Privacy policy | HodlChip

This policy explains what personal data HodlChip collects when you use hodlchip.com or buy from us, why we collect it, who receives it and what rights you have. We built the store to need as little personal data as possible.

In short: we collect your email address, your shipping address, an optional phone number and what you ordered, plus the payment details of your order. A customer account is optional: if you create one, we also keep your name, your sign-in details, what you save in it and its security log. We set no tracking cookies and use no analytics trackers or advertising pixels. We never sell your data, and apart from the service providers that work on our behalf, the only company that receives it is the carrier that delivers your parcel.

1. Who is responsible for your data

The controller responsible for your personal data is HodlChip, identified by the company details shown on our Legal notice. For any question about this policy or your data, email support@hodlchip.com.

2. What we collect and why

Data	Purpose	Legal basis
Order data: email address, name and shipping address, optional phone number, products ordered and shipping method	Processing and delivering your order, sending order and shipping updates, handling returns and warranty claims	Performance of a contract (Art. 6(1)(b) GDPR)
Payment data: coin, network, amount, deposit address and transaction ID of your payment, and any refund address you give us	Matching your payment to your order, and handling underpayments, overpayments and refunds	Performance of a contract (Art. 6(1)(b) GDPR) and our accounting obligations (Art. 6(1)(c) GDPR)
Messages you send us, including attachments such as photos	Answering your questions and handling your requests	Performance of a contract, or our legitimate interest in answering inquiries (Art. 6(1)(b) and (f) GDPR)
Account data, if you create an account: name, email address, password (stored only as an Argon2id hash), authenticator secret if you turn on two-step verification (stored encrypted), saved addresses, wishlist, saved PC builds and newsletter choice	Providing your account: sign-in, order history, saved addresses, a wishlist on all your devices and saved builds	Performance of a contract (Art. 6(1)(b) GDPR)
Account security data: the devices where your account is signed in (browser and operating system, IP address, approximate country, last activity) and a log of security events such as sign-ins, failed attempts and password changes	Protecting your account, showing you where it is used, and detecting and stopping abuse	Our legitimate interest in keeping accounts secure (Art. 6(1)(f) GDPR)
Newsletter: your email address and the details needed to manage your subscription	Sending the restock, release and price alerts you signed up for	Your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time
Technical data: IP address, browser type and the pages requested	Delivering the website, keeping it secure and protecting forms against abuse	Our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR)
Security check on the sign-in, sign-up and password reset forms (Cloudflare Turnstile): technical signals from your browser and your IP address	Telling people from automated programs that try to guess passwords or create fake accounts	Our legitimate interest in protecting accounts against automated attacks (Art. 6(1)(f) GDPR)

The phone number is optional and used only to help the carrier deliver your parcel. We do not collect card or bank details, because we do not accept them, and we do not use your data for profiling or advertising.

3. What we do not do

We never store a password in readable form, only salted hashes that cannot be turned back into the original, and we build no advertising or marketing profiles.
We set no tracking cookies and use no analytics trackers, advertising pixels or social media tracking.
We never sell your personal data, and never share it for marketing.
We never ask for your seed phrase, your private keys or remote access to your devices.

4. Cookies and browser storage

HodlChip sets no tracking cookies. To make the store work, some information is kept in your own browser, in its local storage on your device: your cart, your wishlist and comparison list, your recent searches and your choice of price display currency. A short-lived copy of exchange rates is kept in session storage, which your browser clears when you close the tab. This information stays on your device and is not used to track you, and you can delete it at any time in your browser settings.

If you sign in, we set one strictly necessary cookie that keeps you signed in. It holds a random identifier, cannot be read by scripts on the page, and only a hash of it is stored on our servers. It ends when you close your browser, or after 30 days without activity if you choose "Keep me signed in", and it is deleted when you sign out. While you are signed in, your wishlist is also kept in your account so that it follows you to your other devices. Signing out removes the wishlist copy and any saved checkout details from the device.

