Privacy policy
01Who controls your data
ALDERROCK LTD, trading as Keyterminus, is the controller of the personal data described here. We apply the UK GDPR and the Data Protection Act 2018 to customers in the United Kingdom, and the EU General Data Protection Regulation to customers in the European Union.
- Merchant
- ALDERROCK LTD, trading as Keyterminus
- Company number
- 17381132
- Registered office
- Dept 6984, 196 High Road, Wood Green, London, N22 8HH
- info@keyterminus.com
- Support hours
- Mon–Fri, 09:00–18:00 (GMT)
Write to info@keyterminus.com with any question about your data or to exercise your rights.
02What we hold
- Account: first and last name, email, phone number, date of birth, street, city, postcode and country, and your password, kept only as a one-way hash.
- Orders: the products you buy, billing address, contact details, your request for delivery straight after payment, the status of each key, and the payment result and transaction reference the payment provider sends us.
- Keys: the keys issued to you, stored encrypted. A key is decrypted only when you choose Reveal key, and we record when it was first revealed.
- Messages: what you send by email or through the contact form, including any order number, and for the form the IP address it came from.
- Saved keys: the products you save in your account.
- Newsletter: your email address, if you subscribe.
- Technical data: IP address, browser and device type and the pages requested, in server logs. Browser storage is listed in the Cookie policy.
03Card payments
We don’t store or process full payment card data. Every card payment is processed by our PCI DSS compliant payment provider.
You type your card details on the provider’s hosted page, not on our site. Payments are protected by 3-D Secure and Strong Customer Authentication (SCA), so your bank may ask you to approve a payment, for example in its app. We receive only the payment result and a transaction reference.
04Why we use it, and on what legal basis
| Purpose | Data | Lawful basis |
|---|---|---|
| Taking your order and issuing your keys | Name, email, phone (optional), billing address, products ordered, keys issued to you (stored encrypted) | Contract |
| Showing each key only to its owner | When each key was revealed in your account, and how often | Contract and legitimate interests |
| Running your account | Name, email, phone, date of birth, address, password (stored as a hash), orders, saved keys | Contract |
| Recording your request for delivery straight after payment | The wording you agreed to and when you ticked the box | Legal obligation |
| Confirming you are 18 or over | Date of birth | Contract and legitimate interests |
| Answering your messages and complaints | Name, email, order number, your message and the IP address it came from | Contract and legitimate interests |
| Refunds, chargebacks and fraud prevention | Order details, payment result, transaction reference, IP address | Legal obligation and legitimate interests |
| Refusing orders from restricted countries and territories | Billing country and address | Legal obligation |
| Accounting and tax | Order and refund records | Legal obligation |
| Newsletter, only if you subscribe | Email address | Consent |
| Keeping the site secure and running | IP address, browser and device type, pages requested, error logs | Legitimate interests |
06Transfers abroad
Our key distribution partner receives the product, the quantity and our own order reference, never your name, email, address or card details. When a service provider processes data outside the UK or the European Economic Area, we rely on an adequacy decision or standard contractual clauses (with the UK International Data Transfer Addendum for UK data).
07How long we keep it
- Order, payment and refund records: 6 years from the order, as accounting and tax law require.
- Your account: until you ask us to close it, or after 3 years with no sign-in or order. Order records then follow the rule above.
- Support messages and complaints: kept for 24 months after the last reply.
- Newsletter: until you unsubscribe.
08Your rights
You can ask us to:
- give you a copy of the personal data we hold about you;
- correct data that is wrong;
- delete data we no longer need or have no lawful basis to keep;
- restrict or stop using it, including where we rely on legitimate interests;
- hand over the data you gave us in a portable format.
You can also withdraw consent at any time, for example by unsubscribing or changing your cookie settings.
Email info@keyterminus.com to use these rights. We answer within one month, and may ask you to confirm your identity first.
You may complain to a supervisory authority: the Information Commissioner’s Office (ico.org.uk) in the United Kingdom, or in the European Union the data protection authority of the country where you live or work. We’d welcome the chance to sort it out with you first.
09Security
The site is served over HTTPS only and passwords are kept as one-way hashes. Only the people who fulfil orders and answer messages can reach customer data. Keys are encrypted at rest and shown only to the signed-in account that bought them; staff can’t see them in the admin area. Card details never reach our systems.
10Automated decisions
We don’t make decisions with legal or similarly significant effects on you by automated means alone. Your card issuer and the payment provider run their own automated fraud checks and may decline a payment; if that happens, contact us and we’ll look at the order.
11Age
The store is for adults, and we don’t knowingly collect data from anyone under 18. If you think someone under 18 has an account, email info@keyterminus.com and we’ll delete it.
12Changes to this policy
We update this policy whenever the way we use personal data changes. The date at the top shows the current version.