Privacy policy

Template notice for the site owner: replace the bracketed placeholders with your registered details, confirm the list of processors matches the services you actually run, and have this reviewed before you begin trading.

1. Who controls your data

The data controller is [LEGAL ENTITY NAME], [REGISTERED ADDRESS]. For any privacy question, or to exercise a right described below, write to admin@tzagg.net.

2. What we collect

• Account data. Your email address, username, and password, which is stored only as a cryptographic hash.
• Order data. What you bought, when, the amount, your order number, and the billing details required for tax and invoicing.
• Payment data. Card payments are processed by Stripe and PayPal on their own systems. We receive a confirmation, the last four digits, and the card type. We never receive or store your full card number.
• Support and request data. Anything you send us by email or through the request form, including the game title and any link you provide.
• Technical data. IP address, browser and device type, and pages visited, collected in server logs and used for security, fraud prevention, and diagnosing faults.

3. Why we use it, and our legal basis

• To take payment, deliver your download, and provide your account. Basis: performance of our contract with you.
• To keep tax and accounting records. Basis: a legal obligation.
• To prevent fraud, abuse, and unauthorised sharing of download links, and to keep the site secure. Basis: our legitimate interest in protecting the store and its customers.
• To answer support messages and game requests. Basis: performance of our contract, or our legitimate interest in responding to enquiries.
• To send marketing email, where you have opted in. Basis: your consent, which you can withdraw at any time using the unsubscribe link.

4. Who we share it with

We share personal data only with service providers acting on our instructions, and only as far as they need it: our hosting provider, Stripe and PayPal for payment processing, our email delivery provider, and, where enabled, our analytics provider. We do not sell personal data. We may disclose data where the law requires it or to establish or defend a legal claim.

5. International transfers

Some providers process data outside your country, including in the United States. Where data leaves the UK or the European Economic Area, transfers are covered by an adequacy decision or by standard contractual clauses.

6. How long we keep it

Order and invoice records are kept for [NUMBER] years to meet tax law. Account data is kept while your account is open and for a short period afterwards. Support messages are kept for two years. Server logs are kept for [NUMBER] days. When a retention period ends, data is deleted or anonymised.

7. Your rights in the UK and EEA

Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or send it to another provider in a portable format. You can object to processing we carry out under legitimate interests, and withdraw consent at any time where consent is the basis. We answer within one month. If you are unhappy with our response you can complain to your national supervisory authority.

8. Your rights in California

Under the CCPA and CPRA, California residents can request the categories and specific pieces of personal information we have collected, ask us to delete it, ask us to correct it, and opt out of any sale or sharing of it. We do not sell or share personal information as those terms are defined in that law, and we do not use sensitive personal information for inferring characteristics. We will not discriminate against you for exercising these rights. Send requests to admin@tzagg.net.

9. Cookies

We set cookies that are strictly necessary for the cart, checkout, and login to work. These cannot be switched off without breaking the store. Any analytics or marketing cookies are set only after you agree, and you can change your choice at any time through the cookie settings link in the footer.

10. Security

The site is served over HTTPS, passwords are stored hashed, and access to order data is restricted to staff who need it. No system is perfectly secure, so we also keep the amount of data we hold to the minimum the store needs.

11. Children

The store is not intended for children under 16 and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes

If we change this policy we will update the date at the top of the page, and tell you by email if the change materially affects your rights.