Privacy Policy

This Privacy Policy explains how PRENKORO OÜ collects, uses, shares, retains and protects personal data in connection with prenkokeys.com, Accounts, Orders and support.

1. Controller and Contact Details

PRENKORO OÜ is the controller of personal data processed for operation of Prenkokeys, except where another party independently determines how and why it processes data.

Controller: PRENKORO OÜ · Registry code: 17555038 · Address: Harju maakond, Tallinn, Kesklinna linnaosa, Maakri tn 19/2, 10145, Estonia · Privacy contact: info@prenkokeys.com · Website: prenkokeys.com

2. Scope

This Privacy Policy applies when you visit the Website, create or use an Account, place an Order, receive a Digital Product, contact support, submit a complaint, exercise a privacy right or otherwise interact with Prenkokeys.

It does not govern independent processing by publishers, activation platforms, card issuers or other third parties whose services you choose to use. Their own privacy notices apply to their processing.

3. Personal Data We Collect

Account data

• email address, Account identifier, password hash or other authentication data;
• Account creation date, status, settings and security events; and
• country, currency and other information submitted or selected in the Account.

Order and product data

• Order number, date, Products, price, currency and fulfilment status;
• delivery records, including when a key or code was made available or emailed;
• activation or redemption-status information where available for support or fraud investigation; and
• records of accepted Terms, immediate-supply consent and withdrawal acknowledgement.

Payment data

• payment status, amount, currency, transaction reference and payment-method type;
• limited card-related information made available by the payment service, such as card brand or masked digits, where provided; and
• authentication, fraud and chargeback information relevant to the transaction.

Payment card details are handled through a third-party payment service. We do not ask Customers to send full card numbers or card security codes to support.

Technical and security data

• IP address, approximate country derived from network information, browser, device and operating-system information;
• session identifiers, authentication data, timestamps, Website requests and error logs; and
• signals used to detect bots, abuse, Account takeover, sanctions circumvention and payment fraud.

Communications

• support requests, complaints, refund requests, attachments and correspondence;
• verification information that is reasonably required to resolve a security or payment issue; and
• records of privacy requests and our response.

4. How We Obtain Personal Data

We obtain personal data directly from you, automatically from your device and Website activity, from payment and security service providers, and from technical suppliers involved in catalogue, order and key fulfilment. We may also receive information from a publisher or activation platform when necessary to verify whether a code was valid or previously redeemed.

We do not intentionally obtain personal data from data brokers for marketing and do not currently conduct direct marketing or behavioural advertising.

5. Purposes and Legal Bases

Account creation and management. We process Account and authentication data to create the mandatory Account, enable sign-in, maintain settings and provide order history. The legal basis is performance of the contract and steps requested before entering into a contract.

Orders, payment and delivery. We process Account, Order, payment-status, consent and delivery data to accept payment, fulfil Orders, send Digital Products, provide receipts, administer refunds and enforce the Terms. The legal basis is contract performance and, where applicable, compliance with consumer, accounting and tax obligations.

Customer support and complaints. We process communications and transaction records to answer questions, investigate invalid or used keys, resolve complaints and defend or settle claims. The legal basis is contract performance, legal obligation and our legitimate interests in resolving disputes and protecting legal rights.

Fraud, security and restricted territories. We process technical, Account, transaction, network and payment-risk data to secure the Website, prevent unauthorised payment use, identify Account takeover, enforce territorial restrictions and protect Customers and business partners. The legal basis is our legitimate interests in security and fraud prevention and, where relevant, compliance with legal obligations.

Legal and record-keeping obligations. We retain and disclose information where necessary to comply with accounting, taxation, consumer protection, sanctions, court, law-enforcement and other binding legal requirements. The legal basis is compliance with legal obligations and the establishment, exercise or defence of legal claims.

Consent. Where processing requires consent, we will request it separately and explain how it can be withdrawn. Withdrawal does not affect processing already carried out lawfully. We do not currently use consent for marketing, advertising or analytics because those activities are not currently conducted.

6. Whether Data Is Required

An email address, authentication information and the information necessary to process and verify payment are required to create an Account and place an Order. If you do not provide required data, we may be unable to create the Account, accept payment, deliver a Digital Product or provide a requested remedy.

Information requested for fraud or support verification is required only where reasonably necessary. We will explain the consequence of not providing it when making the request.

7. Payment Processing

Card payments are processed through a third-party payment service. That service may process payment-card information, authentication data, device and transaction information under its own legal obligations and contractual role. We receive the information needed to determine payment status, fulfil the Order, manage refunds and respond to disputes.

We do not name the payment provider in this Policy. The categories of recipient and purpose of disclosure are described so that Customers understand the processing. Any payment interface may provide its own privacy information where required.

8. Recipients of Personal Data

We disclose personal data only where necessary and subject to appropriate legal or contractual safeguards. Recipient categories may include:

• payment, card-authentication and fraud-prevention providers;
• hosting, cloud infrastructure, cybersecurity, email-delivery and customer-support providers;
• catalogue, distribution and Digital Product fulfilment suppliers;
• publishers or activation platforms where necessary to verify a key or resolve a Product problem;
• accountants, auditors, legal advisers, insurers and other professional advisers;
• banks, card networks and payment participants in connection with refunds or chargebacks;
• public authorities, courts, regulators and law-enforcement bodies where disclosure is legally required; and
• a purchaser, investor or successor in a genuine corporate transaction, subject to confidentiality and applicable law.

