary resolution\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Detect and investigate fraud, security incidents, transaction laundering, misuse and disputed transactions\u003C\u002Ftd>\n\u003Ctd>Legitimate interests in protecting buyers, suppliers, Onbold and payment partners; legal obligation where specifically applicable\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Establish, exercise or defend claims\u003C\u002Ftd>\n\u003Ctd>Legitimate interests in protecting and enforcing legal rights, with any additional condition required for sensitive data\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Operate accounts, support channels and business relationships; improve reliability and service quality\u003C\u002Ftd>\n\u003Ctd>Contract where applicable; otherwise legitimate interests in operating, securing and improving our services, using minimised or anonymised information where possible\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Offer the limited CardCorp fallback referral described below\u003C\u002Ftd>\n\u003Ctd>Legitimate interests in helping unsuccessful applicants find an alternative route, subject to the safeguards and unconditional referral opt-out below\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Send marketing or operate optional analytics\u002Fadvertising technologies\u003C\u002Ftd>\n\u003Ctd>Consent where required; otherwise legitimate interests only where applicable marketing law permits, with an opt-out\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003C\u002Ftbody>\n\u003C\u002Ftable>\u003C\u002Fdiv>\u003Cp>We assess necessity and the impact on individuals before relying on legitimate interests. A company's contract does not automatically supply a contract legal basis for its employees' or directors' data. An acquirer's commercial requirement is not automatically a legal obligation imposed on Onbold.\u003C\u002Fp>\n\u003Cp>Required fields and requests are identified in the relevant process. Without information necessary to verify an application, complete a purchase, deliver goods or assess a particular claim, we may be unable to complete that activity. We explain material missing information; declining optional marketing does not prevent a purchase or application assessment.\u003C\u002Fp>\n\u003Ch2 id=\"5-automated-checks-and-artificial-intelligence\" tabindex=\"-1\" data-clause=\"5-automated-checks-and-artificial-intelligence\">5. Automated checks and artificial intelligence\u003C\u002Fh2>\n\u003Cp>Supplier assessment combines rules-based checks, public-source research, document extraction and AI-assisted analysis. For example, systems can identify a business category, extract registry or website facts, interpret free-text application answers, summarise evidence and flag inconsistent information, undisclosed recurring billing or other risks. Automated outputs may be inaccurate; relevant evidence is reviewed before final supplier acceptance or rejection.\u003C\u002Fp>\n\u003Cp>Our onbold.ai assessment service uses Anthropic models for extraction, interpretation and drafting alongside deterministic scoring. Relevant website content, search snippets and application responses may be supplied to those models. We limit inputs to the task and use commercial data-protection arrangements; under the arrangement described for this service, API inputs are not used to train Anthropic's models.\u003C\u002Fp>\n\u003Cp>Transaction controls may automatically request authentication, flag or block a suspicious payment, identify a duplicate refund, or keep a supplier payment ineligible pending settlement, shipment evidence or risk review. These controls use relevant transaction, verification, fulfilment and risk information; they do not establish that a buyer or supplier has committed wrongdoing.\u003C\u002Fp>\n\u003Cp>You may ask us to explain and review an assessment or restriction, correct information, provide your account of events and challenge an outcome at \u003Ca href=\"mailto:privacy@onbold.com\">privacy@onbold.com\u003C\u002Fa>. Where automated processing would produce a legal or similarly significant effect on an individual, we apply the legal conditions and safeguards required for that processing, including meaningful human intervention where required. We do not treat a rules-based decision as human merely because it does not use AI. Payment providers may also make decisions under their own privacy notices.\u003C\u002Fp>\n\u003Ch2 id=\"6-who-receives-personal-data\" tabindex=\"-1\" data-clause=\"6-who-receives-personal-data\">6. Who receives personal data\u003C\u002Fh2>\n\u003Cp>We share data only as relevant to the purpose and recipient's role.