Privacy

This policy explains what personal data Gamequay collects, why, who receives it and how long it is kept. The business that runs Gamequay, named at the foot of every page, is the controller of this data. For any question or request about your data, write to us through the contact form.

What we collect

• When you order: your email address, first and last name, billing address (street, city, postcode, country), phone number, the language you use, and what you bought and paid. We need these to take the payment, check the country of your cards and send you your order.
• When you create an account: your email address, your name, your password (stored only as a one-way hash, never readable), the language you use, whether you want news by email, and technical account records such as when the account was created, whether the email was confirmed and recent failed sign-in attempts.
• When you write to us: your name, email address, the topic, your order number if you give one, and your message.
• When you browse: the few cookies described in the cookie policy. We do not use analytics or advertising trackers.

Your IP address is used for a short time to limit repeated sign-in attempts, and it is passed to our payment provider with your payment to help prevent card fraud. We do not store it in our database.

We never see or store your payment card details: you enter them on the payment provider's page.

The gift cards, codes and other items we deliver to you are stored encrypted.

Why we use it

• To sell and deliver your order and handle refunds and support (performance of our contract with you).
• To keep accounting and tax records of sales (a legal obligation).
• To keep the shop and your account secure and to prevent fraud (our legitimate interest).
• To send you news, only if you ticked the box for it (your consent, which you can withdraw at any time in your account).

Who receives it

• Trezuz, our payment provider, receives your name, email, phone, billing address, IP address and the order amount, to process your payment.
• Hostinger hosts our server and our email in the European Union; your data is stored there and our emails to you are sent through it.
• Our card supplier receives no personal data from us. We do not pass it your name, email or address: a purchase request carries only the product, the value and the quantity.

We do not sell your data and do not share it with advertisers. We give data to authorities only when the law requires it.

How long we keep it

• Orders and payments: for as long as accounting and tax law requires us to keep sales records.
• Your account: until you ask us to delete it.
• Contact messages: as long as needed to answer you and to deal with any follow-up about the same order.
• Sign-in sessions end after at most 30 days; links we email you expire (account confirmation after 48 hours, password reset after 60 minutes, guest order link after 24 hours).
• Backups of the database are kept for 14 days and then overwritten.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to its use, and to receive it in a portable form. Write to us through the contact form from the email address you used with us; we answer within one month. Data we must keep for accounting is kept until that duty ends, and then deleted.

You can also complain to the data protection authority of the country where you live or work.

Changes

We update this policy when what we collect or who receives it changes. The date of the latest change is shown on this page.