Last updated: 17 October 2026.
Privacy policy
Last updated: 17 October 2026.
Who is responsible for your data?
COMSOFT XP, SIREN 941 175 523, trading as MoxCards, with its registered office at 5 Parc d’Activité de Camalcé, 34150 Gignac, France, is the controller for the processing it determines for its store and its relationships with customers and people offering cards for sale.
For questions about personal data or to exercise your rights, email inresponse@moxcards.eu or write to the registered office above.
This notice covers browsing moxcards.eu, purchases, customer accounts, communications with our team and card buyback enquiries. Reading it or continuing to browse does not provide blanket consent to advertising or optional tracking.
What information is used and why?
We receive information you provide through an order, account, form or message: your name, contact details, billing and delivery addresses, relevant products, transaction information and correspondence. Buyback enquiries may include card lists, files, photographs and details you choose to provide. Do not include personal information unrelated to your request.
Information needed for orders, payment, delivery, returns and after-sales support is used to perform the contract or take pre-contractual steps you request. Information needed to assess a buyback enquiry is used to answer that request and, if an agreement is reached, manage the purchase. Without the information needed for a service, we may be unable to provide it.
Invoicing, accounting and legally required traceability records are processed to meet legal obligations. Website protection, proportionate prevention of abuse and fraud, general enquiries and protection of legal rights rely on our legitimate interests in running a secure and properly managed business, while respecting your rights.
Browsing also produces technical data such as IP addresses, device and browser types, identifiers and interactions with the store. Depending on their use, these support operation, security, analytics or advertising. The rules on tracking technologies are explained below.
Payment data is processed through your chosen payment service. We use transaction information needed to manage orders, payments and refunds.
Marketing subscriptions are optional. Consent is required where the law provides for it; permitted marketing of similar products to existing customers remains subject to applicable conditions and the right to object. You can unsubscribe using the link in a marketing message or by contacting us. Necessary messages about an order or current enquiry may continue.
Services and recipients
Data is intended for COMSOFT XP and the services involved in the relevant operation. Recipients depend on the services you use; not every recipient receives every piece of information.
- Shopify provides the store platform, accounts, order and communication features. It also processes certain information for its own services under its Consumer Privacy Policy.
- Tally hosts the external buyback enquiry form when you use it. Your email address, file and message are used to assess your request and respond. Download links sent to our team allow anyone holding them to access the files: do not share those links. See Tally’s privacy policy.
- The payment services presented during your purchase and the selected carrier handle payment and delivery. Available delivery services include Colissimo and Chronopost Shop2Shop, depending on the order and destination.
- The store includes Rivo components for loyalty and referrals, OrderEasy components for order functions, hCaptcha for form protection, and Shopify and Meta components for analytics and advertising. Relevant technical information and interactions depend on the functions used and applicable permissions.
Information may also be disclosed to legally authorised authorities where required, or as necessary to establish, exercise or defend legal claims.
Links to social networks or marketplaces take you to separate services with their own privacy information. A link does not perform the same function as a component embedded in the store.
International processing
The services used may involve processing in several countries, including outside the European Economic Area. The Shopify and Tally policies linked above explain their respective practices; they do not replace COMSOFT XP’s obligations.
A transfer outside the European Economic Area must have the basis required by data-protection law, such as an adequacy decision or appropriate safeguards. For details about recipients, countries and safeguards applicable to your information, contact inresponse@moxcards.eu.
How long is information retained?
Retention depends on its purpose and context:
- Orders, payments and returns: handling the transaction, after-sales support and warranties, followed by legal recordkeeping requirements and relevant periods for establishing or defending rights.
- Accounting and other legally required records: the statutory retention periods applicable to each category.
- Customer accounts: maintaining the account and associated services, taking account of use, a closure request and information that must be retained under another obligation.
- Messages and buyback enquiries: assessment, correspondence and follow-up, followed by any evidence requirements or obligations linked to a completed transaction.
- Marketing: consent or other applicable legal permission, the relationship, relevant last contact, unsubscribing or an objection. Information needed to honour an objection may be retained for that purpose alone.
- Technical information and trackers: the relevant function, session or tracker lifespan, security needs and applicable choices.
The end of an operational need does not remove mandatory retention obligations. Such an obligation does not justify using information for another purpose.
Your rights
Subject to the conditions in data-protection law, you have rights of access, correction, erasure, restriction, portability and objection. You can withdraw consent without affecting the lawfulness of earlier processing. You can object to direct marketing at any time.
Email inresponse@moxcards.eu with your request. A response is normally due within one month of receipt; any extension permitted by law must be explained within that period. Additional identity evidence may be requested only proportionately, particularly where reasonable doubt exists about identity. Legal obligations may limit erasure.
You can complain to CNIL or another competent supervisory authority.
Cookies and similar technologies
These technologies support functions such as sessions, the cart, preferences and security. Others may measure traffic, help understand product interactions or personalise advertising, including through Shopify and Meta.
Trackers strictly necessary for the requested service may be used without prior consent. Other trackers requiring consent are subject to your agreement; continuing to browse, reading this notice or closing a banner does not constitute that agreement.
Where the store or a service you use presents a privacy choice, review the stated purposes before choosing. For questions about choices, objections or withdrawal of consent, email inresponse@moxcards.eu. You can also inspect, delete or restrict cookies through your browser settings. These settings may affect the cart or sign-in and do not replace exercising your rights over information already processed.
Session cookies expire when the session ends; persistent cookies have a set lifespan and may be renewed on a later visit. Platform technology information is available through Shopify’s privacy policy. A cookie’s lifespan is not necessarily the retention period for information processed through it.
Updates
The date above identifies the latest update. An update does not provide consent to a new optional purpose. For privacy questions or difficulties, contact inresponse@moxcards.eu.