Privacy Policy
Version 2.0, last revised: 4 October 2026
This Privacy Policy explains what personal data Aldoo collects when you use the website aldoo.com and its subdomains (together, the "Platform"), why we use it, who we share it with, how long we keep it and what your rights are. It applies to buyers, visitors and the people who work in Merchants' shops on the Platform.
The terms used here (Platform, Merchant, Seller, Buyer, Account) have the meaning given in the Terms of Use.
1. Who is responsible for your data
Aldoo Ltd, a company registered in England and Wales under company number 12755836, registered office Barttelot Court, Barttelot Road, Horsham, West Sussex, RH12 1DQ, United Kingdom, office in Bulgaria: 2 Srebarna Str., Promishlena zona "Hladilnika", Sofia 1407 ("Aldoo", "we"), is the controller of the personal data processed through the Platform, except as described in section 6.2 for Merchants.
Contact for any privacy question or request: support@aldoo.com (subject: "Personal data"). Aldoo has not appointed a data protection officer; every request is handled by the Aldoo team at the e-mail above.
In the European Union you can also reach Aldoo at our office in Bulgaria: 2 Srebarna Str., Promishlena zona "Hladilnika", Sofia 1407, and at support@aldoo.com.
2. What data we collect
2.1. Data you give us
| Data | When |
|---|---|
| E-mail address | When you sign in, create an account or buy (also as a guest) |
| Name, phone, delivery address | At checkout, for physical Products; for delivery to a courier office or locker – only the name and phone of the person collecting the parcel. Saved addresses are kept in your account |
| Company invoice details (company name, registration and VAT number, address, responsible person) | If you ask for an invoice |
| Device or platform for a licence | When you buy software licences |
| Reviews, ratings, favourites | When you rate or review a Product, or add it to your favourites |
| Messages to support | When you write to support@aldoo.com, use the contact form or the support chat |
| Return and complaint details | When you withdraw from a purchase or file a complaint (order, products, reason, photos, and an IBAN if a refund by bank transfer is needed) |
| Marketing preferences | Your choices in Account → Privacy |
| Merchant data | For people who register a shop or work in one: name, e-mail, role, the company's details, bank details for payouts |
2.2. Data created when you use the Platform
- Account and order data – orders, items, amounts, currency, promo codes used, order status, shipments, refunds, receipts and invoices, digital products and licences in your library.
- Payment data – the payment is made directly to Stripe. We receive only the payment result, the payment reference, the card type and the last four digits, never the full card number or security code.
- Sign-in data – if you sign in with Google or Apple, we receive your name, e-mail address and an identifier from them; we do not receive your password. If you sign in by e-mail, we send you a one-time sign-in link.
- Device and usage data – a device identifier stored in your browser, IP address, approximate country, browser and device type, language, the pages and Products you view, searches, items added to the cart, the checkout steps you reach and purchases, and the campaign that brought you to the Platform (UTM parameters).
- Data kept in your browser – your cart, the currency and language chosen, the Products you recently viewed, the delivery method and office last used, and your contact details from the last checkout, so you do not have to enter them again. This data stays on your device.
2.3. Data we receive from others
- Stripe – the result of the payment and data needed to prevent fraud.
- Speedy (courier) – the shipment's status and delivery.
- Merchants – the status of your order, shipment and returns.
- Google, Apple – sign-in data, as above.
We do not collect special categories of data (health, beliefs, etc.) and ask you not to send such data in support messages or reviews.
