Privacy Policy

Who is responsible for your data

ATOMICKEYS LTD is the data controller for the personal data described in this notice. That means we decide why and how it is processed, and we are accountable for it.

We are not required to appoint a statutory Data Protection Officer, but a named member of our team is responsible for data protection and can be reached at the address above.

The short version

The rest of this notice sets out the detail. If anything is unclear, email privacy@atomickeys.com and we will explain it in plain language.

What personal data we collect

Data we do not collect

We do not deliberately collect special category data (such as data about health, race, religion, politics, sexual orientation or trade union membership), and we ask you not to send it to us. We do not collect criminal offence data. We do not knowingly collect data from children — see Children.

Why we use it and our lawful basis

Under the UK GDPR we must have a lawful basis for each use of your data. Ours are set out below.

Where we rely on legitimate interests, we have carried out a balancing assessment to satisfy ourselves that our interests do not override your rights and freedoms. You can ask us for a summary of that assessment at any time, and you have the right to object — see Your rights.

Marketing communications

We will only send you marketing emails where you have opted in, or where you have bought from us before and we are marketing similar products under the soft opt-in permitted by the Privacy and Electronic Communications Regulations 2003.

Every marketing email contains a one-click unsubscribe link. You can also opt out at any time by emailing privacy@atomickeys.com or by changing your preferences in your account.

Opting out of marketing does not stop service messages — order confirmations, key delivery, invoices, refund notices and security alerts. We must send those to fulfil the contract with you.

Who we share your data with

We do not sell your personal data and we do not share it with third parties for their own marketing. We do share it, on a need-to-know basis, with the categories of recipient below.

All processors act under a written contract that requires them to keep your data secure, to process it only on our instructions, and to delete or return it at the end of the engagement.

Third-party services embedded in the Site

• Google Fonts — typefaces are loaded from Google’s servers, which means your IP address is visible to Google when a page loads.
• Gravatar (Automattic) — may be used to display avatars where a comment or review is shown.
• Cloudflare Turnstile — a privacy-preserving bot check used on our forms in place of a traditional CAPTCHA.

We do not currently run Google Analytics, Meta Pixel, or any advertising or profiling tracker on the Site. If that changes, we will update this notice and, where the law requires it, ask for your consent first.

International transfers

Our servers are located within Europe. Some of our suppliers, however, operate globally, which means your data may be transferred outside the United Kingdom or the European Economic Area.

Where that happens, we make sure at least one of the following safeguards is in place:

• the country has been found by the UK government or the European Commission to provide an adequate level of protection;
• the transfer is covered by the International Data Transfer Agreement, the UK Addendum, or the EU Standard Contractual Clauses; or
• the recipient is certified under an approved framework such as the UK Extension to the EU–US Data Privacy Framework.

You may request a copy of the safeguards we rely on by writing to privacy@atomickeys.com.

How long we keep it

We keep personal data only for as long as we need it for the purpose we collected it for, plus any period we are required to keep it by law.

Where data is no longer needed but cannot easily be deleted from backups, we isolate it and stop actively using it until deletion is possible.

How we protect your data

We take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access, including:

• encryption of all traffic in transit using TLS;
• passwords stored only as salted hashes, never in readable form;
• a web application firewall and malware scanning on the Site;
• bot protection and rate limiting on login and checkout;
• a hidden administrator login path and restricted administrative access;
• role-based access, so staff see only the data they need;
• regular software and security updates, and monitored server backups.

No system is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner’s Office within 72 hours of becoming aware of it and, where the risk is high, notify you directly without undue delay.

Fraud screening and automated decisions

Because digital keys are delivered instantly and cannot be recovered once issued, orders are screened automatically for signs of fraud. The screening considers factors such as the country of the IP address compared with the billing address, the payment result, order value and patterns of previous activity.

A high-risk score may cause an order to be held for manual review or cancelled and refunded. Where a decision has a significant effect on you and is made solely by automated means, you have the right to ask for human review, to express your point of view and to contest the decision. Email privacy@atomickeys.com quoting your order number and a member of our team will look at it personally.

We do not carry out profiling for advertising purposes.

Cookies and similar technologies

We use a small number of cookies, mainly to keep your basket working and to keep you signed in. Full details of every cookie, its purpose and its lifespan are in our Cookie Policy, which also explains how to control them.

Your rights

Under the UK GDPR you have the following rights. They are free to exercise.

How to exercise them

Email privacy@atomickeys.com with the subject line “Data rights request”, telling us which right you want to use and, where relevant, which data you mean.

• We will respond within one month. If your request is complex we may extend this by up to two further months and will tell you why within the first month.
• We may ask for information to confirm your identity. This protects your data from being disclosed to someone else.
• Requests are free. We may charge a reasonable fee, or refuse, only where a request is manifestly unfounded or excessive — and we will explain our reasoning if so.

Children

The Site is not directed at children. You must be at least 18 to buy from us, or 16 or 17 with the consent of a parent or guardian.

We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, contact privacy@atomickeys.com and we will delete it promptly.

Links to other sites

The Site links to third-party platforms such as Steam, Epic Games Store and publisher websites. Those services have their own privacy policies and we are not responsible for how they handle your data. Please read their notices before providing personal data to them.

Changes to this notice

We review this notice regularly and will update it when our processing changes or the law requires it. The current version is always published on this page and the “last updated” date at the top shows when it last changed.

Where a change is significant — for example a new purpose for your data, or a new category of recipient — we will bring it to your attention by email or by a prominent notice on the Site before it takes effect.

Complaints

If you are unhappy with how we have handled your personal data, please tell us first at privacy@atomickeys.com. We take privacy complaints seriously and aim to resolve them quickly. Our escalation process is set out in the Complaints Policy.

You also have the right to complain to the supervisory authority at any time.

If you live in the European Economic Area, you may instead complain to the data protection authority in your country of residence.

Contact us about privacy