\u003C\u002Fp>\n\u003Cdiv class=\"table-scroll\" tabindex=\"0\" role=\"region\" aria-label=\"Table, scrollable\">\u003Ctable>\u003Cthead>\n\u003Ctr>\n\u003Cth>Recipient\u003C\u002Fth>\n\u003Cth>Information and purpose\u003C\u002Fth>\n\u003C\u002Ftr>\n\u003C\u002Fthead>\n\u003Ctbody>\n\u003Ctr>\n\u003Ctd>The supplier of your product\u003C\u002Ftd>\n\u003Ctd>Order, buyer contact, delivery or access details and relevant support\u002Freturn information needed to fulfil the purchase and provide product support; not unrestricted access to payment credentials or another supplier's buyers\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Carriers, fulfilment and shipment-validation providers\u003C\u002Ftd>\n\u003Ctd>Shipment reference and necessary recipient\u002Forder information to deliver goods, validate tracking, investigate delivery and process returns\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Payment providers, acquiring banks, card networks, issuers and banking partners\u003C\u002Ftd>\n\u003Ctd>Transaction and authentication information, relevant application\u002Fcompliance data, settlement instructions and dispute evidence; these recipients may have their own legal duties and controller roles\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Tax and accounting providers\u003C\u002Ftd>\n\u003Ctd>Transaction, location, tax-status and invoice information needed for calculation, reporting, remittance and reconciliation\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Verification, screening and registry providers\u003C\u002Ftd>\n\u003Ctd>Relevant identity, ownership, address and business information needed for the specific check\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Hosting, security, software, communications, CRM and AI providers\u003C\u002Ftd>\n\u003Ctd>Data needed to operate the relevant service under appropriate processing and security arrangements\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Professional advisers, insurers and authorities\u003C\u002Ftd>\n\u003Ctd>Information necessary for advice, insurance, claims, audits, legal duties or lawful investigations\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Group companies and authorised personnel\u003C\u002Ftd>\n\u003Ctd>Limited operational, support or administrative access for the purposes described here, under appropriate confidentiality and data-protection arrangements\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>A prospective or actual business purchaser\u002Fsuccessor\u003C\u002Ftd>\n\u003Ctd>Necessary diligence and transferred business records, subject to safeguards and applicable notice and purpose restrictions\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003C\u002Ftbody>\n\u003C\u002Ftable>\u003C\u002Fdiv>\u003Cp>Our onbold.ai service uses Cloudflare infrastructure, Attio for CRM, Anthropic for AI-assisted analysis, Brave Search with a DuckDuckGo fallback, and Bright Data where access to a submitted public website requires it. The public-website fetch does not require your private application documents to be sent to Bright Data. Other Onbold commerce functions use their relevant hosting, payment, banking, tax, communications and verification providers. The exact providers involved depend on the service and transaction. Contact us for information about the recipients or processors relevant to your data.\u003C\u002Fp>\n\u003Cp>Suppliers normally act as independent controllers for product accounts, use, fulfilment and support where they determine the purposes and means. Their own notices explain that processing. Where a particular service is performed on Onbold's behalf as a processor, the appropriate processing agreement applies. We remain responsible for our retail transaction data and our disclosures. A supplier's involvement does not require you to pursue it first for rights against Onbold.\u003C\u002Fp>\n\u003Ch3 id=\"cardcorp-fallback-referrals\" tabindex=\"-1\" data-clause=\"cardcorp-fallback-referrals\">CardCorp fallback referrals\u003C\u002Fh3>\n\u003Cp>\u003Cstrong>CardCorp Limited\u003C\u002Fstrong>, Gibraltar company number \u003Cstrong>115795\u003C\u002Fstrong>, at \u003Cstrong>Suite 1 Burns House, 19 Town Range, GX11 1AA, Gibraltar\u003C\u002Fstrong>, owns 100% of Onbold Commerce Limited.