1. Who is responsible for your information
Prime Keys is the legal operator and controller for personal information it decides to use in connection with the PrimeKeys storefront. Contact the privacy team at [email protected]. Komerza supplies the storefront API, order creation, checkout, and delivery infrastructure. Payment and fraud providers may separately control information they need to process transactions and prevent abuse.
2. Information we may collect
- Identity and contact data, including your email address and any name or contact information you provide to support.
- Order data, including products, variants, quantities, price, currency, coupon, delivery status, order reference, and refund history.
- Technical data, including IP address, browser and device information, timestamps, security signals, logs, and diagnostic events.
- Usage data, including pages viewed, referral information, basket activity, and interactions with the storefront.
- Support data, including messages, attachments, and troubleshooting information you choose to provide.
- Payment status and limited transaction details. Full card or wallet credentials are handled by the checkout and payment provider rather than this frontend.
Prime Keys does not intentionally request special-category information, government identifiers, passwords, or full payment credentials. Do not include them in support messages unless specifically required by law and requested through a secure channel.
3. Where information comes from
Information comes directly from you when you browse, add items to the basket, enter an email, place an order, or contact support. It can also come automatically from your browser or device, and from Komerza, payment providers, fraud prevention services, hosting providers, or affiliate links used in connection with your transaction.
4. Purposes and lawful bases
- To display products, maintain your basket, create an order, take payment, deliver digital content, and provide support. The usual basis is performance of a contract or steps requested before entering a contract.
- To prevent fraud, secure the storefront, diagnose failures, enforce terms, and improve reliability. The usual basis is the legitimate interests of protecting customers, Prime Keys, Komerza, and payment systems, balanced against your rights.
- To keep transaction, tax, accounting, sanctions, and dispute records. The basis is compliance with legal obligations or the establishment and defence of legal claims.
- To remember optional preferences, measure non-essential usage, or send optional marketing. The basis is consent where consent is legally required.
Where processing is based on consent, you may withdraw it at any time without affecting earlier lawful processing. This notice is intended to reflect the UK GDPR and Data Protection Act 2018 as amended, including applicable changes made by the Data (Use and Access) Act 2025.
5. Who may receive information
Information may be shared only as reasonably necessary with Komerza, checkout and payment providers, hosting and content delivery providers, security and fraud prevention services, communications and support platforms such as Discord, professional advisers, insurers, auditors, and public authorities where lawfully required. Providers are expected to use appropriate contractual, confidentiality, and security protections.
6. International transfers
Some providers may process information outside the United Kingdom or your country. Where restricted transfer rules apply, the responsible organisation should use an approved adequacy decision, contractual safeguards, or another lawful transfer mechanism and assess supplementary protection where required.
7. Retention
This frontend does not maintain its own customer database. Basket information stays in your browser until it is cleared or expires under the Komerza SDK. Komerza and payment providers retain order, checkout, payment-status, delivery, fraud, and dispute records under their own schedules and legal duties.
Prime Keys may retain order and financial records for up to six years where reasonably required for tax, accounting, contract, or legal-claim purposes, and longer only where a legal hold or specific duty applies. Support records are kept for the time needed to answer the request and then for a proportionate dispute or security period. Failed or abandoned enquiries should be deleted or anonymised when no longer needed. Retention decisions consider sensitivity, risk, purpose, limitation periods, legal duties, and whether the purpose can be achieved another way.
8. Security
Reasonable technical and organisational measures are used to protect information, including secure hosted checkout, encrypted transport, access controls, service monitoring, and limiting payment data handled by the storefront. No online service can guarantee absolute security. You should protect your email account, order links, licence keys, and device.
9. Your privacy rights
Depending on your location and the lawful basis, you may have rights to be informed, access your data, correct inaccurate data, erase data, restrict processing, object to processing, receive portable data, withdraw consent, and challenge qualifying automated decisions. The right to object to direct marketing is absolute. Other rights can be limited where an exemption or competing legal duty applies.
Email [email protected] and provide enough information to identify the relevant records. Prime Keys may request proportionate verification and will respond within the period required by law, normally one month for UK data-rights requests unless a lawful extension applies. You may also complain to the UK Information Commissioner's Office at ico.org.uk, or to the privacy regulator where you live.
10. Children
The storefront is not directed to children who cannot lawfully enter the relevant contract or provide valid consent. A parent or guardian should contact support if they believe a child supplied personal information without appropriate permission.
11. Required and optional information
A valid delivery email and order information are required to create and fulfil a purchase. If you do not provide them, checkout and delivery cannot be completed. Coupon information, optional support details, and non-essential cookie choices are voluntary. Marketing is not sent by this frontend unless a separate valid opt-in is obtained.
12. Automated decisions
Payment and fraud providers may use automated signals to approve, review, or refuse transactions. Prime Keys does not knowingly make solely automated decisions through this frontend that produce legal or similarly significant effects. If a provider makes such a decision, its notice should explain the logic, significance, consequences, and any right to human review. Contact [email protected] if a transaction is placed under review.
13. Security incidents
Prime Keys will assess suspected personal-data breaches and work with Komerza or relevant providers. Where law requires it, the responsible controller will notify the ICO or another regulator and affected individuals. Report suspected compromise promptly to [email protected]. Do not include exposed credentials in the initial message.
14. Changes and contact
This notice may be updated when services, providers, or legal requirements change. Material changes will be highlighted where appropriate. Contact [email protected] for privacy questions and do not post personal or payment information publicly.