Data protection
This Policy explains how HideCOD processes personal data to operate the service, manage accounts and support Cash on Delivery risk protection.
HideCOD provides Cash on Delivery risk-control technology to e-commerce businesses. For data related to accounts, security, support and operation of the service itself, HideCOD determines the relevant processing purposes.
For customer data submitted by a connected e-shop, the roles of the merchant and HideCOD may vary depending on the specific data flow. Details should be reflected in the relevant agreement and, where required, a Data Processing Agreement (DPA).
Depending on how the service is used, we may process:
For the basic checkout customer check, HideCOD does not require the customer’s full name, address or complete order contents.
The service is designed around privacy-by-design and data-minimization principles. Email and phone are protected at rest and secure lookup keys are used to find matches without unnecessary exposure of the original values.
Access is permitted only where required for authorized service functions. No technical measure can guarantee absolute security, but reasonable organizational and technical measures are applied according to the relevant risk.
The lawful basis depends on the data category and purpose. It may include performance of a contract, compliance with a legal obligation and legitimate interests such as service security and management of genuine Cash on Delivery non-collection risk.
Each merchant is responsible for assessing and documenting the lawful basis on which it collects and transfers customer data to HideCOD and for providing any required privacy information to its customers.
When a relevant incident is detected from another connected e-shop, HideCOD may return a network signal. The store receiving that signal does not see which other e-shop recorded the incident.
Network signals should not be used to draw conclusions about a person’s character, trustworthiness or intent beyond the specific purpose of managing Cash on Delivery risk.
Depending on merchant settings, an incident may result in simple recording, merchant-side review or automatic hiding of Cash on Delivery. HideCOD does not label a customer as a fraudster and is not a credit-scoring service.
When Cash on Delivery is hidden, online payment methods can remain available. The merchant is responsible for selecting and applying appropriate rules for its own business.
We retain personal data only for as long as necessary for the relevant purpose, active service provision, security and applicable legal obligations. Incidents may include an expiry or review date.
When data is no longer necessary, it is deleted, anonymized or isolated in accordance with the applicable retention policy.
HideCOD may use trusted infrastructure, hosting, security, communications and payment providers. Providers receive only the data required to deliver their service.
If personal data is transferred outside the EEA, appropriate safeguards required by applicable law are used, such as adequacy decisions or Standard Contractual Clauses where necessary.
Depending on the circumstances, an individual may have rights of access, rectification, erasure, restriction, objection, portability and withdrawal of consent where processing is based on consent.
Requests are assessed under applicable law and may require appropriate identity verification. Individuals may also lodge a complaint with the competent data-protection supervisory authority.
The website and application may use strictly necessary cookies or similar technical means for security, sign-in and core functionality. If non-essential analytics or marketing technologies are enabled in the future, appropriate information and, where required, consent controls will be provided.
This Policy may be updated when the service, technology or legal framework changes. The latest update date appears at the top of the page. Material changes may also be communicated within the service.