\u003C\u002Fp>\n\u003Cp>Where a business cannot be onboarded to Onbold, we may refer limited application information to CardCorp for assessment for payment processing through its acquirer relationships. The initial information is limited to business identity and website, business contacts, relevant application responses and a proportionate assessment summary or public evidence. We do not routinely transfer the full onboarding file, identity-document copies, bank statements, biometric data or detailed screening reports for an initial referral.\u003C\u002Fp>\n\u003Cp>We explain the referral at intake and give you an opportunity to decline before disclosure. You can ask us not to refer the business without giving a reason; this does not affect Onbold's own assessment. A referral is not acceptance, a contract or permission for unrelated marketing. If you object after referral, we stop further optional referral disclosures and pass your request to CardCorp, which is responsible for its own processing as a separate controller. CardCorp provides its own privacy information; information about its services is at \u003Ca href=\"https:\u002F\u002Fcardcorp.com\u002F\" rel=\"noopener\" target=\"_blank\">cardcorp.com\u003C\u002Fa>.\u003C\u002Fp>\n\u003Cp>We respect any earlier notice that promised consent-only referral. This policy does not retrospectively authorise disclosure that required your consent. Further document sharing requires its own necessity, lawful basis and appropriate notice and safeguards.\u003C\u002Fp>\n\u003Ch2 id=\"7-international-transfers\" tabindex=\"-1\" data-clause=\"7-international-transfers\">7. International transfers\u003C\u002Fh2>\n\u003Cp>Our providers, suppliers and authorised personnel may process information outside Cyprus, the European Economic Area or the UK. Cloud and website-access services can use global infrastructure; a supplier or carrier may be in the destination or origin country of a purchase. Group-company access is subject to the same transfer rules as other overseas access.\u003C\u002Fp>\n\u003Cp>Where a restricted transfer takes place, we use an applicable adequacy decision or an appropriate safeguard, such as the European Commission's Standard Contractual Clauses, with transfer assessment and supplementary protection where necessary. UK transfers use an applicable UK mechanism, such as the UK Addendum or International Data Transfer Agreement, where required. A provider's presence in a country does not by itself establish that every transfer is adequately protected.\u003C\u002Fp>\n\u003Cp>Contact \u003Ca href=\"mailto:privacy@onbold.com\">privacy@onbold.com\u003C\u002Fa> for information or a copy of relevant safeguards. We may redact confidential information while providing the information needed to understand the protection.\u003C\u002Fp>\n\u003Ch2 id=\"8-retention-and-security\" tabindex=\"-1\" data-clause=\"8-retention-and-security\">8. Retention and security\u003C\u002Fh2>\n\u003Cp>We retain data for the period needed for its purpose and any applicable legal duty or claim, then delete or anonymise it. Different records have different periods:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Cstrong>Application and verification records:\u003C\u002Fstrong> for active assessment and onboarding, then according to the outcome, last meaningful contact, proportionate fraud-prevention needs and applicable legal or claim periods. Unsuccessful applications are not kept indefinitely merely because they might be useful.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Supplier relationship and settlement records:\u003C\u002Fstrong> during the relationship and for applicable accounting, tax, dispute, outstanding buyer-entitlement and claim periods afterwards.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Orders, invoices, tax and payment records:\u003C\u002Fstrong> for applicable transaction-record obligations and the period needed to administer the purchase, subscriptions, refunds and claims. Some tax schemes require longer retention than ordinary operational records.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Tracking, returns, consent and dispute evidence:\u003C\u002Fstrong> for fulfilment and case handling and the relevant dispute, statutory-remedy or claim period; not as a permanent record of an individual's movements.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Support, security and technical logs:\u003C\u002Fstrong> according to the issue, security purpose and applicable retention needs; routine logs generally have shorter lives than financial records.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Marketing and consent preferences:\u003C\u002Fstrong> until withdrawal or the applicable review point, with a minimal suppression record where needed to honour an opt-out.