Privacy Policy

Depending on how you use the service, we collect:

• account details such as your name, email, and login-security data;
• billing and contact details, including address and telephone number;
• basket, order, product, delivery, refund, and support records;
• payment references, status, payer details returned by the payment provider, and fraud-review information;
• newsletter choices and communications with us; and
• technical and security data such as IP address, device/browser information, request logs, and error information.

PayPal handles payment credentials on its own systems. We do not receive your complete card number or PayPal password.

We receive data from you, from your browser when it communicates with our service, and from service providers involved in payment, delivery, email, security, and support. We may also receive an activation or transaction status needed to resolve an order issue.

We use personal data to:

• create and secure accounts;
• process payment, deliver keys, and maintain order history;
• provide customer support and handle refunds or disputes;
• detect fraud, abuse, security incidents, and duplicate payment;
• operate, diagnose, and improve the website;
• keep business, tax, and compliance records; and
• send marketing only where you have made the required choice.

Where a law requires a legal basis, we rely as appropriate on performance of a contract, compliance with law, our legitimate interests in operating and protecting the service, or your consent.

Newsletter signup is optional and is not selected by default. You may withdraw consent or opt out at any time by using the unsubscribe link in an email or contacting us. Service messages about accounts, security, orders, and refunds are not marketing.

We share only what is reasonably needed with:

• payment processors, including PayPal;
• email providers, including Mailjet;
• hosting, database, monitoring, and security providers;
• digital fulfilment suppliers where needed to supply or investigate a key;
• professional advisers, insurers, auditors, or potential transaction parties; and
• authorities or other parties where law, legal process, or protection from fraud requires it.

We do not sell personal data. Providers that handle data for us must do so for the relevant service and under appropriate controls.

We are based in Hong Kong and use service providers that may process data in other countries. Those countries may have different privacy laws. Where required, we use contractual or other appropriate safeguards and limit the data shared to the service being provided.

We keep data only for as long as needed for the purposes above. Account data is normally kept while the account is active. Support, security, and fraud records are retained for a period appropriate to the issue and any dispute period.

Hong Kong business and transaction records may need to be retained for at least seven years. When data is no longer needed, we delete it, anonymise it, or restrict it until deletion is possible.

We use technical and organisational measures intended to protect personal data, including restricted access, encrypted transport, and security monitoring. No internet service can guarantee absolute security. Use a unique password and contact us promptly if you suspect unauthorised account activity.

You may ask whether we hold personal data about you and request access or correction under Hong Kong's Personal Data (Privacy) Ordinance. Depending on where you live, you may also have rights to deletion, restriction, portability, objection, or withdrawal of consent.

Send a request to support@madgamekeys.com. We may need to verify your identity and may retain information that law requires us to keep. You may also complain to the privacy or consumer authority where you live, including Hong Kong's Privacy Commissioner for Personal Data.

We use essential cookies for secure sign-in and browser storage for your basket and display preference. Payment providers may set their own storage when their service is loaded. See our Cookie Notice for details and controls.

The service is not directed to children who cannot legally enter a purchase contract. A parent or guardian should place an order where local law requires their involvement.

We may update this policy when our services, providers, or legal obligations change. We will post the revised version here and update the date above. We will provide additional notice where a material change requires it.