This policy explains what personal data Keyotics processes when you use the store, why, and what rights you have under the EU General Data Protection Regulation (GDPR).
1. Controller
VYNEXERY LTD, Unit 13 Roding House, 2 Cambridge Road, Barking IG11 8NL, United Kingdom. Registered in England and Wales, company no. 17416854. Contact for privacy questions: privacy@keyotics.com.
2. What we process and why
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Email, order items, amount, billing country | Deliver keys, send the receipt, support | Contract, Art. 6(1)(b) | 10 years (tax law) |
| Payment data | Take payment. Card details go to Stripe, not to us | Contract, Art. 6(1)(b) | As required by Stripe and tax law |
| Billing country, country of your IP address, card country | Correct VAT for your country (EU VAT rules for digital services, Implementing Regulation 282/2011 Art. 24b) | Legal obligation, Art. 6(1)(c) | 10 years |
| Company name and VAT ID (business purchases) | Check the VAT ID in the EU VIES database, issue a reverse-charge invoice | Contract and legal obligation | 10 years |
| Consent records (text version, time, shortened hash of your IP address) | Prove what you agreed to at checkout and when you revealed a key | Legal obligation and legitimate interest, Art. 6(1)(c),(f) | 3 years after the order |
| Account: email, sign-in codes, session | Sign-in without a password, your order history and wishlist | Contract, Art. 6(1)(b) | Until you delete the account; codes 24 hours |
| Age verification result (verified yes/no, date, reference) | German youth protection law for games rated USK 18 | Legal obligation, Art. 6(1)(c) | Until you delete the account |
| Support messages and screenshots | Answer your request, replace keys | Contract / legitimate interest | 2 years after closing |
| Reviews and the name you choose | Show verified reviews | Consent, Art. 6(1)(a) | Until you ask us to remove it |
| Usage data (pages, funnel events) | Analytics with Matomo on our own EU server | Consent, Art. 6(1)(a) | 13 months |
| Viewed games and searches | Recommendations, stored only in your browser | Consent, Art. 6(1)(a) | Until you clear it |
| Email for deal alerts | Price drops on games you saved, only after you confirm by email (double opt-in) | Consent, Art. 6(1)(a) | Until you unsubscribe |
| Technical logs (IP address, browser, errors) | Security, preventing abuse and fraud, fixing errors | Legitimate interest, Art. 6(1)(f) | 14 days (error reports 90 days) |
3. Recipients
Hetzner Online GmbH, Germany (hosting of the store and its database), Stripe Payments Europe Ltd., Ireland (payments), Resend (transactional email: sign-in codes, receipts, support replies), Friendly Captcha GmbH, Germany (anti-bot check), our key distribution partner (to issue your key) and the European Commission’s VIES service (VAT ID checks for business purchases). Analytics data stays on our own Matomo server and is not shared. Where a provider processes data outside the EU/EEA, the transfer relies on the EU–US Data Privacy Framework or Standard Contractual Clauses.
4. Your rights
You can ask for access, correction, deletion, restriction and portability, and you can object to processing based on legitimate interest. You can withdraw consent at any time without affecting earlier processing. Write to privacy@keyotics.com; we answer within one month. You also have the right to complain to a data protection authority.
5. Automated decisions
We do not make decisions with legal effect based solely on automated processing. Recommendations are ranked by genre, platform and price in your browser. Orders can be held for a manual check when the country signals don’t match; a person reviews them.
Questions? Contact support