Privacy, clearly explained

• Account and profile data, including your name, email address, phone number, username, display name, profile image and authentication identifiers.
• Seller and listing data, including city, pickup details, seller phone number, payout-account name and masked payout identifier, card price, condition notes, grade or certificate details and proof photos.
• Cart and order data, including selected cards, buyer details, receipt email, delivery or pickup choice, address fields, map coordinates or place identifier, order status and transaction history.
• Payment and refund data, including amount, currency, payment method, status, payment-provider references and provider response records. Cardnation does not receive or store your complete card number or card security code.
• Trust and support data, including ratings, dispute reasons, messages, requested evidence, refund decisions, listing review outcomes and support correspondence.
• Technical and security data, including request times, browser or device information made available through a request, pseudonymous visitor or network identifiers, abuse-prevention records, audit events and language or theme preferences.

Most data comes directly from you when you register, edit your profile, submit a listing, upload a photo, check out, choose a location, confirm an order, open a dispute or contact us.

We also receive account verification data from our authentication service, payment status and references from the payment processor, ratings or dispute material from other transaction participants, and technical data generated when the service is used. Card catalog information can come from public or licensed catalog sources and is not treated as your personal data unless it is linked to your activity.

• Create, authenticate and administer accounts.
• Publish, search, review, moderate and maintain listings.
• Operate carts, orders, payments, delivery, pickup and seller payouts.
• Support buyer quality confirmation, process refunds, manage ratings and resolve disputes.
• Answer support requests and send essential service or transaction notices.
• Prevent fraud, counterfeit listings, account abuse, payment misuse and security incidents.
• Maintain reliable service, enforce our terms, keep audit records and defend legal claims.
• Comply with Bahrain law, court orders and lawful requests from competent authorities.

Depending on the purpose, we rely on steps requested before a contract, performance of a contract, compliance with a legal obligation, legitimate interests that do not override your fundamental rights, or your clear consent. If processing relies on consent, you may withdraw it without affecting processing that was lawful before withdrawal.

Once a listing is approved, its card details, price, condition notes, grade or certificate details, seller display name, seller city, seller rating and front and back proof photos may be visible to anyone. Choose your public display name carefully.

Public listings are designed not to show a full email address, phone number, exact pickup address or payout details. Information needed to complete an order may still be shared privately with the buyer, seller, delivery participant and authorised Cardnation staff.

• The buyer, seller or delivery and pickup participants, but only where needed to complete or support the transaction.
• Account, hosting, secure-storage, security, communications and customer-support providers working for Cardnation.
• Tap Payments and the relevant payment networks or banks when a payment or refund is requested.
• Google Maps and Places if you choose map-assisted address entry or location selection.
• eBay may receive card search terms when live price references are requested. Opening an eBay result sends your browser to eBay under its own privacy notice.
• Professional advisers, insurers, auditors or a lawful successor to the marketplace where access is necessary and protected.
• Courts, regulators, law-enforcement bodies or other competent authorities where disclosure is required or lawfully permitted.

Tap acts as a separate data controller for payment-instrument information it receives when you initiate payment. Google may also process information under its own policy when its map features load. Cardnation's server does not send your Cardnation account identity to eBay for a card-price search. Cardnation does not sell personal data.

The hosted payment process collects payment-instrument information directly through the payment provider. Cardnation keeps the amount, currency, method, status and provider references needed to reconcile the order, respond to a dispute and process a refund.

Sellers provide the information needed to arrange a payout. Cardnation's marketplace record stores the payout-account name and a masked Benefit number or IBAN identifier rather than publishing or displaying the complete number. Access is limited to people and providers who need it for payout, review, support, fraud prevention or legal compliance.

Cardnation uses essential session and authentication technologies. A language cookie remembers whether you selected English or Arabic, and browser storage remembers preferences such as the site theme. Blocking essential storage can prevent sign-in or preference features from working correctly.

Cardnation does not currently use advertising or behavioural-analytics cookies. Hosted payment and map features may use their own technologies under their policies. If Cardnation later introduces optional analytics, advertising or marketing technologies, we will provide the notice, choice and consent required by applicable law.

Some service providers may process or store data outside the Kingdom of Bahrain. Cardnation will use a transfer route permitted by Bahrain law, such as a destination recognised as providing adequate protection, required authority approval, valid consent, another lawful exception or suitable safeguards.

The exact destination can depend on the service and infrastructure used for an account or transaction. Contact us if you want information about the transfer basis relevant to your data.

We keep personal data only as long as reasonably needed for the purpose for which it was collected. Account data is generally retained while the account is active. Public listing content can be removed or restricted when it is no longer needed, subject to transaction and legal records.

Order, payment, payout, refund, dispute, audit, fraud-prevention, tax and accounting records may be retained longer where necessary to complete a transaction, comply with law, resolve a complaint, establish or defend a claim, protect another person or prevent repeated abuse. Backup copies are deleted or overwritten through the normal backup cycle, and provider-held data follows the provider's lawful retention process.

• Ask whether Cardnation processes personal data about you and request understandable access to it.
• Request correction of inaccurate, incomplete or outdated data.
• Request blocking or erasure where data is processed unlawfully or Bahrain law otherwise requires it.
• Object to direct marketing or processing likely to cause substantial and unwarranted harm or distress.
• Withdraw consent where consent is the basis for processing.
• Request human reconsideration where a decision with a significant personal effect is based solely on automated processing. Cardnation does not currently use such solely automated decision-making.

Email support@cardnation.bh with enough detail to verify your identity and locate the relevant data. We handle requests within the periods required by Bahrain law, which generally include 15 working days for an access notification and 10 working days for relevant correction, blocking, erasure or objection requests.

A request can be limited where the law requires retention, another person's rights would be harmed, the information is protected, or the data is needed for evidence or a legal claim. We will explain a lawful refusal or limitation.

Cardnation uses proportionate technical and organisational safeguards, including access controls, protected storage, validation, abuse prevention, audit records and transaction-integrity checks. Access is limited according to operational need.

No website, storage system or transmission method can guarantee absolute security. Protect your account, use a strong sign-in method, do not share verification codes and contact us promptly if you suspect unauthorised access.

Cardnation is intended for people who can lawfully enter marketplace transactions. It is not directed to children under 18, and a child should not create an account, submit a listing or place an order. A parent or legal guardian who believes a child provided data without proper authority should contact us so we can review and take appropriate action.

We may update this policy when our service, providers or legal duties change. The current effective and last-updated dates appear at the top. Material changes will be highlighted through the service or another appropriate notice where required.

Please contact Cardnation first at support@cardnation.bh so we can investigate a privacy concern. You may also lodge a complaint with Bahrain's Personal Data Protection Authority when you believe personal data has been processed contrary to the Personal Data Protection Law.