Privacy Notice

Last updated: 5 November 2026

CardFix runs Derby Draft and is the data controller for the personal data described here.

What we collect and why

• Account data (email address, login details, display name). We use this to create and run your account. Legal basis: performance of a contract.
• Game data (a guest player ID, nicknames, picks, scores, match and lobby results). We use this to run the game, leaderboards and stats. Legal basis: contract and legitimate interests.
• Purchase records (which unlock you bought and a transaction reference). We use these to give you access to what you paid for. Legal basis: contract and legal obligation.
• Technical data (IP address, device and browser details, error logs). We use this for security, fraud prevention and fixing bugs. Legal basis: legitimate interests.

Local storage

We store essential data in your browser's local storage, such as your guest ID, name, daily progress and sound setting. We do not use advertising cookies.

Who we share data with

• Service providers who host and run the site, such as hosting, database and sign-in providers.
• Stripe, which processes payments and handles billing, fraud prevention and, where applicable, tax compliance and transaction-level support. We do not store your full card details.
• Professional advisers, such as legal and accounting advisers.
• Authorities, when the law requires it.

Some providers may process data outside the UK/EEA. When they do, appropriate safeguards are used, such as Standard Contractual Clauses or adequacy decisions.

Retention

We keep account and game data while your account is active. Purchase records are kept as long as the law requires. When we no longer need data, we delete or anonymise it.

Your rights

You have the right to access, correct, delete, restrict or port your data. You can also object to processing and withdraw consent. To use these rights, email info@cardfix.dk. We will reply within one month. You may also complain to a supervisory authority, such as Datatilsynet in Denmark.

Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit and access controls.