In short
We collect what we need to quote, sell, ship and legally export GPUs. We do not sell your personal information. Analytics and marketing cookies stay off until you say yes. This policy covers shopvram.com and the emails, quotes and orders that come from it. It is written for the EU and UK GDPR and for California law (CCPA as amended by the CPRA).
1. Who is responsible
- Controller: ShopVRAM LLC, a US limited liability company.
- State of formation: [STATE OF FORMATION].
- Registered address: [REGISTERED ADDRESS].
- EIN: 32-56434645.
- Privacy contact: [email protected]. Put “Privacy” in the subject line.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email, password (stored hashed), company, phone | You |
| Order data | Products, quantities, prices, billing and delivery addresses, invoices, serial numbers shipped to you | You and us |
| Quote requests | Company, email, phone, country, products, message, and end-user details: end-user name, address and intended use | You |
| Compliance and KYC data | End-user statements, company registration documents, identity documents of signatories and owners, proof of address, screening results | You and screening providers |
| Payment data | Card details are entered on Stripe and handled by Stripe. We receive only the payment status, card brand, last four digits and expiry. Bank transfer, escrow and letter of credit details from your bank or escrow provider. | You, Stripe, banks |
| Delivery data | Tracking events, delivery confirmation, customs data | DHL |
| Communications | Emails you send us and our replies, RMA requests and photos | You |
| Device and usage data | IP address, browser, device type, pages viewed, time of visit, server and security logs | Your browser |
| Cookies | Cart and login cookies always. Analytics and marketing cookies only with your consent. See our Cookie Policy. | Your browser |
We never store full card numbers. Identity documents can be sensitive personal information under California law. We use them only for compliance screening and fraud prevention, never to infer anything about you.
3. Why we use it and our legal basis
| Purpose | Legal basis (EU and UK GDPR) |
|---|---|
| Answer quote requests and take steps before a contract | Contract |
| Process orders, take payment, ship, handle returns, warranty and RMAs | Contract |
| Run your account | Contract |
| Export control and sanctions screening, end-user checks, export records | Legal obligation (US Export Administration Regulations and sanctions law) |
| Tax, invoicing and accounting records | Legal obligation |
| Fraud prevention, payment verification and anti-diversion checks | Legitimate interests (protecting us and our customers) and legal obligation |
| Site security, logs and keeping the store working | Legitimate interests |
| Business-to-business follow-up on a quote you asked for | Legitimate interests |
| Marketing emails | Consent. Where the law allows, existing customers may get emails about similar products, with an opt-out in every email. |
| Analytics and marketing cookies | Consent |
| Legal claims and requests from authorities | Legal obligation and legitimate interests |
If you do not give the data needed for an order or for export screening, we cannot complete that order.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. A person reviews every screening match before we refuse an order.
4. Who we share it with
- Stripe: card payments and fraud checks.
- DHL: shipping, tracking and customs clearance.
- Email provider: sending and receiving our email.
- Hosting provider: runs the Site and stores its database.
- Screening providers: check names and companies against US and other restricted party lists.
- Banks and escrow services: when you pay by transfer, escrow or letter of credit.
- Analytics and advertising providers (Google Analytics, Meta): only if you consent to those cookies.
- Authorities: customs, tax, export control and law enforcement authorities, when the law requires it or to protect our rights.
- Professional advisers: lawyers and accountants, under confidentiality.
- A buyer of our business, if we sell or merge it, under this policy.
Our providers act on our instructions under data processing terms, except where they act as independent controllers, such as Stripe for its own fraud and legal duties, DHL for customs, and authorities.
5. International transfers
We are based in the United States, so your data is processed in the US. Some providers process data in other countries. When we send personal data from the EU, EEA, UK or Switzerland to a country without an adequacy decision, we use the European Commission’s Standard Contractual Clauses, with the UK Addendum for UK data, or rely on the provider’s certification under the EU-US Data Privacy Framework and its UK and Swiss extensions where it applies. Ask us for a copy of the safeguards.
6. How long we keep it
| Data | Kept for |
|---|---|
| Orders, invoices and payment records | 7 years, for tax |
| Export records: end-user statements, KYC documents, screening results, shipping and serial records | 5 years from the export or the last related transaction, as required by EAR Part 762. Longer if an investigation or legal hold requires it. |
| Quote requests that did not become orders | 24 months |
| Account data | Until you close the account, then as above for any orders |
| Marketing email list | Until you opt out. We keep a suppression record so we do not email you again. |
| Cookie consent choice | 12 months in your browser. If we turn on consent logging, a record of the choice (a random ID, the categories, the date, whether GPC was sent) for 24 months, to prove consent. No IP address is stored with it. |
7. Your rights (EU, EEA, UK and Switzerland)
- Access: get a copy of your data.
- Rectification: correct wrong data.
- Erasure: ask us to delete it. We must keep some records for tax and export law (section 6).
- Restriction: ask us to pause use while a complaint is checked.
- Portability: get data you gave us in a machine-readable format.
- Objection: object to use based on legitimate interests, and to direct marketing at any time.
- Withdraw consent: at any time, without affecting earlier use. For cookies, use “Cookie settings” in the footer.
- Complain: to the supervisory authority where you live or work. In the UK this is the Information Commissioner’s Office.
Email [email protected]. We reply within one month. We may ask you to confirm your identity.
8. California privacy rights
- In the past 12 months we collected the categories in section 2: identifiers, customer records, commercial information, internet activity, approximate location from IP address, professional information (company and role), and sensitive personal information in the form of identity documents for compliance.
- We use them for the purposes in section 3 and disclose them to the recipients in section 4 for business purposes.
- No sale: we do not sell personal information and have not sold it in the past 12 months. We do not knowingly sell or share data of anyone under 16.
- Sharing: if you turn on marketing cookies, the Meta Pixel may count as “sharing” for cross-context behavioural advertising. It is off unless you turn it on.
- Do Not Sell or Share: the “Do Not Sell or Share My Personal Information” link in the footer turns off analytics and marketing cookies straight away, saves that choice for 12 months and confirms it on screen. No form, no account needed.
- Global Privacy Control: if your browser sends a GPC signal, we treat it as a request to opt out of sale and sharing. Analytics and marketing stay off by default, and the cookie banner tells you the signal was detected.
- Your rights: to know what we collect and how we use it, to access it, to delete it, to correct it, and to opt out of sale and sharing. We do not use sensitive personal information for purposes that would give you a right to limit it.
- No discrimination: using your rights does not change your prices or service.
- How to ask: email [email protected]. We verify requests by matching details you give with our records. An authorised agent can ask for you with your signed permission. We reply within 45 days.
9. Children
We do not sell to anyone under 18, and the Site is not aimed at children. If we learn we hold data from a child, we delete it.
10. Security
The Site uses HTTPS. Card data goes straight to Stripe. Access to compliance documents is limited to the people who need it. No system is perfectly secure. If a breach puts you at risk, we will tell you and the authorities as the law requires.
11. Changes
We will update this policy when our practices change. The version and date at the top show the current version. We will email account holders about material changes.
12. Contact
[email protected], subject “Privacy”. See also our Cookie Policy and Terms of Sale.