WopCart.com
Get WopCart

Privacy policy

Last updated: 14 September 2026

1. Controller

WopCart.com, operated by C. Badde, sole trader, Triq il-Marfa, Bay Blue 2, MLH9065 Mellieha, Malta. Email: [email protected].

2. Data protection officer

We have not appointed a data protection officer, because the law does not require one for a business of our size and type. For any privacy question, contact [email protected].

3. Overview

This policy covers the website wopcart.com, purchases of WopCart plans, customer accounts, support requests, and the plan check that WopCart installations send to wopcart.com. We process personal data on the following legal bases under the GDPR: performance of a contract (Art. 6(1)(b)), legal obligations such as tax record keeping (Art. 6(1)(c)), legitimate interests (Art. 6(1)(f)) and, where we ask for it, consent (Art. 6(1)(a)). Each section below names the legal basis for that activity.

4. Hosting and server logs

The website is hosted on a virtual server provided by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. When you visit, the server processes your IP address, date and time, requested URL, referrer and browser user agent to deliver the site and keep it secure. Log files are kept for 14 days. Legal basis: Art. 6(1)(f) GDPR. Hostinger processes this data on our behalf under a data processing agreement (Art. 28 GDPR).

5. WordPress, customer accounts and cookies

The site runs on WordPress with the WopCart plugin. If you create an account or buy a plan, we process your name, email address, password (stored as a hash), billing address, orders, invoices, plan keys and the domains activated on them. Legal basis: Art. 6(1)(b) GDPR.

We only use cookies that are needed for the site to work. We do not use advertising or analytics cookies.

  • WordPress login cookies: a test cookie that checks whether your browser accepts cookies, and session cookies that keep you logged in to your account. They expire when you close the browser, or after up to 14 days if you choose “Remember me”.
  • Cart cookie (wopcart_cart_key): a random key that links your browser to your cart. It is only set once you add something to the cart and lasts 30 days.
  • Currency cookie (wopcart_currency): remembers the currency you chose, for 30 days.
  • Review vote cookie (wopcart_voted_ followed by a review number): set only if you mark a review as helpful, so the same browser cannot vote twice. It lasts one year.
  • Cloudflare security cookies: Cloudflare may set strictly necessary cookies to tell people from bots when its protection features are active. See section 6.

Legal basis: regulation 5(2) of the Maltese Processing of Personal Data (Electronic Communications Sector) Regulations (Subsidiary Legislation 586.01), which allows cookies that are strictly necessary for a service you request, and Art. 6(1)(f) GDPR.

6. Cloudflare

We use Cloudflare for DNS, content delivery (CDN) and security, including protection against attacks. All requests to wopcart.com pass through Cloudflare’s network. Provider: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare processes your IP address and request data to deliver and protect the site, and may set strictly necessary security cookies. Data may be transferred to the USA; Cloudflare is certified under the EU-US Data Privacy Framework and also offers standard contractual clauses. Legal basis: Art. 6(1)(f) GDPR. Privacy policy: https://www.cloudflare.com/privacypolicy/

7. Email delivery through Brevo

Emails from the site, such as receipts, invoices, plan keys and password resets, are sent through the SMTP service of Brevo (Sendinblue SAS, 17 rue Salneuve, 75017 Paris, France). Brevo processes your email address, name, the email content and delivery data on our behalf under a data processing agreement (Art. 28 GDPR). Legal basis: Art. 6(1)(b) GDPR. Privacy policy: https://www.brevo.com/legal/privacypolicy/

8. Purchases, payments and tax records

Plan purchases are paid through Stripe Checkout. For customers in the EU, the Stripe provider is Stripe Payments Europe, Limited, Dublin, Ireland. Stripe receives the amount, currency, your email address, billing details and payment details, and processes them under its own privacy policy: https://stripe.com/privacy. We do not store full card numbers.