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>The onbold.ai analysis service's raw fetched-page cache is generally discarded within 24 hours. This does not mean the resulting assessment, selected supporting evidence or supplier record is deleted at that point. Where a private results link is provided, the link acts as an access credential: anyone holding it may see the associated information. Treat it like a password and do not forward it unnecessarily. Private assessment links expire after 90 days; this is an access period, not a promise that all associated records are deleted after 90 days.\u003C\u002Fp>\n\u003Cp>We use access restrictions, appropriate authentication, encryption, monitoring, incident handling and contractual safeguards proportionate to the data and risks. Access is limited to authorised people and providers who need it for their work. No transmission or storage system can be guaranteed completely secure. Tell us promptly if a private link, account or communication appears compromised.\u003C\u002Fp>\n\u003Cp>We may retain necessary evidence while a dispute, investigation or legal hold remains active. A deletion request does not necessarily require erasing records we must retain; we explain the applicable grounds and restrict use where appropriate.\u003C\u002Fp>\n\u003Ch2 id=\"9-cookies-analytics-and-marketing\" tabindex=\"-1\" data-clause=\"9-cookies-analytics-and-marketing\">9. Cookies, analytics and marketing\u003C\u002Fh2>\n\u003Cp>Essential technologies support functions such as security, authentication, checkout sessions and remembering necessary choices. Optional analytics, advertising and remarketing tools operate only under the choices and legal conditions applicable to the site and your location. Where consent is required, they must not run before you consent.\u003C\u002Fp>\n\u003Cp>Where enabled, tools may include Google Analytics or Google Ads. The site's cookie controls provide the relevant purposes, providers and durations and allow you to change or withdraw your choice. Refusing optional technologies does not prevent essential purchasing or application functions. Browser controls can also remove cookies, although this may affect necessary functions.\u003C\u002Fp>\n\u003Cp>You can unsubscribe from promotional messages or contact us at any time. We keep transaction, application and service communications separate from optional marketing; unsubscribing does not stop messages needed to administer an order, account, application or legal obligation.\u003C\u002Fp>\n\u003Ch2 id=\"10-your-rights\" tabindex=\"-1\" data-clause=\"10-your-rights\">10. Your rights\u003C\u002Fh2>\n\u003Cp>Depending on the applicable law and circumstances, you may request access, correction, deletion, restriction or a portable copy of your data. You may withdraw consent without affecting processing already lawfully carried out. You may object to processing based on legitimate interests for reasons relating to your situation, and object to direct marketing at any time. We stop direct marketing following an objection.\u003C\u002Fp>\n\u003Cp>Contact \u003Ca href=\"mailto:privacy@onbold.com\">privacy@onbold.com\u003C\u002Fa>. We may ask for proportionate information to verify identity or authority. Under GDPR we normally respond within one month; if a lawful extension is needed, we explain it within that first month. Rights have conditions and exceptions, which we explain where relevant.\u003C\u002Fp>\n\u003Cp>You may complain to the \u003Ca href=\"https:\u002F\u002Fwww.gov.cy\u002Fdataprotection\u002Fen\u002Finformation-for-the-public\u002Flodge-a-complaint\u002F\" rel=\"noopener\" target=\"_blank\">Office of the Commissioner for Personal Data Protection in Cyprus\u003C\u002Fa>, including at \u003Ca href=\"mailto:commissioner@dataprotection.gov.cy\">commissioner@dataprotection.gov.cy\u003C\u002Fa>, or to the competent authority in the EU country of your residence, workplace or alleged infringement. Where UK law applies, you may contact the \u003Ca href=\"https:\u002F\u002Fico.org.uk\u002Fmake-a-complaint\u002F\" rel=\"noopener\" target=\"_blank\">Information Commissioner's Office\u003C\u002Fa>. You do not have to contact us first. Nothing here restricts court proceedings or other rights available under mandatory law.