The security check on the sign-in, sign-up and password reset forms is Cloudflare Turnstile. It loads from Cloudflare only on those forms, in a separate frame, and Cloudflare uses the signals it collects to tell people from automated programs, not for advertising.

If a feature you use needs a cookie to work, such as keeping a checkout session secure, that cookie is strictly necessary, is used only for that purpose and is never used for tracking. Strictly necessary storage does not require consent.

5. Who receives your data

Carriers. To deliver your parcel, we give the carrier (DHL, DHL Express or TNT, as shown at checkout) your name, your shipping address, the parcel details and, if you provided it, your phone number. For shipments that cross a border, the information required for the customs declaration is passed to the customs authorities.
Service providers working for us. We use technical providers to host the website, send emails and run our payment system, and Cloudflare to deliver the website and run the security check on the sign-in forms. They process data only on our instructions and may not use it for their own purposes.
Password check. When you choose a new password, we check that it does not appear in known data breaches using the Pwned Passwords service (haveibeenpwned.com). Only the first five characters of a SHA-1 hash of the password are sent, which is not enough to reveal or rebuild it.
Authorities. We disclose data to public authorities only where the law requires it, for example to tax authorities.

We never sell your personal data.

6. International transfers

We ship from Germany to the countries listed on our shipping page. An order delivered outside the EU involves sending your delivery details to the destination country, to its customs authorities and to the carriers operating there. This transfer is necessary to perform our contract with you. Where a service provider processes data in another country, we rely on the safeguards required by applicable data protection law, such as adequacy decisions or standard contractual clauses.

7. How long we keep your data

Order and payment records are kept for as long as our accounting and warranty obligations require.
Messages are kept for as long as needed to handle your request. Messages about an order are kept with the order record.
Account data is kept while your account is open. You can delete your account at any time in Sign-in & security: your profile, addresses, wishlist, saved builds, signed-in devices and security log are erased at once. Your orders are kept as described above, without a link to an account.
Security data: signed-in devices are removed when you sign out or the session ends, and security log entries are deleted after one year.
Newsletter data is kept until you unsubscribe, which you can do at any time with the link in every newsletter email.
Technical data is kept only as long as needed for security and troubleshooting.

Data that we are not required to keep is deleted on request.

8. Blockchain payments are public

Crypto payments are recorded on public blockchains, where anyone can see them and nobody, including HodlChip, can change or delete them. A blockchain record does not show your name. We link your transaction to your order only in our own records, and we do not publish that link.

9. How we protect your data

We use technical and organizational measures appropriate to the risk, including encrypted https connections, access to personal data restricted to what each person needs for their work, and collecting as little data as possible in the first place. Accounts are protected by hashed passwords, optional two-step verification, limits on sign-in attempts and a security check against automated attacks, and we send no sign-in or password reset links by email. Every order gets its own payment address, and payment addresses are only shown on payment pages at hodlchip.com.

10. Your rights

Depending on where you live, and in particular if you are in the European Union, the European Economic Area or the United Kingdom, you have the right to:

access the personal data we hold about you and receive a copy of it
have inaccurate data corrected
have your data erased, unless we must keep it, for example for accounting or warranty purposes
restrict our processing of your data
receive the data you provided to us in a structured, machine-readable format
object to processing based on our legitimate interests
withdraw your consent at any time, for example by unsubscribing from the newsletter, without affecting processing that took place before
lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work

If you have an account, you can download your data and delete your account yourself, in Sign-in & security. To exercise any of your rights, you can also email support@hodlchip.com, ideally from the email address on your order and quoting your order number, so that we can confirm the request comes from you. We respond without undue delay and within the time limits set by law, which is one month under the GDPR.

If you live in the United States, including California: we do not sell your personal information or share it for cross-context behavioral advertising, and we will not treat you differently for exercising your privacy rights.

11. Children

Our store is not directed at children, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes to this policy

We may update this policy when our services or legal requirements change. The current version is always published on this page, with the date of the latest update.