The controller of the personal data described here is the company operating this store, whose registration details are set out in section 14. For anything to do with your data — a question, a request, a complaint — write to legal@key4games.com.

We have not appointed a data protection officer. Requests are handled by the same team that runs the store.

We collect the minimum a digital order needs. Concretely:

• Your name and email address. Entered by you at checkout. The email address is the delivery route for your key, your order notices and any support about the payment.
• Your order. What you bought, the quantity, the price and currency, the order number, its status, and the key that was issued against it.
• Correspondence. The emails you exchange with us about an order, and any notes we add to that order while resolving a problem.
• Payment records. The order amount, currency, payment method, payment status and a transaction reference. We do not receive or store your full card number or security code.
• Technical data. Your IP address, browser type and version, the pages you request and the time you request them. Our server writes this to its access and error logs automatically, as every web server does.
• Cookies and optional analytics. Necessary store cookies and, only after explicit opt-in, limited Google Analytics 4 usage data, described in full in our Cookie Policy.

We do not ask for a phone number. We do not collect any special category data (health, beliefs, biometrics and so on), and you should not send it to us.

Under the GDPR every use of your data needs a lawful basis. Ours are:

• To perform our contract with you — taking your order, arranging payment, obtaining and delivering the key, giving you access to your order, and handling refunds and replacement claims. Without this data we cannot deliver what you paid for.
• To meet our legal obligations — keeping the accounting and tax records the law requires us to keep, and responding to lawful requests from authorities.
• For our legitimate interests — keeping the site secure and available, investigating suspected fraud, chargeback abuse and repeated false claims, and diagnosing technical faults from server logs. We use the least data that achieves this, and we do not profile you.
• With your consent — only if you choose to opt in to something specific, such as a future newsletter. We do not currently run marketing emails, and we do not add order customers to a mailing list. Consent, if you ever give it, can be withdrawn at any time.

Running the store requires a small number of service providers. Each acts on our instructions as a processor under a contract, and each sees only what its job requires:

• Our hosting provider — stores the website, its database and its logs, and therefore technically holds everything above.
• IPinfo, our country lookup provider — receives the visitor’s IP address when a new session needs a default country. We use only the returned country code to show region-compatible store and payment options; WooCommerce caches a successful result for up to 24 hours.
• Our key supplier — receives the order reference and product identifier needed to issue a key. It does not receive your name or your email address.
• Our email delivery service — transmits order and delivery emails, and therefore handles your email address, your name and the message content, including the key.
• Our payment provider — processes your payment. We receive the result and a transaction reference, not your full card number or security code.

Beyond these, we disclose data only where the law requires it, or where it is necessary to establish or defend a legal claim.

Some of the providers above may process data outside the European Economic Area. Where that happens, the transfer is made only on a basis the GDPR permits: a European Commission adequacy decision covering the destination country, or Standard Contractual Clauses with the provider, together with any additional safeguards the situation requires. You can ask us which basis applies to a particular provider by writing to the address in section 1.

Order and payment records are kept for as long as the applicable tax and accounting law requires us to keep them. That period is set by law rather than by us, and it means we cannot delete a completed order on request while the obligation is still running.

Server logs containing IP addresses are kept for a short operational period and then rotated out. Correspondence about an order is kept alongside that order. Data that is not tied to an order and not subject to a retention obligation is deleted once the reason we held it has passed, or earlier if you ask.

The site is served over HTTPS. Access to order data is limited to the people who need it to run the store, and administrative access requires an individual account and password. Keys are delivered to the email address on the order and shown on that order’s own page rather than published anywhere public.

If you are in the EU or the EEA, the GDPR gives you the following rights over your data, and we apply them to everyone regardless of where they live:

Send your request to legal@key4games.com. Say which right you are exercising and include enough detail for us to find your records — the order number is usually enough, or the email address you ordered with.

We answer within one month. If a request is unusually complex we may extend that by up to two further months, and we will tell you within the first month if we do. There is no charge. If a request is manifestly unfounded or repetitive we may charge a reasonable fee or decline it, and we will explain why.

Because a key has real value, we may need to confirm that a request genuinely comes from the person who placed the order before we act on it. We ask only for what is needed to be sure.

If you think we have handled your data wrongly, tell us first — most issues are a misunderstanding we can fix quickly. If you are not satisfied with our answer, you have the right to lodge a complaint with a data protection supervisory authority, either in the EU member state where you live or work, or where the alleged infringement took place. Contacting us first does not affect that right in any way.

This store is not intended for children. We do not knowingly collect data from a child below the age at which they can consent to online services in their country. If you believe a child has ordered from us, write to us and we will delete the data we are permitted to delete.

We will update this policy when what we do changes. The “Last updated” date at the top of this page shows when the current version took effect. Where a change materially affects your rights, we will make that clear rather than quietly editing the text.

Privacy questions and requests: legal@key4games.com. Questions about a specific order: orders@key4games.com, quoting the order number.

Key4Games is operated by LUDVIA LTD, a company registered in England and Wales.

Company

LUDVIA LTD

Company number

17398924

Registered office

1 Kings Avenue, Winchmore Hill, London, N21 3NA, United Kingdom

Contact

legal@key4games.com