klodivo Privacy Policy
Last updated: 14 November 2026
This policy explains what personal data klodivo collects, why, who receives it, how long we keep it and what your rights are. It covers klodivo.com, our emails, and the Seller API.
1. Who is responsible
The data controller is:
klodivo – enkeltmandsvirksomhed (sole proprietorship) v/ Frederik Lilani, Kattebjerg 3, 4700 Næstved, Denmark
Email for privacy questions: privacy@klodivo.com
We have not appointed a data protection officer, because the law does not require one for a company of our size and kind. Write to privacy@klodivo.com; a person reads every message.
Stores are separate controllers. When you order from a store, the store receives your name, delivery address and phone number to ship your parcel. From then on, the store is responsible for its own use of that data, under its own privacy obligations. Our Seller Terms only allow stores to use it for your order.
Stripe is a separate controller for its own identity checks, fraud prevention and anti-money-laundering duties. See stripe.com/privacy.
Google is a separate controller when you choose "Continue with Google": you sign in on Google's page under Google's own terms. See policies.google.com/privacy.
2. What we collect and why
| What | Examples | Why | Legal basis (GDPR) |
|---|---|---|---|
| Account details | Email, full name, username, country, currency, password (stored only as a secure hash), two-step sign-in settings | To create and run your account, keep it secure | Contract (art. 6(1)(b)); security: legitimate interest (art. 6(1)(f)) |
| Sign in with Google (only if you use it) | From Google: your name, email address and an account number for you; when you connected it and last used it. Nothing else: no contacts, photos or access to your Gmail | To let you sign in with Google and recognise your account | Contract (art. 6(1)(b)) |
| Addresses and phone | Delivery addresses, phone number | To deliver your orders | Contract |
| Orders and payments | Items, prices, stores, shipping, delivery address on the order, payment status, refunds, receipts. We never see full card numbers. | To complete purchases, refunds, buyer protection; bookkeeping | Contract; legal obligation (art. 6(1)(c), Danish Bookkeeping Act) |
| Messages | Messages between you and stores; problem reports and photos. Photos you add to a problem report or the contact form are not public: only the buyer, the store and our staff can see them (contact form: only our staff) | To support orders and decide problem cases | Contract; legitimate interest |
| Fraud and abuse checks on messages | Automatic flagging of messages that mention contact details or payment outside klodivo, for a person to check | To protect buyers and stores against scams | Legitimate interest |
| Feedback | Your ratings and comments, shown publicly with your username and country | To help other buyers choose stores | Contract; legitimate interest |
| Wanted lists, follows, notifications | Items you want, stores you follow, email preferences | To send the alerts you asked for | Contract |
| Discount codes from stores | A personal code a store gives you because you bought from it or follow it, and whether you used it | To pass on offers from stores you know | Email: consent (art. 6(1)(a)), off until you switch it on under Account → Notifications; on-site notification: legitimate interest |
| Reports and moderation | Reports you make about listings, messages or stores, our decisions, staff notes on a member or store, bank disputes (chargebacks) | To keep the marketplace safe and handle reports as the EU Digital Services Act requires; bookkeeping | Legitimate interest; legal obligation |
| Store details (stores) | Store name, location, trader status, business details, Stripe account status, listings, sales, payouts | To run your store and pay you | Contract |
| Tax reporting data (stores) | TIN (for Danes the CPR number), date of birth, address, VAT and registration numbers, bank account | To meet DAC7 reporting duties | Legal obligation (art. 6(1)(c)); CPR: databeskyttelsesloven § 11(2)(1) |
| Sanctions screening (store owners) | The owner's name (from the account or the tax details), date of birth, the entry on the EU sanctions list it may match, our decision and a staff note | EU sanctions rules forbid making money available to people whose assets are frozen; as the platform that pays out stores' money, we check every store owner. We check against the EU's consolidated sanctions list, which we download every week; no data is sent anywhere for this | Legal obligation (art. 6(1)(c)) |
| Security and technical data | IP address, browser and device, sign-in times, sessions, actions in the audit log. For each signed-in session we also keep the approximate place (city and country) derived from the IP address; it is shown to you under Account → Security → Signed-in devices so you can spot sign-ins you don't recognise, and it is deleted with the session | To keep the site secure and prevent fraud | Legitimate interest |
| Error log | The page address (with sign-in links, keys and other secrets removed), your user id if you were signed in, the time and the technical error. No IP addresses | To find and fix faults | Legitimate interest |
| Support emails and contact form | Your name, email, message, attachments, order number | To answer you | Legitimate interest; contract |
| Statistics (only with consent) | Pages viewed, device, approximate location, via Google Analytics | To understand how the site is used and improve it | Consent (art. 6(1)(a)) |
| Product update emails (only if you ticked the box) | Email address | To tell you about new features | Consent |
You must give the data marked "contract" to use the marketplace; without it we can't create your account or deliver orders. Tax reporting data is required by law for stores.
