Note: This Privacy Notice will be published once actual controller information has been entered. The placeholders below must be replaced with real company details before this notice is made publicly effective.
1. Controller
The data controller responsible for your personal data is:
Name: [LEGAL_BUSINESS_NAME]
Organisation number: [ORGANISATION_NUMBER]
Address: [REGISTERED_BUSINESS_ADDRESS]
Email: [SUPPORT_EMAIL_ADDRESS]
Contact: [TELEPHONE_OR_DIRECT_CONTACT_METHOD]
2. What Personal Data We Process
Account information (registered customers)
- Email address
- Password (stored as a secure hash — we never see your password)
- Account creation date
Guest checkout information
- Email address (used to deliver your activation keys)
Order and payment metadata
- Order reference number
- Products purchased (title, edition, platform, region, quantity)
- Order total and currency
- Payment status (paid / unpaid)
- Stripe payment reference (we do not store card numbers)
- Order date and time
Legal consent record
- Confirmation that you requested immediate digital delivery
- Confirmation that you acknowledged loss of withdrawal right
- Confirmation that you verified product compatibility
- The exact wording of the checkboxes you confirmed
- The policy versions that applied at the time of your order
- Timestamp of acceptance
Digital delivery
- Activation keys (stored encrypted; decrypted only for email delivery)
- Delivery status and timestamps
Customer support
- Support correspondence
- Issue descriptions and resolutions
3. Legal Basis for Processing
- Contract performance: Processing your order, delivering activation keys, sending order confirmation and key delivery emails
- Legal obligation: Retaining order and consent records for bookkeeping and consumer law compliance
- Legitimate interests: Fraud prevention, security, system integrity
We do not rely on consent as a legal basis for processing your order data. The Privacy Notice is acknowledged, not treated as optional contractual consent.
4. Service Providers
We use the following third-party service providers:
Stripe
Payment processing. Stripe processes your payment card data. We receive only a payment reference and status. Stripe is PCI-DSS compliant.
Supabase
Database and authentication infrastructure. Your account data, order records and encrypted activation keys are stored in Supabase.
Resend
Transactional email delivery. Your email address and order details are passed to Resend to deliver your order confirmation and activation key emails.
Hosting infrastructure
The storefront is hosted on [HOSTING_PROVIDER]. Standard server logs may be retained for security purposes.
5. International Transfers
Some of our service providers may process data outside the European Economic Area. Where this occurs, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.
6. Retention
- Order records and consent records: Retained for [RETENTION_PERIOD] years for legal and bookkeeping obligations
- Account data: Retained until you request deletion, subject to legal retention requirements
- Support correspondence: Retained for [RETENTION_PERIOD] years
- Encrypted activation keys: Retained for [RETENTION_PERIOD] years for dispute resolution
7. Your Rights
Under applicable data protection law, you have the right to:
- Access your personal data
- Correct inaccurate data
- Request deletion (subject to legal retention requirements)
- Restrict processing
- Data portability
- Object to processing based on legitimate interests
To exercise your rights, contact us at [SUPPORT_EMAIL_ADDRESS].
8. Complaints
You have the right to lodge a complaint with the data protection supervisory authority in your country.