GDPR & Data Rights

1. Our role

For account and platform data, Spatial Regal Digital Ltd acts as a data controller. For data a merchant stores about their customers (order history, marketing lists), the merchant is the controller and MoonKart is a processor acting on their documented instructions under our Data Processing Addendum.

2. Your rights

• Access — obtain a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion where no overriding legal basis applies.
• Restriction — pause processing while a dispute is resolved.
• Portability — receive your data in a structured, machine-readable export.
• Objection — object to processing based on legitimate interests or direct marketing.
• Withdraw consent — where processing relies on consent, at any time.

3. How to exercise them

Self-service: Settings → Privacy in the admin offers export and account deletion. Otherwise email privacy@moonkart.online from your account address. We respond within 30 days (extendable by 60 for complex requests, with explanation). We may verify your identity before acting.

4. Data minimization & purpose limitation

We collect only what the feature requires, retain it no longer than documented, and never repurpose private content for advertising.

5. Sub-processors

Our current sub-processors provide hosting, content delivery, storage, database, and authentication services. A maintained list is available at moonkart.online/legal — subscribe there for advance notice of changes.

6. Processor commitments for merchants

• Processing only on your instructions.
• Confidentiality, security measures, and breach notification without undue delay.
• Assistance with data-subject requests within 10 business days.
• Deletion or return of data at the end of service.
• Audit information available on request.

7. Complaints

Contact privacy@moonkart.online first — we aim to resolve concerns directly. You also have the right to complain to your local supervisory authority.