Kardu

Privacy Policy

Last updated: September 2026

1. Data controller

The data controller for personal data collected through kardu.eu is Kardu, a company based in the European Union. For any privacy-related queries, you can contact us at contact@kardu.eu.

2. Data we collect

We collect only the data strictly necessary to provide the service:

  • ✓Email address, when you book a Kardu Foundation conversation or contact us.
  • ✓Platform usage data, to improve the product (no personal identification).
  • ✓Anonymous, aggregated website browsing data (page views, scroll depth, click heatmaps and Core Web Vitals performance metrics), only if you accept anonymous analytics. We do not build person profiles or identify you.
  • ✓Billing data, only if you subscribe to a paid plan.

We only collect browsing data anonymously and in aggregate, and only if you accept analytics. We do not install advertising cookies, and we do not sell or share your data with third parties for advertising purposes.

3. Legal basis for processing

The processing of your data is based on the following legal grounds under the GDPR:

  • ·Performance of a contract — to provide the service you have requested.
  • ·Legitimate interest — to improve the product using aggregated and anonymised usage data.
  • ·Consent — for anonymous web analytics (PostHog) and sending product communications, revocable at any time.

4. Where your data is stored

All data is stored on servers located within the European Union. Our web analytics (PostHog) uses its EU instance. We never transfer personal data outside the European Economic Area. We do not use services subject to the US CLOUD Act for storing customer data.

5. Cookies

Kardu uses strictly necessary technical cookies (session management, language preferences) and, only with your consent, anonymous analytics cookies (PostHog). We do not use advertising cookies or analytics tools that identify individual users. You can manage your consent at any time from our cookie policy.

6. Your rights

As a data subject, you have the following rights under the GDPR:

  • ·Access — request a copy of the data we hold about you.
  • ·Rectification — correct inaccurate or incomplete data.
  • ·Erasure — request the deletion of your data.
  • ·Portability — receive your data in a structured, machine-readable format.
  • ·Objection — object to processing based on legitimate interest.
  • ·Restriction — request restriction of processing in certain circumstances.

To exercise any of these rights, write to us at contact@kardu.eu. We will respond within a maximum of 30 days.

7. Changes to this policy

We may update this policy occasionally. We will notify you by email if the changes are significant. The date of the last update will always be visible at the top of the document.

8. Contact

For any queries relating to this policy or the processing of your personal data, you can contact our privacy team at contact@kardu.eu.