Automated decisions. We use automated rules to: flag messages for review, flag listings priced far below the price guide, release payouts on set dates, hold payouts when a bank dispute is opened, freeze a store when 5 bank disputes are open at the same time, and hold a store's payouts when the weekly sanctions check finds a possible match on the EU sanctions list. A possible match is never decided by the computer: payouts stay held until a person has checked it. Decisions that significantly affect you (holds, freezes, suspensions) can always be reviewed by a person: reply to our email or write to legal@klodivo.com. Stripe also uses automated fraud screening on payments.
3. Who receives your data
| Recipient | What and why | Where |
|---|---|---|
| Stores you order from | Name, delivery address, phone number, order contents, messages, to ship and support your order | Each store's country (EU) |
| Stripe (Stripe Technology Europe Ltd, Ireland, and Stripe, Inc., USA) | Payment details, store identity and bank details, to process payments and payouts | EU and USA (EU-US Data Privacy Framework; Standard Contractual Clauses) |
| One.com Group AB (one.com), Sweden | Hosts our server and its daily backups (processor) | EU |
| Cloudflare, Inc. | Network security, protection against attacks, delivery of images and files; sees IP addresses and requests. Photos from problem reports and the contact form are never stored in its cache (processor) | Global network; USA (EU-US Data Privacy Framework; Standard Contractual Clauses) |
| Google Ireland Ltd / Google LLC (Google Analytics 4) | Usage statistics, only if you accept statistics cookies (processor) | EU and USA (EU-US Data Privacy Framework) |
| Google Ireland Ltd / Google LLC (Google Merchant Center, Google Shopping) | Stores' listings: the store name (for a private seller often their own name), listing photos, prices, condition, shipping rates and return terms, to show them free in Google Shopping. A store can turn this off under Settings › Google Shopping. Google decides how it shows them under its own privacy policy | EU and USA (EU-US Data Privacy Framework) |
| Google Ireland Ltd / Google LLC (Sign in with Google) | Only if you choose "Continue with Google": you sign in on Google's own page, and Google tells us your name, email address and an account number for you. We send Google nothing about you; Google is a separate controller for its own sign-in | EU and USA (EU-US Data Privacy Framework) |
| Discord, Inc. | Internal team alerts. These say only what kind of event happened (for example "Refund failed" or "New contact message") with a link to our admin pages, and technical notices about our own systems; never order numbers, amounts, ids, names, email addresses, subjects or message contents | USA (EU-U.S. Data Privacy Framework) |
| Skattestyrelsen (Danish Tax Agency) | Stores' sales information (DAC7), as required by law | Denmark |
| Authorities and courts | When the law requires it, or to report suspected crime | Denmark, or the authority's own country |
| Carriers and tracking services | When you click a tracking link, the carrier or 17TRACK receives the tracking number | Their own terms apply |
Our own server runs the search engine, the email server, the virus and spam filtering and the sanctions check, so that data stays with us. We don't sell your data and don't use it for advertising.
4. Transfers outside the EU/EEA
Some recipients are in the USA. We rely on the EU-US Data Privacy Framework (Commission decision 2023/1795) where the recipient is certified, and otherwise on the EU Standard Contractual Clauses (2021/914). Ask privacy@klodivo.com for a copy of the safeguards.