\u003C\u002Fp>\n\u003Ch2 id=\"11-additional-us-privacy-information\" tabindex=\"-1\" data-clause=\"11-additional-us-privacy-information\">11. Additional US privacy information\u003C\u002Fh2>\n\u003Cp>Where applicable state law grants you rights, these may include confirmation of processing, access, correction, deletion, portability, an appeal of a refused request, and opt-outs from targeted advertising, sale\u002Fsharing or certain profiling. Use the privacy contact above, stating if you are appealing an earlier response. An authorised agent may submit a request with appropriate evidence of authority. We do not discriminate for exercising privacy rights.\u003C\u002Fp>\n\u003Cp>We do not sell personal data for money. Optional advertising technologies, where enabled, may constitute sale, sharing or targeted advertising under particular state laws. Where those laws apply, we provide the required opt-out and recognise legally required preference signals, including Global Privacy Control. Cookie controls and privacy requests provide the relevant routes; a generic browser Do Not Track setting is not a substitute for those controls. We do not use sensitive personal information for unrelated advertising purposes.\u003C\u002Fp>\n\u003Ch2 id=\"12-children-and-other-websites\" tabindex=\"-1\" data-clause=\"12-children-and-other-websites\">12. Children and other websites\u003C\u002Fh2>\n\u003Cp>Our supplier application and business services are intended for adults. We do not direct them to children or knowingly use children's data for targeted marketing. A purchase or delivery record may nevertheless contain information about a child supplied by an adult, and we handle any such information only as necessary and lawful for that context. Contact us if you believe a child supplied information inappropriately. Any service deliberately directed to children requires its own appropriate safeguards and information before it is offered.\u003C\u002Fp>\n\u003Cp>Independent websites and supplier services have their own privacy notices. A link from our website does not make Onbold the controller of everything that happens on the linked service.\u003C\u002Fp>\n\u003Ch2 id=\"13-changes-and-contact\" tabindex=\"-1\" data-clause=\"13-changes-and-contact\">13. Changes and contact\u003C\u002Fh2>\n\u003Cp>We update this policy when our processing or legal requirements change and identify the revision date above. We provide further notice of material changes where required. New purposes or data uses requiring separate information or consent will not be authorised merely by updating this page or by your continued use.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Onbold Commerce Limited — HE497763\u003C\u002Fstrong>\u003Cbr>\nProdromou 75, Oneworld Parkview House, 4th Floor, 2063 Nicosia, Cyprus\u003Cbr>\n\u003Ca href=\"mailto:privacy@onbold.com\">privacy@onbold.com\u003C\u002Fa>\u003C\u002Fp>\n",[25,29,32,36,39,42,45,48,51,54,57,60,63,66,69,72,75,78,81],{"id":26,"text":27,"level":28},"1-who-we-are-and-what-this-policy-covers","1. Who we are and what this policy covers",2,{"id":30,"text":31,"level":28},"2-personal-data-we-collect","2. Personal data we collect",{"id":33,"text":34,"level":35},"website-visitors-enquiries-and-partners","Website visitors, enquiries and partners",3,{"id":37,"text":38,"level":35},"supplier-applicants-and-approved-suppliers","Supplier applicants and approved suppliers",{"id":40,"text":41,"level":35},"buyers-and-delivery-recipients","Buyers and delivery recipients",{"id":43,"text":44,"level":35},"delivery-withdrawal-returns-and-disputes","Delivery, withdrawal, returns and disputes",{"id":46,"text":47,"level":35},"sensitive-information","Sensitive information",{"id":49,"text":50,"level":28},"3-where-information-comes-from","3. Where information comes from",{"id":52,"text":53,"level":28},"4-purposes-and-legal-bases","4. Purposes and legal bases",{"id":55,"text":56,"level":28},"5-automated-checks-and-artificial-intelligence","5. Automated checks and artificial intelligence",{"id":58,"text":59,"level":28},"6-who-receives-personal-data","6. Who receives personal data",{"id":61,"text":62,"level":35},"cardcorp-fallback-referrals","CardCorp fallback referrals",{"id":64,"text":65,"level":28},"7-international-transfers","7. International transfers",{"id":67,"text":68,"level":28},"8-retention-and-security","8. Retention and security",{"id":70,"text":71,"level":28},"9-cookies-analytics-and-marketing","9. Cookies, analytics and marketing",{"id":73,"text":74,"level":28},"10-your-rights","10. Your rights",{"id":76,"text":77,"level":28},"11-additional-us-privacy-information","11. Additional US privacy information",{"id":79,"text":80,"level":28},"12-children-and-other-websites","12. Children and other websites",{"id":82,"text":83,"level":28},"13-changes-and-contact","13. Changes and contact",1791904610115]