Privacy Policy

1. Controller

The controller for the processing described here is:

• EasyMarket
• c/o GAM
• Pappelallee 64
• 10437 Berlin
• Germany
• Email: [email protected]

We are not required to appoint a data protection officer. Please send any question about your data to the address above.

2. Visiting the website

When you open a page, your browser sends data that our server and the content delivery network in front of it process to deliver the page: your IP address, the page requested, date and time, referrer, browser and operating system. This is necessary to operate the site securely and to defend against attacks (Art. 6 (1) (f) GDPR). Server log data is deleted or shortened after a few days.

The site is delivered through Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, as our processor. Cloudflare terminates the connection, filters attacks and caches content. Transfers to the USA are covered by the EU-US Data Privacy Framework and by standard contractual clauses. We also see aggregated traffic statistics from Cloudflare; they contain no data that identifies you.

The shop itself runs on a server we rent. Our hosting provider processes the data stored there on our behalf and only on our instructions, as a processor within the meaning of Art. 28 GDPR.

3. Customer account and orders

To create an account we process your email address, a password (stored only as a hash), your name if you give one, and the time of registration. You can also sign in with Discord; we then receive your Discord user ID, username, avatar and email address from Discord.

For an order we process the data of the order itself, the products, the price, the time, your payment status and the keys issued to you. The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR).

Invoices and the data behind them are kept for the statutory retention periods of up to ten years under tax and commercial law (§ 147 AO, § 257 HGB), legal basis Art. 6 (1) (c) GDPR. Data no longer needed for that is deleted when you close your account.

4. Payments

Payments are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. When you pay, you enter your payment details directly with Stripe; we never see your card number. We receive the payment status, the amount, the payment method and a transaction ID.

Stripe acts as an independent controller for fraud prevention and its own legal obligations. Stripe may transfer data to the USA under the EU-US Data Privacy Framework and standard contractual clauses. Stripe's own privacy policy is at https://stripe.com/privacy. The legal basis for passing your data to Stripe is the performance of the contract (Art. 6 (1) (b) GDPR).

5. Licence keys

Keys are issued and checked through the licence system Luarmor. For this we transmit the key and technical identifiers. When you use the key, Luarmor stores a hardware identifier (HWID) of your device so that a key runs on one device only, and it records when a key was last used. The legal basis is the performance of the contract and our legitimate interest in preventing the multiple use of a single key (Art. 6 (1) (b) and (f) GDPR).

You can have the hardware link reset through our support if you change device.

6. Free keys funded by advertising

If you obtain a free key, the unlock runs through the advertising network LootLabs. You leave our site, complete the steps there and come back with a confirmation. LootLabs processes your IP address and device data for its own purposes and as an independent controller; please read its privacy policy before using the free route.

On our side we store a one-way hash (SHA-256) of your IP address, the time and the status of the unlock, so that one unlock cannot be used repeatedly. We cannot read the original IP address from the hash. The legal basis is our legitimate interest in preventing abuse (Art. 6 (1) (f) GDPR). These records are deleted after a short period.

7. Using the script

While the script is running it sends us technical data so we can operate the service, show live statistics and find errors:

The legal basis is the performance of the contract for the key you use and our legitimate interest in a working, abuse-free service (Art. 6 (1) (b) and (f) GDPR).

While the script is connected for live announcements, the connection holds your Roblox user ID, session ID, place ID, script version and executor in memory only, for as long as the connection lasts. Nothing of that is written to a database.

Please do not put personal data of other people into fields the script sends to us, for example a nametag text or an error description.

8. Support and Discord

If you write to us by email, we process your message and your address to answer it (Art. 6 (1) (b) and (f) GDPR) and keep the correspondence as long as needed for the matter and for statutory retention.

We run a Discord server and use Discord for support tickets and for internal notifications, for example about new orders or error reports. Discord Netherlands BV and Discord Inc., 444 De Haro St., San Francisco, CA 94107, USA, are independent controllers for everything that happens on their platform; use of Discord is voluntary and governed by Discord's own privacy policy. Ticket transcripts we create are stored on our side for as long as needed to handle the request.

9. Emails we send

We send transactional emails: registration and email verification, password resets, order confirmations with the contract text, and key delivery. The legal basis is the performance of the contract and our legitimate interest in secure accounts (Art. 6 (1) (b) and (f) GDPR). Emails are sent through the mail server configured for this shop, acting as our processor.

10. Cookies and local storage

We only store information on your device where it is necessary for the service or where you have consented (§ 25 TDDDG).

You can change or withdraw your choice at any time through "Cookie settings" in the footer. Withdrawing does not affect the lawfulness of processing carried out before.

11. Google Analytics

Only if you consent do we load Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It helps us understand how the shop is used: pages visited, approximate location derived from the IP address, device and browser, and which purchases were completed.

Data may be transferred to Google LLC in the USA, covered by the EU-US Data Privacy Framework and standard contractual clauses. The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). You can withdraw it at any time in the cookie settings. Google's privacy policy is at https://policies.google.com/privacy.

12. Affiliate programme

If you take part in our affiliate programme or arrive through an affiliate link, we process the referral code, the time of the click and the resulting order, so that commissions can be calculated correctly. The legal basis is the performance of the contract with the affiliate and our legitimate interest in correct accounting (Art. 6 (1) (b) and (f) GDPR).

13. Security and administration

Changes made in the administration area are logged with the account, the action and the IP address, so that we can trace who changed what. The legal basis is our legitimate interest in the security and integrity of the shop (Art. 6 (1) (f) GDPR).

Traffic is encrypted in transit (TLS). Access to personal data inside our team is limited to what each role needs.

14. Recipients and third countries

We pass on personal data only where it is necessary and lawful: to our hosting provider, Cloudflare, Stripe, the licence system, the mail provider, and, if you use them, Discord and the advertising network for free keys. Processors are bound by agreements under Art. 28 GDPR. Where data reaches a third country, it is based on the EU-US Data Privacy Framework, on standard contractual clauses, or on your consent.

15. Minors

Our shop is not directed at children. You must be 18 to buy from us, and minors may only use the shop with the consent of their parent or legal guardian. Consent-based processing of the data of anyone under 16 requires that consent (Art. 8 GDPR). If you believe a child has given us data, tell us and we will delete it.

16. Your rights

You have the right to:

• access the data we hold about you (Art. 15 GDPR),
• have inaccurate data corrected (Art. 16 GDPR),
• have data erased (Art. 17 GDPR),
• have processing restricted (Art. 18 GDPR),
• receive your data in a portable format (Art. 20 GDPR),
• object to processing based on legitimate interests, on grounds relating to your particular situation (Art. 21 GDPR),
• withdraw a consent you gave, with effect for the future (Art. 7 (3) GDPR).

Write to the contact address above and we will answer within one month. You can also delete your customer account yourself in your account settings.

You have the right to lodge a complaint with a supervisory authority. The authority responsible for us is:

• Berliner Beauftragte für Datenschutz und Informationsfreiheit
• Alt-Moabit 59-61, 10555 Berlin, Germany
• https://www.datenschutz-berlin.de

17. Changes to this policy

We update this policy when our services or the legal situation change. The current version always applies, and the date below tells you when it was last revised.