3. Why we use your data and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and running your account; signing you in | Contract (Art. 6(1)(b)) |
| Taking and fulfilling orders: reserving stock, payment, passing the order to the Seller, delivery, digital content and licences, receipts and invoices | Contract (Art. 6(1)(b)) |
| Returns, refunds, complaints and the legal guarantee | Contract and legal obligation (Art. 6(1)(b) and (c)) |
| Customer support, including the support chat | Contract; our legitimate interest in answering you (Art. 6(1)(b) and (f)) |
| Accounting and tax records, invoices | Legal obligation (Art. 6(1)(c)) |
| Preventing fraud and abuse, securing the Platform and accounts | Legitimate interest (Art. 6(1)(f)) |
| Publishing your reviews and ratings | Contract (Art. 6(1)(b)) |
| Remembering your cart, currency, language, recently viewed Products and last delivery choice | Strictly necessary for the service you asked for; legitimate interest (Art. 6(1)(f)) |
| Service messages (order confirmation, shipping, refund, sign-in link) | Contract (Art. 6(1)(b)) |
| Measuring how the Platform is used and improving it (Aldoo Analytics, Google Analytics) | Consent, where cookies or similar technologies are needed (Art. 6(1)(a)); otherwise legitimate interest |
| Advertising and measuring ad campaigns (Google Ads, Meta, Microsoft Advertising) | Consent (Art. 6(1)(a)) |
| Marketing e-mails about new Products and offers ("direct marketing") | Consent, or, for customers, our legitimate interest in offering similar products – you can always opt out (Art. 6(1)(a) or (f)) |
| Personalised recommendations and marketing ("personalised marketing") | Consent (Art. 6(1)(a)) |
| Complying with requests of authorities, establishing and defending legal claims | Legal obligation; legitimate interest (Art. 6(1)(c) and (f)) |
You do not have to give us your data, but without the data needed for an order we cannot fulfil it.
We do not make decisions that have legal or similarly significant effects on you based solely on automated processing. Automated tools may flag an order or account for fraud review; any decision to refuse an order or restrict an account is taken by a person.
4. Cookies and similar technologies
4.1. The Platform uses cookies and browser storage (local storage) for:
- Strictly necessary purposes – signing in, the cart, the checkout, security, your language and currency. These do not need consent.
- Analytics – Aldoo Analytics (our own) and Google Analytics, to count visits and understand how the Platform is used.
- Advertising – Google Ads, Meta Pixel and Microsoft Advertising (UET), to measure which campaigns lead to purchases and to show you relevant ads. For purchase measurement, Google may receive your e-mail address and phone number in hashed (encrypted, non-readable) form, and the identifier of the ad you clicked.
4.2. Your choice. Visitors from the EEA, the UK and Switzerland are asked on their first visit whether they accept analytics and advertising cookies. Until you accept – and if you reject – Google's analytics tools and the advertising tools run in cookieless mode ("consent denied"): they set no analytics or advertising cookies and use no data for personalised advertising; Google may still receive anonymous signals without identifiers, from which it estimates the number of visits and purchases. You can change your choice at any time through Cookie settings at the bottom of every page.
4.2a. Purchases and refunds may also be reported to Google Analytics by our servers (for example when the page was closed before the order confirmation), with the order number, the amounts and the products, and – where you accepted analytics cookies – the identifier of your visit; never your name, e-mail or address.
4.3. You can also delete or block cookies in your browser settings; the Platform may then not work fully.
5. Support chat
In the support chat you are answered by members of Aldoo's support team. To help you, they use your messages and, where needed, the details of your orders. Chat conversations are stored so that the support team can follow up.
6. Who we share your data with
We never sell your personal data. We share it only as follows:
6.1. Service providers (processors) that act on our instructions:
| Provider | What for |
|---|---|
| Stripe Payments Europe Ltd | Card and wallet payments, refunds, fraud prevention |
| Speedy AD | Delivery of parcels (name, phone, address or office/locker) |
| Hetzner Online GmbH (Germany) | Hosting the Platform and its databases, in EU data centres |
| Cloudflare, Inc. | Content delivery and protection of the Platform |
| Google (Google Analytics, Google Tag Manager, Google Ads, sign-in with Google) | Analytics, advertising measurement, sign-in |
| Meta Platforms Ireland Ltd | Advertising measurement (only with consent) |
| Microsoft Ireland Operations Ltd | Advertising measurement (only with consent) |
| Apple (sign-in with Apple) | Sign-in |
| Postmark (ActiveCampaign, LLC, USA) | Sending service and marketing e-mails (transfers outside the EU under the EU standard contractual clauses) |
6.2. Merchants. When you buy a Merchant's Product, we give that Merchant the data it needs to fulfil the order and its legal obligations: your name, e-mail, phone, delivery address or chosen office, the order's contents, invoice details if requested, and the details of any return or complaint. The Merchant processes this data as an independent controller, under its own privacy policy and only for fulfilling your order, returns, complaints and its legal obligations. Merchants may not use it for their own marketing unless you agree to it directly with them.
