Privacy notice for buyers

This notice covers the order form you opened from a brand's link.

Who is responsible

The brand that sent you the link is the controller of your order data. Its identity is on the order page and in your recap email. The legal basis is its legitimate interest in handling business orders (Art. 6(1)(f) GDPR).

Carnet is the order tool that acts for that brand and processes the data on its behalf.

What data

Name, email, company, phone, delivery and billing address, VAT number, order lines and notes.

Why

To pass your order to the brand's store and to send you a copy.

Where

Microsoft Azure in the EU (hosting, database and email) and Cloudflare (network).

How long

As long as the brand has set, then the data is deleted.

Sent email bodies are deleted after 7 days. Backups expire after 35 days.

On your device

One session cookie on the brand's order pages, and the cart quantities in your browser storage. No contact data is stored there.

Your rights

Contact the brand, or write to privacy@ordersheet.net: the message is forwarded to the brand.

You can also complain to your data protection authority.