What personal data we collect, why we use it, who we share it with, and your rights over it.
INSTAKEYS LTD, a company registered in England and Wales (company number 17531546), whose registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom, is the controller of the personal data described in this policy. This means we decide how and why it is used, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
For anything about your data, contact us through our contact form or by email at [email protected].
Contact details: the email address you give us at checkout, where we send your codes and receipt, and your name and email address if you contact us.
Order details: the codes you buy, their values and prices, the currency, the date and your order number.
Payment details: these are collected and handled by our payment provider. We receive confirmation of your payment and limited details such as the type of card; we never receive your full card number.
Messages: what you write to us, through our contact form or by email, including any order number you give.
Technical data: your IP address, browser and device details, and the approximate country your connection comes from. Cloudflare, which delivers and protects our site, tells us that country; we use it to suggest a language and currency.
Cookie data: the choices our cookies store, described in our Cookie Policy.
To take your order, deliver your codes, send your receipt and help you with your order. Our basis is performing our contract with you.
To keep accounting and tax records. Our basis is our legal obligations.
To prevent fraud and misuse, and to keep our site and your payment secure, including the check our contact form uses to tell people from automated programs. Our basis is our legitimate interest in running a safe shop.
To answer your messages. Our basis is our legitimate interest in helping people who contact us, or performing our contract with you if your message is about an order.
To suggest a language and currency, and to show the cards available where you are. Our basis is our legitimate interest in showing you a relevant shop.
To set any optional cookies. Our basis is your consent, which you can withdraw at any time, as our Cookie Policy explains.
We don't sell your data, and we don't use it for advertising. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects on you.
Our payment provider, to take your payment and screen it for fraud.
Our gift card supplier, which receives the order details it needs to issue your codes.
Cloudflare, which hosts, delivers and protects our site. On our contact form, Cloudflare Turnstile reads signals such as your IP address and browser details to tell people from bots, as described in Cloudflare's Turnstile Privacy Addendum.
The companies that send our emails and provide our other IT services.
Professional advisers such as accountants and lawyers, and authorities such as HMRC or the police when the law requires it.
These companies act on our instructions under contracts that protect your data. If we ever sell or reorganise our business, your data may pass to the new owner under the same protections.
Some of these companies process data outside the UK, for example in the European Economic Area or the United States. When they do, we make sure the transfer is protected as UK law requires, for example by UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or the International Data Transfer Agreement or Addendum approved by the Information Commissioner.
Order and payment records: six years from the end of the financial year they relate to, because UK tax law requires it.
Messages to us: two years after we last replied, so that we can help you if the matter comes up again.
Cookies: for the periods given in our Cookie Policy.
After those periods, we delete the data or make it anonymous.
Our site is only served over encrypted connections, access to personal data is limited to the people who need it, and card details are handled only by our payment provider.
You have the right to a copy of your personal data, and to ask us to correct it, delete it, restrict how we use it, or send it to you or another organisation in a portable format. You can object to our use of it based on legitimate interests, and withdraw any consent you have given.
To use any of these rights, contact us through our contact form or by email at [email protected]. It is free, and we will reply within one month. We may need to check your identity first.
If you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.
Our shop is for adults. We don't knowingly collect data from anyone under 18.
We may update this policy from time to time. If we make important changes, we will tell you.