6.3. Publishers and licensors of software – only the data needed to activate a licence, where the publisher requires it.
6.4. Authorities – courts, prosecutors, tax and consumer protection authorities, the police – when the law requires it.
6.5. Professional advisers (lawyers, auditors, accountants) under a duty of confidentiality, and a buyer or successor of Aldoo's business in the event of a reorganisation, with the same protection for your data.
6.6. Other users see only what you publish yourself: your reviews and ratings, with the name or nickname you chose.
7. Transfers outside the EEA and the UK
Aldoo is established in the United Kingdom, which the European Commission recognises as providing adequate protection for personal data. Some of our providers (for example Google, Meta, Microsoft, Stripe, Cloudflare) may process data in the United States or other countries. Such transfers are made on the basis of an adequacy decision (including the EU–US Data Privacy Framework, for certified companies) or the European Commission's Standard Contractual Clauses with additional safeguards. You can ask us for a copy of the relevant safeguards.
8. How long we keep your data
| Data | Period |
|---|---|
| Account | Until you ask us to close it, or 3 years after your last activity, after which we ask you before deleting it |
| Orders, receipts, invoices and payment records | 10 years from the end of the year of the transaction, as required by accounting and tax law |
| Return, refund and complaint records | 5 years from the end of the year the matter was closed (the general limitation period for claims) |
| Digital products and licences in your library | As long as your account exists, so that you keep access to what you bought |
| Support messages and chat | 3 years from the last message |
| Reviews | Until you delete them or close your account |
| Analytics data | Up to 26 months |
| Marketing consent and preferences | Until withdrawn, plus the time needed to prove the consent |
| Data in your browser (cart, recently viewed, last delivery) | Until you clear it in your browser |
After these periods data is deleted or anonymised.
9. Your rights
Under the GDPR (and the UK GDPR) you have the right to:
- access the personal data we hold about you and receive a copy;
- rectification of inaccurate or incomplete data – you can correct most of it yourself in your account;
- erasure ("right to be forgotten"), unless we must keep the data, for example for accounting purposes;
- restriction of processing;
- data portability – receive the data you gave us in a structured, machine-readable format, or have it sent to another controller;
- object at any time to processing based on our legitimate interest, and in particular to direct marketing;
- withdraw your consent at any time, without affecting what was done before. Marketing e-mails can be stopped through the link in every message or in Account → Privacy; cookies through the cookie settings;
- lodge a complaint with a supervisory authority – in Bulgaria the Commission for Personal Data Protection (cpdp.bg, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592), in the UK the Information Commissioner's Office (ico.org.uk), or the authority of the country where you live.
To exercise your rights, write to support@aldoo.com from the e-mail address of your account. We may ask you to confirm your identity. We reply within one month; for complex requests this may be extended by two more months, and we will tell you why. Requests are free of charge, unless they are clearly unfounded or excessive.
To exercise your rights against a Merchant concerning data it received for an order, you may contact the Merchant directly or write to us and we will forward your request.
10. Children
10.1. Purchases on the Platform may only be made by adults. Where the Platform offers content for children, it is intended to be used by children together with a parent or guardian, who creates the account and makes any purchases.
10.2. We do not knowingly collect personal data from children under 14 (the age of digital consent in Bulgaria; in other countries, the age set by local law) without the consent of a parent or guardian.
10.3. If you are a parent or guardian and believe your child has given us personal data without your consent, write to support@aldoo.com and we will delete it.
11. Security
We protect your data with technical and organisational measures appropriate to the risk, including: encrypted connections (HTTPS) on the whole Platform; card payments handled only by Stripe, a PCI DSS certified provider; sign-in without passwords (one-time e-mail links or sign-in with Google or Apple); access to personal data only for staff and Merchants who need it for their work, with separate roles and permissions; and regular backups. If a personal data breach is likely to result in a high risk to you, we will tell you without undue delay.
12. Changes to this policy
We may update this policy when the Platform or the law changes. The current version and its effective date are always published at aldoo.com/privacy-policy. We will inform registered users by e-mail of material changes before they take effect.
13. Contact
| Controller | Aldoo Ltd, Company No. 12755836 |
| support@aldoo.com | |
| Office in Bulgaria | 2 Srebarna Str., Promishlena zona "Hladilnika", Sofia 1407 |
| Supervisory authority in Bulgaria | Commission for Personal Data Protection, cpdp.bg |
| Supervisory authority in the UK | Information Commissioner's Office, ico.org.uk |