Template. This document is a starting point and is not legal advice. List your real processors and data locations, and have it reviewed for GDPR, UK GDPR and CCPA compliance as needed.
Who is responsible for your data
GamsBox, 33 E 1st St, New York, NY 10003, United States, is the controller of the personal data described in this policy. Contact: legal@gamsbox.com.
Data we collect
| Data | Examples | Where it comes from |
|---|---|---|
| Account data | Email, password (hashed), display name | You |
| Order data | Products bought, amounts, order history, delivery status | You and our systems |
| Payment data | Payment method type, last 4 digits, transaction ID | Our payment providers |
| Service data | Spotify account email you give us for an Upgrade | You |
| Support data | Messages, screenshots | You |
| Technical data | IP address, browser, device, approximate country | Your device |
We never receive or store your full card number. Payments are handled by PCI-DSS compliant providers.
Why we use it
| Purpose | Legal basis |
|---|---|
| Deliver orders and provide after-sales support | Performance of a contract |
| Take payments and prevent fraud | Contract and legitimate interest |
| Keep accounting and tax records | Legal obligation |
| Send order emails | Performance of a contract |
| Send offers and newsletters | Consent, which you can withdraw at any time |
| Improve the site with analytics | Consent (see our Cookie Policy) |
Who we share it with
We share data only with providers that help us run the service, for example:
- payment providers ([Stripe / PayPal / …]);
- hosting and email providers ([provider names]);
- customer support tools ([provider name]);
- analytics, only if you accept analytics cookies.
We do not sell your personal data.
International transfers
Some providers may process data outside your country. When data leaves the EEA or UK, we rely on adequacy decisions or Standard Contractual Clauses.
How long we keep it
- Account data: until you delete your account.
- Order and payment records: [X years], as required by tax law.
- Support messages: [24 months] after the ticket is closed.
- Technical logs: [90 days].
Your rights
Depending on where you live, you can ask to access, correct, delete or export your data. You can also object to or restrict some processing, and withdraw consent at any time. Email legal@gamsbox.com and we reply within 30 days.
You can also complain to your data protection authority.
Security
We use encryption in transit, hashed passwords, access controls and trusted providers. No system is perfectly secure. If a breach affects you, we will tell you as the law requires.
Children
GamsBox is not intended for people under 18, and we do not knowingly collect their data.
Changes
We will post any update on this page and change the “Last updated” date. If the changes are significant, we will also notify you by email.