klodivo Privacy Policy
Last updated: 6 November 2026
This policy explains what personal data klodivo collects, why, who receives it, how long we keep it and what your rights are. It covers klodivo.com, our emails, and the Seller API.
1. Who is responsible
The data controller is:
klodivo – enkeltmandsvirksomhed (sole proprietorship) v/ Frederik Lilani, Kattebjerg 3, 4700 Næstved, Denmark
Email for privacy questions: privacy@klodivo.com
We have not appointed a data protection officer, because the law does not require one for a company of our size and kind. Write to privacy@klodivo.com; a person reads every message.
Stores are separate controllers. When you order from a store, the store receives your name, delivery address and phone number to ship your parcel. From then on, the store is responsible for its own use of that data, under its own privacy obligations. Our Seller Terms only allow stores to use it for your order.
Stripe is a separate controller for its own identity checks, fraud prevention and anti-money-laundering duties. See stripe.com/privacy.
2. What we collect and why
| What | Examples | Why | Legal basis (GDPR) |
|---|---|---|---|
| Account details | Email, full name, username, country, currency, password (stored only as a secure hash), two-step sign-in settings | To create and run your account, keep it secure | Contract (art. 6(1)(b)); security: legitimate interest (art. 6(1)(f)) |
| Addresses and phone | Delivery addresses, phone number | To deliver your orders | Contract |
| Orders and payments | Items, prices, stores, shipping, delivery address on the order, payment status, refunds, receipts. We never see full card numbers. | To complete purchases, refunds, buyer protection; bookkeeping | Contract; legal obligation (art. 6(1)(c), Danish Bookkeeping Act) |
| Messages | Messages between you and stores; problem reports and photos | To support orders and decide problem cases | Contract; legitimate interest |
| Fraud and abuse checks on messages | Automatic flagging of messages that mention contact details or payment outside klodivo, for a person to check | To protect buyers and stores against scams | Legitimate interest |
| Feedback | Your ratings and comments, shown publicly with your username and country | To help other buyers choose stores | Contract; legitimate interest |
| Wanted lists, follows, notifications | Items you want, stores you follow, email preferences | To send the alerts you asked for | Contract |
| Store details (stores) | Store name, location, trader status, business details, Stripe account status, listings, sales, payouts | To run your store and pay you | Contract |
| Tax reporting data (stores) | TIN (for Danes the CPR number), date of birth, address, VAT and registration numbers, bank account | To meet DAC7 reporting duties | Legal obligation (art. 6(1)(c)); CPR: databeskyttelsesloven § 11(2)(1) |
| Security and technical data | IP address, browser and device, sign-in times, sessions, actions in the audit log | To keep the site secure and prevent fraud | Legitimate interest |
| Support emails and contact form | Your name, email, message, attachments, order number | To answer you | Legitimate interest; contract |
| Statistics (only with consent) | Pages viewed, device, approximate location, via Google Analytics | To understand how the site is used and improve it | Consent (art. 6(1)(a)) |
| Product update emails (only if you ticked the box) | Email address | To tell you about new features | Consent |
You must give the data marked "contract" to use the marketplace; without it we can't create your account or deliver orders. Tax reporting data is required by law for stores.
Automated decisions. We use automated rules to: flag messages for review, flag listings priced far below the price guide, release payouts on set dates, hold payouts when a bank dispute is opened, and freeze a store when 5 bank disputes are open at the same time. Decisions that significantly affect you (holds, freezes, suspensions) can always be reviewed by a person: reply to our email or write to legal@klodivo.com. Stripe also uses automated fraud screening on payments.
