Privacy policy

ALDERROCK LTD, trading as Keyrook, is the controller of the personal data described in this policy. This policy applies to customers in the United Kingdom under the UK GDPR and the Data Protection Act 2018, and to customers in the European Union under the EU General Data Protection Regulation.

Merchant

ALDERROCK LTD, trading as Keyrook

Company number

17381132

Registered office

Dept 6984, 196 High Road, Wood Green, London, N22 8HH

Email

info@keyroook.com

Support hours

Mon–Fri, 09:00–18:00 (GMT)

For any question about your data or to use your rights, email info@keyroook.com.

• Account details: first and last name, email, phone number, date of birth, street, city, postcode and country, and your password, which we store only as a one-way hash.
• Order details: the products you buy, billing address, contact details, your request for immediate delivery, the delivery status of each key, and the payment result and transaction reference sent to us by our payment provider.
• Keys: the activation keys issued to you. We store them encrypted and decrypt a key only when you select Reveal key in your account. We record when a key was first revealed.
• Messages: what you send through the contact form or by email, including any order number, and for the contact form the IP address it was sent from.
• Saved items: products you save to your account.
• Newsletter: your email address, if you sign up.
• Technical data: IP address, browser and device type, and the pages requested, recorded in server logs. Browser storage is described in our Cookie policy.

We do not store or process full payment card data. All card payments are processed by our PCI DSS compliant payment provider.

You enter your card details on the provider’s hosted payment page, not on our website. Payments are protected by 3-D Secure and Strong Customer Authentication (SCA), so your bank may ask you to confirm a payment, for example in your banking app. We receive only the result of the payment and a transaction reference.

We share personal data only with service providers that process it on our behalf and under our instructions, and only the data each one needs:

• Card payments: takes card payments on its own hosted page and runs 3-D Secure checks.
• Key distribution partner: issues the activation keys you buy. It receives the product and quantity, never your name, email or card details.
• Website hosting and database: runs the store and stores account and order records, including your keys in encrypted form.
• Email delivery: sends order, account and support emails.

We may also disclose data where the law requires it, for example to tax authorities or the police, or to a card issuer when a payment is disputed. We do not sell personal data and do not share it with advertisers.

Our key distribution partner receives the product and quantity of each order and our own order reference. It does not receive your name, email, address or card details. Where a service provider processes data outside the UK or the European Economic Area, we use an adequacy decision or standard contractual clauses (with the UK International Data Transfer Addendum for UK data).

• Order, payment and refund records: 6 years after the order, for accounting and tax law.
• Your account: until you ask us to close it, or after 3 years without a sign-in or order. Order records are then kept as above.
• Messages and complaints: 24 months after the conversation ends.
• Newsletter: until you unsubscribe.

You have the right to:

• get a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have data deleted where we no longer need it or have no lawful basis to keep it;
• restrict or object to our use of it, including where we rely on legitimate interests;
• receive data you gave us in a portable format;
• withdraw consent at any time, for example by unsubscribing from the newsletter or changing your cookie settings.

Email info@keyroook.com to use any of these rights. We reply within one month. We may ask you to confirm your identity before we act on a request.

You can complain to a supervisory authority: in the United Kingdom, the Information Commissioner’s Office (ico.org.uk); in the European Union, the data protection authority of the country where you live or work. We would appreciate the chance to deal with your concern first.

The website is served only over HTTPS. Passwords are stored as one-way hashes. Access to customer data is limited to the people who need it to fulfil orders and answer messages. Keys are encrypted at rest and shown only to the signed-in account that bought them; our staff do not see them in the admin area. Card details never reach our systems.

We do not make decisions with legal or similarly significant effects about you by automated means alone. Your card issuer and our payment provider run their own automated fraud checks and may decline a payment. If that happens, contact us and we will look at the order.

Our store is for adults. We do not knowingly collect data from anyone under 18. If you believe a person under 18 has created an account, email info@keyroook.com and we will delete it.

We update this policy when the way we use personal data changes. The date at the top of the page shows the latest version.