5. How long we keep data
| Data | Kept for |
|---|---|
| Account details | Until you delete your account |
| A connected Google account | Until you disconnect it or delete your account |
| Orders, payments, refunds, receipts and fee records | 5 years from the end of the financial year they belong to (Danish Bookkeeping Act), then anonymised |
| Messages between buyers and stores | 3 years after the last message (the limitation period for claims), then deleted |
| Problem reports and withdrawals | With the order records: the texts and photos are deleted when the order record is anonymised (5 years from the end of the financial year); the decision and amounts stay for the bookkeeping |
| Bank disputes (chargebacks) | 5 years from the end of the financial year they belong to (Danish Bookkeeping Act) |
| Feedback | As long as the store exists, and 3 years after it closes; shown as "Former member" after you delete your account |
| Closed stores | The public profile (about text, banner, logo, store terms, languages and notices) is deleted when the store closes; the business details are kept 5 years after closure (bookkeeping and DAC7) |
| Tax reporting data (stores) | While the store is open. After it closes: 5 years from the end of the later of the last year with reported sales and the year it closed (Danish DAC7 rules, via the Bookkeeping Act) |
| Sanctions screening records (stores) | 5 years after the decision, or 5 years after the store closes if that is later |
| Support emails, reports and contact messages | About an order, privacy or a legal matter: 3 years after the conversation was answered or closed. Other questions: 12 months. Spam: 30 days |
| Reports of listings, messages and stores | 3 years after they were handled |
| Staff notes on a member or store | As long as that account or store record is kept, and at most 5 years after the last note |
| On-site notifications | 12 months |
| Audit log (security, including IP addresses) | 2 years |
| Sessions (including the approximate place of each signed-in device) | Until you sign out, or 12 hours of inactivity (30 days with "Keep me signed in") |
| Copies of emails we send, including ones that could not be delivered | 30 days |
| Server logs | 14 days; the mail server's and background worker's logs up to 5 weeks |
| Error log (no IP addresses) | 90 days |
| Last IP address used with a Seller API key | 90 days after the key was last used |
| Backups | Our encrypted backups: 14 days. Our host's daily server backups: up to 14 days |
| Data exports you request | The download link and file: 7 days |
| Statistics in Google Analytics | 2 months (setting in Google Analytics) |
When you delete your account we delete your addresses, wanted lists, follows, notifications, carts, sessions, data exports and your side of your messages: the messages you wrote, as a buyer or as a store. The other party keeps the messages they wrote and sees you as "Former member". We keep your order records (anonymised: without your name, address and phone) for the bookkeeping period, your feedback (as "Former member"), and security records for the period above. If you have a store, it is closed and its listings and their photos are deleted; the store record and its sales stay for the bookkeeping period. You can't delete your account while an order is open.
6. Your rights
You have the right to:
- access your data, and get a copy: Account → Password and security → "Download your data". We email you a download link, valid for 7 days (you can ask once every 24 hours). The file contains your account and profile, addresses, orders, messages (as a buyer and as a store), feedback you gave and received, follows, notifications, wanted lists, conversations with klodivo, problem reports and reports you made, and discount codes; for store owners also the store's details and settings, shipping rates, listings, sales, payouts, API key details (never the keys themselves) and your own DAC7 tax details. Write to us for anything not in it;
- correct wrong data: most of it you can edit in your account;
- delete your data ("right to be forgotten"), except what we must keep by law;
- restrict our processing, and object to processing based on our legitimate interests, including at any time to direct marketing;
- data portability: receive data you gave us in a machine-readable format;
- withdraw consent at any time (cookie settings in the site footer; email preferences under Account → Notifications), without affecting earlier processing.
Write to privacy@klodivo.com. We answer within one month. You can also complain to the Danish Data Protection Agency, Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, www.datatilsynet.dk, or the authority in your own country.
7. Cookies
We use necessary cookies to keep you signed in and remember your cart and currency, and statistics cookies only with your consent. Details: Cookie Policy.
8. Emails
We send emails needed for your account and orders. Other emails (wanted-list matches, weekly summaries of stores you follow, feedback reminders, product news) can be switched off under Account → Notifications or with the unsubscribe link in each email.
Discount codes from stores. A store can send a personal discount code to members who bought from it or follow it. You get it by email only if you switch on "Discount codes from stores" under Account → Notifications (it is off until you do), and every such email has a one-click unsubscribe link. You also get a notification on the site; that is on by default and can be switched off in the same place.
9. Our YouTube channel
klodivo uses YouTube API Services to publish short videos to our own YouTube channel, @klodivo. This only involves our own channel: we do not access, collect or store data about you or your YouTube account through YouTube API Services. If you watch or interact with our videos on YouTube, the YouTube Terms of Service and the Google Privacy Policy apply. We keep the access to our channel on our own server and can remove it at any time, and it can also be revoked on Google's security settings page.
10. Children
klodivo is not meant for children. You must be 18 to create an account. If we learn we have data from a child without the needed consent, we delete it.
11. Security
Passwords are stored with Argon2id; sign-in links and keys only as secure hashes; all traffic is encrypted (HTTPS); our server is reachable only through Cloudflare; staff need two-step sign-in; backups are encrypted with a key kept away from the server; incoming email is scanned for viruses. Tell us about security problems at security@klodivo.com.
12. Changes
We'll update this policy when our processing changes, and email you about important changes.