What personal data we collect, why we use it, who we share it with, and your rights over it.
KEYSTOP LLC, a limited liability company organized in Kentucky, USA, whose principal office is at 172 Trade St, Lexington, KY 40511, United States, is responsible for the personal data described in this policy. This means we decide how and why it is used. Where the EU General Data Protection Regulation (GDPR) or the UK GDPR applies, we are the controller of that data.
For anything about your data, contact us through our contact form or by email at [email protected].
Contact details: the email address you give us at checkout, where we send your codes and receipt, and your name and email address if you contact us.
Order details: the codes you buy, their values and prices, the currency, the date and your order number.
Payment details: these are collected and handled by our payment provider. We receive confirmation of your payment and limited details such as the type of card; we never receive your full card number.
Messages: what you write to us, through our contact form or by email, including any order number you give.
Technical data: your IP address, browser and device details, and the approximate country your connection comes from. Cloudflare, which delivers and protects our site, tells us that country; we use it to suggest a language and currency.
Cookie data: the choices our cookies store, described in our Cookie Policy.
Where the GDPR or a similar law applies, each use below also gives the legal basis we rely on.
To take your order, deliver your codes, send your receipt and help you with your order. Our basis is performing our contract with you.
To keep accounting and tax records. Our basis is our legal obligations.
To prevent fraud and misuse, and to keep our site and your payment secure, including the check our contact form uses to tell people from automated programs. Our basis is our legitimate interest in running a safe shop.
To answer your messages. Our basis is our legitimate interest in helping people who contact us, or performing our contract with you if your message is about an order.
To suggest a language and currency, and to show the cards available where you are. Our basis is our legitimate interest in showing you a relevant shop.
To set any optional cookies. Our basis is your consent, which you can withdraw at any time, as our Cookie Policy explains.
We don't sell your personal data, we don't share it for targeted or cross-context behavioral advertising, and we don't use it for advertising at all. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects on you.
Our payment provider, to take your payment and screen it for fraud.
Our gift card supplier, which receives the order details it needs to issue your codes.
Cloudflare, which hosts, delivers and protects our site. On our contact form, Cloudflare Turnstile reads signals such as your IP address and browser details to tell people from bots, as described in Cloudflare's Turnstile Privacy Addendum.
The companies that send our emails and provide our other IT services.
Professional advisers such as accountants and lawyers, and authorities such as tax agencies, courts or law enforcement when the law requires it.
These companies act on our instructions under contracts that protect your data. If we ever sell or reorganize our business, your data may pass to the new owner under the same protections.
We are based in the United States, and we and the companies above process data in the United States and other countries, whose data protection laws may differ from those where you live.
When data about people in the European Economic Area, the UK or Switzerland is transferred to a country without an adequacy decision, we protect it as those laws require, for example through the EU-US Data Privacy Framework, its UK Extension and the Swiss-US Data Privacy Framework where the recipient is certified, or through the European Commission's standard contractual clauses and the UK's equivalents.
Order and payment records: seven years after the order, as US tax and accounting rules require us to keep them.
Messages to us: two years after we last replied, so that we can help you if the matter comes up again.
Cookies: for the periods given in our Cookie Policy.
After those periods, we delete the data or make it anonymous.
Our site is only served over encrypted connections, access to personal data is limited to the people who need it, and card details are handled only by our payment provider.
Depending on where you live, you have rights over your personal data. Whatever the law where you live, we will consider any request below.
If you are in the European Economic Area, the UK or Switzerland, you have the right to a copy of your personal data, and to ask us to correct it, delete it, restrict how we use it, or send it to you or another organization in a portable format. You can object to our use of it based on legitimate interests, and withdraw any consent you have given.
If you live in a US state with a consumer privacy law, such as California, you have the right to know what personal information we collect, use and disclose, to get a copy of it, and to ask us to correct or delete it. You can also opt out of the sale of your personal information or its sharing for targeted advertising, although we do neither. We won't treat you differently for using these rights.
To use any of these rights, contact us through our contact form or by email at [email protected]. It is free, and we will reply within one month. We may need to check your identity first, and someone you authorize can ask for you if we can confirm they have your permission. If we turn down your request, you can appeal by replying to our answer, and we will tell you the outcome in writing.
If you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the data protection authority where you live or work, or where you think the problem happened. In the United States, you can contact your state's attorney general, or in California the California Privacy Protection Agency.
Our shop is for adults. We don't knowingly collect data from anyone under 18.
We may update this policy from time to time. If we make important changes, we will tell you.