Privacy Policy

1. Overview & Scope

AtlasKeys ("we", "us", "our", or the "Platform") operates an escrow-protected global marketplace for digital game keys, activation software licenses, gift cards, and game currency vouchers. This Privacy Policy governs the processing of personal data collected when you access our website, create a user or seller account, execute digital escrow orders, or communicate with our support and arbitration teams.

We respect your privacy and are committed to complying with all applicable data protection regulations, including the European Union General Data Protection Regulation (EU GDPR), the UK General Data Protection Regulation (UK GDPR), and the California Consumer Privacy Act (CCPA/CPRA).

2. Information We Collect

To deliver automated instant delivery, secure escrow deposits, and maintain marketplace integrity against fraudulent chargebacks, we collect the following categories of data:

• Identity & Profile Data: Full name, username, email address, encrypted authentication password, linked OAuth credentials (Google, Discord, Apple, Steam), and optional profile avatars.
• Financial & Transactional Data: Order reference numbers, purchased product SKUs, total transaction amounts, billing address, currency selections, redemption timestamps, and masked payment tokens. AtlasKeys never stores raw credit/debit card numbers or CVVs; all payment instruments are tokenized by PCI-DSS Level 1 compliant processors (Stripe, PayPal, Cryptomus).
• Seller Verification & KYC Data: Government-issued photo identification (passport, national ID, driver's license), biometric liveness check results, proof of residential address, taxpayer registration numbers, business registration records, and verified withdrawal endpoints (IBAN, SEPA, Payoneer, USDT/TRC20 addresses).
• Technical & Telemetry Data: IP address, Internet Service Provider (ISP), device type, browser user-agent, operating system, approximate geographical location, referrer URLs, and fraud-detection browser fingerprint signals.
• Communications & Dispute Data: Support ticket histories, customer service live-chat transcripts, order dispute evidence (such as key activation error screenshots submitted during escrow arbitration), and public seller reviews.

3. Legal Bases for Processing (GDPR Article 6)

We only process your personal data where lawful grounds exist under European and international privacy frameworks:

4. How We Use Information

Your data is processed strictly for legitimate marketplace functions:

• Automating instant digital key retrieval and vault decryption upon order confirmation.
• Holding payments in buyer protection escrow until activation validity is verified or the 24-hour inspection window lapses.
• Mediating disputes between buyers and sellers with audit-logged evidentiary reviews.
• Monitoring high-risk transaction spikes, unauthorized login attempts, and credential stuffing vectors.
• Dispatching critical operational emails (receipts, two-factor authentication codes, dispute notifications, and cart recovery prompts).

5. Data Sharing & Third Parties

AtlasKeys has never sold, rented, or traded personal data to third-party data brokers, advertisers, or lead generators, and will never do so. We share data strictly with the following service providers bound by strict Data Processing Agreements (DPAs):

• Payment Gateways & Banking Rails: Stripe, PayPal, and Cryptomus for tokenized authorization and escrow settlement.
• Identity & Fraud Prevention Services: Certified automated KYC verification vendors and device risk screening networks.
• Infrastructure & Hosting: Enterprise cloud hosting providers with end-to-end hardware encryption and SOC2 certification.
• Counterparties in Transactions: When a purchase is executed, the merchant receives only the public buyer username, order identifier, and dispute dialogue. Merchants never receive buyer financial accounts or billing addresses.
• Law Enforcement & Legal Authorities: Disclosed only when compelled by valid judicial court orders, formal subpoenas, or statutory compliance mandates.

6. International Transfers

As a global platform, your data may be transferred to and maintained on cloud servers located outside your jurisdiction. Whenever personal data is transferred outside the European Economic Area (EEA) or the United Kingdom, we enforce Standard Contractual Clauses (SCCs) approved by the European Commission, along with supplementary technical safeguards including TLS 1.3 encryption in transit and AES-256 encryption at rest.

7. Retention & Anonymization

We retain personal information only as long as necessary to fulfill the purposes outlined in this policy:

• Active Accounts: Maintained for the operational lifespan of your account to ensure continued access to your purchased digital key library and transaction history.
• Tax & Financial Ledgers: Kept for 7 (seven) years from the transaction date to comply with corporate accounting, value-added tax (VAT), and regulatory reporting laws.
• KYC Verification Records: Retained for 5 (five) years following account termination in compliance with international AML statutory mandates.
• Technical Logs: IP and firewall connection logs are rotated and permanently purged after 90 days, unless flagged as part of an active security investigation.

8. Your Rights (GDPR & CCPA/CPRA)

Depending on your geographical residence, you possess enforceable privacy rights regarding your data:

• Right to Access & Portability: Request an export copy of all personal records and transaction logs stored in our databases in a structured JSON or CSV format.
• Right to Rectification: Correct inaccurate or incomplete profile details directly through your account dashboard or via support.
• Right to Erasure ("Right to be Forgotten"): Request the complete deletion of your account and personal data, subject to statutory AML and accounting retention exemptions.
• Right to Object & Restrict: Restrict or object to the processing of your personal data for direct marketing or based on legitimate interests.
• CCPA/CPRA "Do Not Sell or Share My Personal Information": AtlasKeys does not sell or share personal information for cross-context behavioral advertising. You can exercise opt-out rights directly without discrimination.

To exercise any of these rights, contact our Data Protection Officer at privacy@atlaskeys.com or submit a request through our Support Contact Center. We respond to all verified requests within thirty (30) calendar days without charge.

9. Data Security Safeguards

We employ state-of-the-art cyber defense protocols to guard your information against unauthorized access, loss, or manipulation:

• All account passwords are encrypted using high-cost Argon2id or Bcrypt cryptographic hashing algorithms.
• Mandatory two-factor authentication (2FA) is available for all buyer accounts and strictly enforced for merchant and administrator portals.
• Digital license keys held in seller storage vaults are encrypted using individual hardware-backed cryptographic keys.
• In the event of a confirmed security incident affecting your personal data, we will notify affected users and regulatory authorities within 72 hours in accordance with GDPR Article 33.

10. Minors & Children's Privacy

AtlasKeys is strictly designed and operated for individuals aged 18 and older, or minors aged 13 to 17 operating under the direct consent and supervision of a parent or legal guardian. We do not knowingly solicit or collect personal information from children under the age of 13. If we discover an account registered by an unsupervised minor under 13, all associated data and active orders will be immediately terminated and refunded.

11. Data Protection Officer

For questions, privacy grievances, or statutory compliance requests regarding this Privacy Policy, our designated Data Protection Officer (DPO) can be reached at:

AtlasKeys Data Protection & Legal Compliance Team
Email: dpo@atlaskeys.com
General Inquiries: privacy@atlaskeys.com
Postal Inquiries: AtlasKeys Legal Compliance Department, Data Protection Office