Privacy Policy
Version 1.0 — effective 10 November 2026
1. Controller and contact
The operator of cpapgerate.com and controller for the processing described here is ISL Trading, Sarah Brandvienhendler (שרה ברנדווינהנדלר), Licensed Dealer (עוסק מורשה) 051708246, Hibner 32, Petah Tikva, Israel (היבנר 32, פתח תקווה).
For privacy questions and to exercise your rights, contact us at [email protected] or [email protected], by telephone at +972-52-9509955, or at the postal address above.
Everyone has rights under Israel’s Privacy Protection Law, including Amendment 13. People in the EU and the European Economic Area (EEA) also have the rights under the General Data Protection Regulation (GDPR) described below.
2. The data we use and why
We receive data from you when you place an order, use an account, contact us, submit a review or voluntarily upload documents. If an order is delivered to another person, we receive their delivery details from the purchaser. Visits also generate technical data such as your IP address, browser and device information, pages viewed and access times.
| Data and purpose | GDPR legal basis, where applicable |
|---|---|
| Name, email, telephone, billing and delivery address, products ordered and order messages: processing and delivering your order, support and refunds. | Article 6(1)(b): contract and requested steps before entering into a contract. |
| Another person’s delivery details: carrying out the requested delivery. | Article 6(1)(f): legitimate interest in fulfilling the delivery request. |
| Account and sign-in data and order history: providing and securing your account. | Article 6(1)(b); for account security, Article 6(1)(f), the legitimate interest in protecting the account. |
| Payment reference, amount and payment status: payment processing and refunds. | Article 6(1)(b). |
| Contact enquiries, emails and chat messages: replies and customer service. | Article 6(1)(b) for contract-related enquiries; otherwise Article 6(1)(f), the legitimate interest in answering your enquiry. |
| Voluntarily uploaded prescriptions and titration reports: checking pressure settings or mask size for your order. | Article 6(1)(a) and Article 9(2)(a): explicit consent for health data. |
| Voluntarily submitted product reviews: publishing your review. | Article 6(1)(a): consent. |
| Technical data and server logs: operation and security of the shop. | Article 6(1)(f): legitimate interest in operating and protecting the shop. |
| Analytics and advertising measurement data: the measurement you choose under section 4. | Article 6(1)(a): consent. |
| Order, invoice and accounting records: meeting tax obligations. | Article 6(1)(c) for obligations under EU or Member State law; Article 6(1)(f) for the legitimate interest in meeting Israeli tax and bookkeeping obligations. |
Providing data is generally voluntary. Without the necessary order, contact and delivery details, we cannot process or deliver an order; without the necessary sign-in data, we cannot provide account access. Without a way to contact you, we cannot reply. Please provide only the information needed for your request. If you provide another person’s delivery details, please share this privacy policy with them.
3. Optional prescriptions and titration reports
No prescription is needed to order. Uploading a prescription or titration report is optional. We use these documents only to check pressure settings or mask size for your order. They are sent by email to [email protected].
These documents contain health data. We process them only with your explicit consent given in the upload form. You can withdraw consent at any time using either contact address in section 1. Withdrawal stops further consent-based processing and does not affect the lawfulness of processing before withdrawal. You can order without uploading anything. Please send only the information needed for the check.
The documents are deleted within 90 days after your order is completed, or immediately on request, unless a legal obligation requires longer retention. The general seven-year retention of accounting records does not apply to these health documents as a blanket rule.
4. Cookies, analytics, advertising and chat
Analytics and advertising are used only with your consent. You can choose the categories separately. The “Analytics” category includes Google Analytics 4 and Microsoft Clarity. Your choice is stored for 180 days in your browser’s local storage. You can change your choice or withdraw consent at any time through the “Cookie settings” link at the bottom of every page. Withdrawal deletes our analytics cookies. The lawfulness of earlier consent-based processing is unaffected.
