Privacy
Policy.

The data controller is CardShouker Trading L.L.C S.O.C("Cardshouker", "we", "us"), a company licensed by the Department of Economy and Tourism (DET), Government of Dubai under trade licence No. 1565185, with registered office at Office 301, Al Satwa, Dubai, United Arab Emirates. For any privacy request, please contact contact@cardshouker.com.

• Identity & contact — first and last name, email, phone number, postal address, country, and any information you voluntarily share when filling a contact form, joining the marketplace waitlist, or instructing us on a transaction.
• Transaction & service data — details of cards or collections you ask us to source, authenticate, grade or sell, payment instructions, and shipment tracking information. Card payments themselves are processed by third-party payment service providers; we do not store full card numbers on our systems.
• Usage data — IP address, device type, browser, pages visited, referring URL, and approximate location. This data is collected through cookies and similar technologies (see our Cookie Policy).
• Identification documents — for high-value transactions or buy-back operations, we may be required to collect a copy of an ID document and proof of address to comply with UAE anti-money-laundering rules.

• to respond to your enquiries and provide our services;
• to source, authenticate, grade, store, insure, and dispatch cards on your behalf;
• to manage payments, refunds, and currency settlements (AED, USD, EUR, GBP, BTC);
• to comply with legal obligations, including tax, accounting, VAT, anti-money-laundering and customs requirements;
• to send you transactional communications about your orders or ongoing concierge engagements;
• with your consent, to send you editorial updates and information on new releases or marketplace launches;
• to operate, secure and improve cardshouker.com and protect against fraud or abuse.

We process personal data on the legal bases recognised under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, and, where applicable to residents of the European Economic Area or the United Kingdom, under the General Data Protection Regulation: performance of a contract or pre-contractual steps, compliance with a legal obligation, our legitimate interests in running and securing the maison, and your consent for marketing and non-essential cookies.

• Logistics — DHL Express and equivalent insured couriers for door-to-door delivery worldwide;
• Retail partner — Mister-8, our authorised retailer, when an order originates from its catalogue;
• Grading & authentication houses — PSA, BGS, CGC, TAG and equivalents, when we submit cards on your behalf;
• Service providers — hosting, analytics, payment processors, customer support tools, accountants and legal advisers, all bound by confidentiality obligations;
• Authorities — UAE government, customs, courts or regulators when required by law.

We never sell your personal data to third parties for advertising.

Cardshouker operates from the United Arab Emirates. Some of our service providers and recipients are located outside the UAE, including in the European Union, the United Kingdom and the United States. When we transfer personal data outside the UAE we rely on safeguards appropriate to the destination, such as adequacy mechanisms or contractual commitments, in line with the UAE Personal Data Protection Law.

We keep personal data only as long as necessary for the purposes for which it was collected and to comply with our legal obligations. Transaction records are typically retained for at least five years after the end of the financial year of the transaction, in line with UAE accounting and tax requirements. Marketing data is retained until you unsubscribe.

Subject to applicable law, you have the right to access, correct, delete, restrict or object to the processing of your personal data, to withdraw your consent at any time, and to receive your data in a portable format. To exercise any of these rights, please contact contact@cardshouker.com. We will reply within thirty days. If you are not satisfied with our response, you may lodge a complaint with the UAE Data Office or the data protection authority of your country of residence.

We implement reasonable technical and organisational measures to protect your data, including encryption in transit, access controls, segregation of environments, and staff confidentiality. No system is impenetrable; we will notify affected users and authorities without undue delay if a breach materially affects personal data, in accordance with applicable law.

Cardshouker is not directed at children under 18. We do not knowingly collect data from minors. If you believe a minor has provided us with personal data, please contact us so we can delete it.

We may update this policy from time to time. The version in force is the one published here, dated by its effective date. Material changes will be flagged via the website or by email when appropriate.