Privacy Policy

This Privacy Policy explains what personal data KEY4GAMES collects when you use this website or buy from it, why we hold it, who else sees it, and what you can require us to do with it. We have kept it specific: it describes what this store actually does, not what a store of this kind might do.

1. Who is responsible for your data

The controller of the personal data described here is the company operating this store, whose registration details are set out below. For anything to do with your data — a question, a request, a complaint — write to legal@key4games.com.

We have not appointed a data protection officer. Requests are handled by the same team that runs the store.

2. What we collect

We collect the minimum a digital order needs. Concretely:

• Your name and email address. Entered by you at checkout. The email address is the delivery route for your key and the channel through which a manager arranges payment, so it is the one piece of data the order genuinely cannot work without.
• Your order. What you bought, the quantity, the price and currency, the order number, its status, and the key that was issued against it.
• Correspondence. The emails you exchange with us about an order, and any notes we add to that order while resolving a problem.
• Payment arrangements. Because payment is currently arranged manually, what we hold is a record that payment was agreed and confirmed. We do not collect or store card numbers, and this website has no card form. If you pay by bank transfer, your bank shows us the sender details on that transfer.
• Technical data. Your IP address, browser type and version, the pages you request and the time you request them. Our server writes this to its access and error logs automatically, as every web server does.
• Cookies. A small number of strictly necessary cookies, described in full in our Cookie Policy.

We do not ask for a delivery address — there is nothing to ship, and the checkout asks for no delivery address. We do not ask for a phone number. We do not collect any special category data (health, beliefs, biometrics and so on), and you should not send it to us.

3. Why we use it, and on what legal basis

Under the GDPR every use of your data needs a lawful basis. Ours are:

• To perform our contract with you — taking your order, arranging payment, obtaining and delivering the key, giving you access to your order, and handling refunds and replacement claims. Without this data we cannot deliver what you paid for.
• To meet our legal obligations — keeping the accounting and tax records the law requires us to keep, and responding to lawful requests from authorities.
• For our legitimate interests — keeping the site secure and available, investigating suspected fraud, chargeback abuse and repeated false claims, and diagnosing technical faults from server logs. We use the least data that achieves this, and we do not profile you.
• With your consent — only if you choose to opt in to something specific, such as a future newsletter. We do not currently run marketing emails, and we do not add order customers to a mailing list. Consent, if you ever give it, can be withdrawn at any time.

We do not sell your data, we do not rent it, and we do not share it with advertisers.

4. Who else processes it

Running the store requires a small number of service providers. Each acts on our instructions as a processor under a contract, and each sees only what its job requires:

• Our hosting provider — stores the website, its database and its logs, and therefore technically holds everything above.
• Our key supplier — receives the order reference and product identifier needed to issue a key. It does not receive your name or your email address.
• Our email delivery service — transmits order and delivery emails, and therefore handles your email address, your name and the message content, including the key.
• A payment processor — none today, because payment is arranged manually. When online card payment goes live, the processor will handle your payment data directly under its own privacy policy; we will still not receive or store your card number, and this section will be updated before the change takes effect.

Beyond these, we disclose data only where the law requires it, or where it is necessary to establish or defend a legal claim.

5. Transfers outside the EEA

Some of the providers above may process data outside the European Economic Area. Where that happens, the transfer is made only on a basis the GDPR permits: a European Commission adequacy decision covering the destination country, or Standard Contractual Clauses with the provider, together with any additional safeguards the situation requires. You can ask us which basis applies to a particular provider by writing to the address in section 1.

6. How long we keep it

Order and payment records are kept for as long as the applicable tax and accounting law requires us to keep them. That period is set by law rather than by us, and it means we cannot delete a completed order on request while the obligation is still running.

Server logs containing IP addresses are kept for a short operational period and then rotated out. Correspondence about an order is kept alongside that order. Data that is not tied to an order and not subject to a retention obligation is deleted once the reason we held it has passed, or earlier if you ask.

7. How we protect it

The site is served over HTTPS. Access to order data is limited to the people who need it to run the store, and administrative access requires an individual account and password. Keys are delivered to the email address on the order and shown on that order’s own page rather than published anywhere public.

No system is immune. If a breach occurs that is likely to put your rights at risk, we will notify the competent supervisory authority within 72 hours of becoming aware of it, and tell you directly where the law requires it.

8. Your rights

If you are in the EU or the EEA, the GDPR gives you the following rights over your data, and we apply them to everyone regardless of where they live:

• Access — a copy of the personal data we hold about you, and an explanation of what we do with it.
• Rectification — correction of data that is wrong or incomplete, such as a misspelled name.
• Erasure — deletion of your data, where we no longer have a lawful reason to keep it. Note the limit in section 6: a legal retention obligation overrides an erasure request for the records it covers.
• Restriction — a pause on processing while a dispute about accuracy or lawfulness is resolved.
• Portability — the data you gave us, in a structured, commonly used, machine-readable format, sent to you or to another controller.
• Objection — you can object to processing we base on legitimate interests, and we must stop unless we can show compelling grounds that override your rights.
• Withdrawal of consent — where processing rests on consent, you can withdraw it at any time, without affecting what was lawful before you did.

9. How to exercise them

Send your request to legal@key4games.com. Say which right you are exercising and include enough detail for us to find your records — the order number is usually enough, or the email address you ordered with.

We answer within one month. If a request is unusually complex we may extend that by up to two further months, and we will tell you within the first month if we do. There is no charge. If a request is manifestly unfounded or repetitive we may charge a reasonable fee or decline it, and we will explain why.

Because a key has real value, we may need to confirm that a request genuinely comes from the person who placed the order before we act on it. We ask only for what is needed to be sure.

10. Complaints

If you think we have handled your data wrongly, tell us first — most issues are a misunderstanding we can fix quickly. If you are not satisfied with our answer, you have the right to lodge a complaint with a data protection supervisory authority, either in the EU member state where you live or work, or where the alleged infringement took place. Contacting us first does not affect that right in any way.

11. Children

This store is not intended for children. We do not knowingly collect data from a child below the age at which they can consent to online services in their country. If you believe a child has ordered from us, write to us and we will delete the data we are permitted to delete.

12. Changes to this policy

We will update this policy when what we do changes — the payment processor section in particular will change when online payment goes live. The “Last updated” date at the top of this page shows when the current version took effect. Where a change materially affects your rights, we will make that clear rather than quietly editing the text.

13. Contact

Privacy questions and requests: legal@key4games.com. Questions about a specific order: orders@key4games.com, quoting the order number.

Who operates this store

This store is operated as a registered business. Company registration details are provided on request — write to legal@key4games.com and we will send them.