| Category | Processing |
|---|---|
| Always on: shop and choice | Cart, checkout and sign-in storage needed for the service, and storage of your consent choice. Blocking this storage may affect these functions. |
| Always on: Chaport live chat | The chat widget sets a cookie to maintain the conversation. Messages you send in the chat are stored by Chaport. You can also contact us by email or telephone. |
| Analytics: only with consent | Google Analytics 4 (Google) measures use of the shop. Microsoft Clarity (Microsoft) records page interactions and session replays; input fields are masked. |
| Advertising: only with consent | Google advertising measurement through Google Tag Manager measures advertising effectiveness. |
| Always-on infrastructure: Cloudflare | Cloudflare provides CDN and security services. Cloudflare’s Web Analytics beacon is cookieless. |
Cookie and storage inventory
| Cookie or storage | Purpose and duration |
|---|---|
| _ga, _ga_<id> | Google Analytics; only with Analytics consent; up to 2 years. |
| _clck | Microsoft Clarity; only with Analytics consent; up to 1 year. |
| _clsk | Microsoft Clarity; only with Analytics consent; up to 1 day. |
| MUID, CLID | Microsoft cookies set by Clarity’s domains; only with Analytics consent. |
| _gcl_au | Google Ads; only with Advertising consent; up to 90 days. |
| chaport-<id> | Always-on chat cookie to maintain the conversation. |
| Consent choice in local storage | Always on; stores your choice for 180 days. |
| Cart, checkout and sign-in storage | Always on; supports the requested shop functions. |
A cookie’s lifetime differs from the retention period for analytics data in section 7. Another browser, another device or clearing browser storage may require a new choice.
5. Service providers and international processing
- Hosting: Our server is at Time4VPS, a hosting provider in Lithuania (EU). WordPress and WooCommerce run on this server.
- Payments: Card and PayPal payments are processed by PayPal. We never receive full card numbers.
- Email: Transactional emails are sent through Mailgun (EU region) and the server’s own mail system.
- Delivery: Shipping and fulfilment providers receive the order and contact details needed for delivery.
- Support and infrastructure: Chaport processes chat messages; Cloudflare provides CDN and security services.
- Measurement: Google and Microsoft process analytics and advertising measurement data in accordance with your consent.
Data is processed in Israel, in the EU for hosting, and by providers in the US, including Google, Microsoft, PayPal, Chaport and Cloudflare. The EU recognises Israel as providing an adequate level of data protection. For US providers, we rely on their standard transfer safeguards, such as the EU-US Data Privacy Framework or standard contractual clauses, as offered by each provider. You can request information about these safeguards using the contact addresses in section 1.
6. Abandoned-cart reminders
If you enter your email address at checkout and do not complete the order, we may send you a reminder about your basket. Every reminder contains an unsubscribe link. You can also ask us at any time, using either contact address in section 1, not to send further reminders. We stop sending and keep your address on a do-not-send list to honour your request. Cookie consent is not consent to email advertising.
7. Retention and security
The following maximum periods apply to each data category:
| Data | Retention |
|---|---|
| Orders, invoices and accounting records | Up to 7 years for tax obligations. |
| Customer accounts and saved recipient details | Until you request account deletion, or up to 3 years after your last order or sign-in, whichever comes first. |
| Contact-form and email enquiries | Up to 2 years. |
| Chat transcripts | Up to 12 months. |
| Abandoned-cart entries | Up to 30 days. |
| Product reviews | While published, or until you ask us to remove them. |
| Consent records, including upload consent | Up to 2 years after the relevant choice. |
| Do-not-send list | As long as needed to honour your request. |
| Google Analytics data | Up to 14 months. |
| Clarity recordings and aggregated data | Recordings up to 30 days; aggregated data up to 13 months. |
| Server logs | Up to 90 days. |
| Backups | Up to 6 months, then overwritten. |
| Prescriptions and titration reports | Up to 90 days after your order is completed; deleted immediately on request, unless the law requires longer retention. |
We use TLS on every page. Payment data is handled by PayPal. Access to shop data is limited to the people running the shop. We maintain backups.
8. Your rights and changes
Under Israel’s Privacy Protection Law, including Amendment 13, everyone can request access, correction, deletion where applicable, and object to direct marketing.
People in the EU and EEA also have GDPR rights to access, rectification, erasure, restriction of processing, portability, objection, withdrawal of consent and complaint to a competent data protection supervisory authority. You can also contact Israel’s Privacy Protection Authority. Rights are subject to the relevant legal conditions; certain accounting records must still be retained.
Send your request to [email protected] or [email protected]. We reply within 30 days and may verify your identity. You can withdraw consent at any time; for cookies, you can also use the “Cookie settings” link at the bottom of every page.
Changes to this privacy policy will be published on this page with an updated version and effective date.