We do not sell personal data. We do not disclose Account or Order data to unrelated parties for their own direct marketing.

9. International Data Transfers

Some service providers or technical systems may process personal data outside Estonia or the European Economic Area. Where personal data is transferred to a country without an adequacy decision, we use an appropriate transfer mechanism required by law, such as the European Commission’s Standard Contractual Clauses, together with supplementary safeguards where necessary.

You may contact info@prenkokeys.com for information about the applicable transfer safeguards, subject to protection of confidential and security-sensitive information.

10. Retention

We retain personal data only for as long as necessary for the purpose collected, legal record-keeping, security and the establishment, exercise or defence of claims. In particular:

• Account and authentication data are retained while the Account is active and then deleted or anonymised when no longer needed, except for data linked to transactions, disputes, security incidents or legal obligations;
• accounting source documents, contracts and business records necessary to reconstruct transactions are retained for seven years from the end of the relevant financial year, or longer where a binding legal rule requires;
• Order, payment-status, delivery, consent and refund records are retained for the applicable accounting period and any additional period reasonably necessary to resolve or defend claims;
• support and complaint records are retained until the matter is resolved and for the applicable limitation period, unless earlier deletion is appropriate;
• security and technical logs are retained for a limited period based on security need, system integrity and incident investigation, and are kept longer only where associated with an identified incident or legal claim; and
• privacy-request records are retained for the period necessary to demonstrate compliance and handle related claims.

When retention expires, data is deleted, irreversibly anonymised or securely isolated until deletion from backups according to the applicable backup cycle.

11. Automated Fraud Signals

We may use automated rules or risk signals to flag an Order or Account for fraud, sanctions or security review. A flag may delay delivery or trigger a request for verification.

We do not intend to rely on solely automated decision-making that produces legal or similarly significant effects where the GDPR prohibits it. Where a decision is subject to Article 22 GDPR, you may request human intervention, express your point of view and contest the decision, subject to lawful fraud-prevention restrictions.

12. Your Data Protection Rights

Subject to applicable conditions and exceptions, you may have the right to:

• obtain confirmation whether we process your personal data and receive a copy;
• correct inaccurate or incomplete personal data;
• request deletion of personal data;
• restrict processing;
• object to processing based on legitimate interests;
• receive data you provided in a structured, commonly used and machine-readable format and transmit it to another controller where portability applies;
• withdraw consent at any time where processing is based on consent;
• request safeguards information for an international transfer; and
• complain to a competent data protection authority.

Rights are not absolute. For example, we may retain transaction data required by law even after Account deletion and may withhold information where disclosure would adversely affect the rights of others, security or legally protected confidentiality.

13. How to Exercise Your Rights

Send a request to info@prenkokeys.com from the Account email where possible. Clearly identify the right you wish to exercise. We may request proportionate information to verify identity and prevent disclosure to an unauthorised person.

We will respond within the period required by applicable law. GDPR requests are generally answered within one month, subject to a lawful extension for complex or numerous requests. We will explain any extension, refusal or permitted fee.

14. Account Deletion

You may request Account deletion by contacting info@prenkokeys.com or using an Account control if available. Deletion will remove or anonymise data that is no longer needed, but will not erase records that PRENKORO must retain for accounting, taxation, fraud prevention, unresolved disputes or legal claims.

Before deleting an Account, save any order information you need. Deletion does not recreate, deactivate or refund Digital Products already supplied.

15. Security

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss and destruction. Measures are selected according to the nature of the data and risk and may include access controls, authentication, encryption in transit, logging, monitoring, backups and supplier controls.

No internet service is completely secure. Customers must protect Account credentials and notify us promptly of suspected compromise. We will assess and notify personal-data breaches as required by law.

16. Children

Prenkokeys is available only to persons aged 18 or older. We do not knowingly offer Accounts or Products to children. If you believe that a minor has provided personal data, contact info@prenkokeys.com so that we can investigate and take appropriate action.

17. Transactional Communications and No Marketing

We send transactional and service communications necessary for Account security, Order confirmation, Digital Product delivery, payment status, support, complaints and material changes affecting an existing relationship.

We do not currently send promotional newsletters, use personal data for direct marketing, or use behavioural advertising. If this changes, we will update this Policy and obtain consent where required before beginning the new activity.

18. Cookies and Similar Technologies

The Website currently uses only cookies and similar technologies necessary for authentication, Account security, checkout, payment flow, delivery and essential preferences. We do not currently use analytics, advertising or marketing cookies. Further information appears in the Cookie Policy.

19. Complaints to a Supervisory Authority

You may complain to the supervisory authority in the EEA country where you live or work or where the alleged infringement occurred. PRENKORO’s lead national authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, email info@aki.ee, website aki.ee.

We encourage you to contact us first so that we can try to resolve the concern, but doing so is not a condition of lodging a complaint with an authority.

20. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in law, data use, suppliers, Products or Website functionality. The updated version will be published with a revised date. Where a change materially affects existing Customers, we will provide additional notice where required.

21. Contact

For privacy questions or requests, contact PRENKORO OÜ at info@prenkokeys.com or write to Harju maakond, Tallinn, Kesklinna linnaosa, Maakri tn 19/2, 10145, Estonia.