3. Who receives your data
| Recipient | What and why | Where |
|---|---|---|
| Stores you order from | Name, delivery address, phone number, order contents, messages, to ship and support your order | Each store's country (EU) |
| Stripe (Stripe Technology Europe Ltd, Ireland, and Stripe, Inc., USA) | Payment details, store identity and bank details, to process payments and payouts | EU and USA (EU-US Data Privacy Framework; Standard Contractual Clauses) |
| One.com Group AB (one.com), Sweden | Hosts our server and its daily backups (processor) | EU |
| Cloudflare, Inc. | Network security, protection against attacks, delivery of images and files; sees IP addresses and requests (processor) | Global network; USA (EU-US Data Privacy Framework; Standard Contractual Clauses) |
| Google Ireland Ltd / Google LLC (Google Analytics 4) | Usage statistics, only if you accept statistics cookies (processor) | EU and USA (EU-US Data Privacy Framework) |
| Discord, Inc. | Internal team alerts. These can contain an order number, an amount, or the name, email and subject of a support message, never the message itself (processor) | USA (EU-U.S. Data Privacy Framework) |
| Skattestyrelsen (Danish Tax Agency) | Stores' sales information (DAC7), as required by law | Denmark |
| Authorities and courts | When the law requires it, or to report suspected crime | Denmark, or the authority's own country |
| Carriers and tracking services | When you click a tracking link, the carrier or 17TRACK receives the tracking number | Their own terms apply |
Our own server runs the search engine, the email server and the virus and spam filtering, so that data stays with us. We don't sell your data and don't use it for advertising.
4. Transfers outside the EU/EEA
Some recipients are in the USA. We rely on the EU-US Data Privacy Framework (Commission decision 2023/1795) where the recipient is certified, and otherwise on the EU Standard Contractual Clauses (2021/914). Ask privacy@klodivo.com for a copy of the safeguards.
5. How long we keep data
| Data | Kept for |
|---|---|
| Account details | Until you delete your account |
| Orders, payments, refunds, receipts and fee records | 5 years from the end of the financial year they belong to (Danish Bookkeeping Act), then anonymised |
| Messages between buyers and stores | 3 years after the last message (the limitation period for claims), then deleted |
| Problem reports and withdrawals | With the order records |
| Feedback | As long as the store exists; shown as "Former member" after you delete your account |
| Tax reporting data (stores) | 5 years from the end of the year reported (Danish DAC7 rules, via the Bookkeeping Act) |
| Support emails, reports and contact messages | About an order, privacy or a legal matter: 3 years after the conversation was answered or closed. Other questions: 12 months. Spam: 30 days |
| Audit log (security, including IP addresses) | 2 years |
| Sessions | Until you sign out, or 12 hours of inactivity (30 days with "Keep me signed in") |
| Copies of sent emails | 30 days |
| Server logs | 14 days; the mail server's and background worker's logs up to 5 weeks |
| Backups | Our encrypted backups: 14 days. Our host's daily server backups: up to 14 days |
| Data exports you request | 7 days |
| Statistics in Google Analytics | 2 months (setting in Google Analytics) |
When you delete your account we delete your addresses, wanted lists, follows, notifications, carts, sessions, data exports and your side of your messages. We keep your order records (anonymised: without your name, address and phone) for the bookkeeping period, your feedback (as "Former member"), and security records for the period above. If you have a store, it is closed and its listings removed. You can't delete your account while an order is open.
6. Your rights
You have the right to:
- access your data, and get a copy: Account → Password and security → "Download your data" gives you a file straight away; write to us for anything not in it;
- correct wrong data: most of it you can edit in your account;
- delete your data ("right to be forgotten"), except what we must keep by law;
- restrict our processing, and object to processing based on our legitimate interests, including at any time to direct marketing;
- data portability: receive data you gave us in a machine-readable format;
- withdraw consent at any time (cookie settings in the site footer; email preferences under Account → Notifications), without affecting earlier processing.
Write to privacy@klodivo.com. We answer within one month. You can also complain to the Danish Data Protection Agency, Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, www.datatilsynet.dk, or the authority in your own country.
7. Cookies
We use necessary cookies to keep you signed in and remember your cart and currency, and statistics cookies only with your consent. Details: Cookie Policy.
8. Emails
We send emails needed for your account and orders. Other emails (wanted-list matches, weekly summaries of stores you follow, feedback reminders, product news) can be switched off under Account → Notifications or with the unsubscribe link in each email.
9. Children
klodivo is not meant for children. You must be 18 to create an account. If we learn we have data from a child without the needed consent, we delete it.
10. Security
Passwords are stored with Argon2id; sign-in links and keys only as secure hashes; all traffic is encrypted (HTTPS); our server is reachable only through Cloudflare; staff need two-step sign-in; backups are encrypted with a key kept away from the server; incoming email is scanned for viruses. Tell us about security problems at security@klodivo.com.
11. Changes
We'll update this policy when our processing changes, and email you about important changes.