Privacy Policy

This policy explains what personal data we process when you visit joltkeys.com, buy a game key or contact our support team, and what rights you have under the EU General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act.

1. Who is responsible for your data

The data controller is Romione OÜ (registry code 17578111), registered at Jõe tn 5, Kesklinna linnaosa, Tallinn, Harju maakond, 10151, Estonia, operating the online store joltkeys.com. For any privacy matter, write to privacy@joltkeys.com.

2. What data we collect

• Order data — your name, e-mail address, country, the products ordered, order number, order total and payment status.
• Payment data — payments are processed by our payment service provider. We receive only the result of the transaction and never store your full card number or security code.
• Account data — if you register: username, e-mail address, an encrypted password and your order history.
• Support and review data — the content of the messages you send us and any review you choose to publish.
• Technical data — IP address, browser and device type, pages viewed and referring page, collected through cookies and similar technologies (see our Cookies Policy).

3. Why we use it and on what legal basis

• To perform our contract with you (GDPR art. 6(1)(b)) — processing your order, delivering the key to your e-mail address, running your account and handling returns and support requests.
• To comply with legal obligations (art. 6(1)(c)) — accounting and tax records, which Estonian law requires us to keep for seven years.
• For our legitimate interests (art. 6(1)(f)) — preventing fraudulent orders and chargebacks, keeping the store secure, and improving how it works.
• With your consent (art. 6(1)(a)) — marketing e-mails and non-essential cookies. You can withdraw consent at any time, without affecting processing carried out before withdrawal.

4. Who we share it with

We never sell your personal data. We share it only with service providers who process it on our behalf and under a written agreement: our hosting provider, our payment service provider, our e-mail delivery provider, and the partners we rely on to fulfil digital orders. We may also disclose data where we are legally required to do so.

5. Transfers outside the EEA

Your data is processed inside the European Economic Area wherever possible. If a provider processes data outside the EEA, the transfer is covered by an adequacy decision of the European Commission or by the European Commission's Standard Contractual Clauses.

6. How long we keep it

• Order and accounting records — 7 years from the end of the financial year, as required by the Estonian Accounting Act.
• Account data — until you delete your account or ask us to delete it.
• Support correspondence — up to 3 years from the last message.
• Cookie data — for the lifetimes listed in our Cookies Policy.

7. Your rights

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw any consent you have given. To exercise any of these rights, write to privacy@joltkeys.com; we answer within one month.

If you believe we have handled your data unlawfully, you may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, info@aki.ee) or with the supervisory authority of your country of residence.

8. Security

The store runs over an encrypted HTTPS connection, passwords are stored hashed, and access to personal data is limited to the people who need it to do their job.

9. Children

Our store is not intended for children. You must have the legal capacity to enter into a contract in order to purchase from us.

10. Changes to this policy

We may update this policy as our services change. The current version and its date are always published on this page.