For EU VAT, we store your billing country and a country derived from your IP address as location evidence. To get that country, your IP address is sent to ipapi.co. If you enter a VAT number, it is checked with the European Commission’s VIES service. When you agree to immediate delivery at checkout, we store the time of that consent as evidence.

Orders, invoices and VAT evidence are kept for 6 years from the end of the year they relate to, as required by Maltese VAT law. Legal basis: Art. 6(1)(b) and (c) GDPR.

9. Merchants using the free plan (Stripe Connect)

If you use the WopCart plugin on the free plan, payments in your store are created through our Stripe Connect platform as direct charges on your connected Stripe account. We process your connected account identifier, its status and the platform fees for each transaction. For each payment, Stripe receives the amount, currency, the buyer’s email address and billing country.

You, the merchant, are the controller for your buyers’ data and are responsible for informing your buyers about it in your own privacy policy. Stripe processes payment data under its own terms. We only use the transaction data we can see in our platform account to calculate and collect the platform fee, prevent fraud and meet our tax and accounting duties. Legal basis: Art. 6(1)(b), (c) and (f) GDPR.

10. Plan check from WopCart installations

When a plan key is saved in a WopCart installation, that installation contacts wopcart.com to activate the site on the plan, and then checks the plan about twice a day. Each request contains the plan key, the site address (URL) and the plugin version. Our server also processes the IP address of the requesting server, including for rate limiting. No data about the merchant’s customers or sales is sent. Without a stored plan key, no request is made.

Purpose: confirming the plan and counting the domains it is used on. Legal basis: Art. 6(1)(b) GDPR. Activation records are kept for as long as the plan exists and for 12 months after it ends.

11. Contacting us

If you email us, we process your email address, name and the content of your message to answer you. Legal basis: Art. 6(1)(b) GDPR where your request relates to a purchase or account, otherwise Art. 6(1)(f) GDPR. We delete support emails 24 months after the matter is closed, unless they form part of order records that we must keep longer.

12. Recipients

  • Hostinger International Ltd. (Cyprus): hosting
  • Cloudflare: DNS, content delivery and security
  • Brevo: email delivery
  • Stripe: payment processing
  • ipapi.co (Kloudend, Inc., USA): IP-based country lookup for VAT evidence
  • European Commission (VIES): VAT number validation
  • Tax and other public authorities, where the law requires it

13. Transfers outside the EU/EEA

Hosting takes place in the EU. Some of our providers process data in the USA or other countries outside the EU/EEA:

  • Cloudflare: certified under the EU-US Data Privacy Framework; standard contractual clauses as an additional safeguard.
  • Stripe: Stripe, LLC is certified under the EU-US Data Privacy Framework; Stripe also uses standard contractual clauses.
  • Brevo: an EU company; where its group companies or sub-processors outside the EU are involved, Brevo relies on standard contractual clauses and, for its US company, the EU-US Data Privacy Framework.
  • ipapi.co: operated by Kloudend, Inc. in the USA; transfers are based on standard contractual clauses in its data processing agreement.

14. How long we keep data

  • Server log files: 14 days.
  • Orders, invoices and VAT evidence: 6 years from the end of the year they relate to.
  • Plan activation records: for the life of the plan and 12 months after it ends.
  • Customer account: until you ask us to delete it. Records we must keep for tax purposes are kept for the period above.
  • Support emails: 24 months after the matter is closed.
  • Cookies: as listed in section 5.

15. Your rights

You have the right to access, rectify and erase your data, to restrict processing, to data portability, to object to processing based on legitimate interests, and to withdraw consent at any time with effect for the future. To exercise these rights, contact [email protected].

You can also lodge a complaint with a supervisory authority, in particular in the EU country where you live or work. Our lead authority is the Information and Data Protection Commissioner (IDPC), Floor 2, Airways House, Triq il-Kbira, Tas-Sliema SLM 1549, Malta, https://idpc.org.mt/.

16. Automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

17. Changes

We may update this policy when our services or the law change. The current version is always on this page.