1. Who is responsible

The controller for the processing of personal data in this shop is HighImpressions. Contact details are listed on our Company Info page.

2. What data we process and why

• Orders: email address, ordered products, order and payment status, and, where you provide them, further details at checkout. We need this data to deliver your order and to answer support requests (Art. 6(1)(b) GDPR).
• Customer account and tickets: your email address, login information and the messages you send us, to give you access to your orders and to help you (Art. 6(1)(b) GDPR).
• Payments: payments are handled by the payment provider you choose at checkout. We receive the payment status, not your full card or wallet details (Art. 6(1)(b) GDPR).
• Fraud prevention and security: technical data such as IP address, browser and device information, to protect the shop and our customers against fraud and abuse (Art. 6(1)(f) GDPR).
• Legal obligations: order and invoice records that we must keep under commercial and tax law (Art. 6(1)(c) GDPR).

3. Shop platform and service providers

Our shop runs on SellAuth, which hosts the shop, processes orders and sends order emails on our behalf. Payments are processed by the payment providers shown at checkout. These providers receive the data they need to perform their part of the service. Some of them may process data outside the European Union; where this happens, transfers are based on the safeguards provided by the GDPR, such as EU standard contractual clauses.

4. Cookies

We use cookies and similar technologies that are needed to run the shop, for example for the cart and your login. Optional cookies are only used if you allow them in the cookie banner. You can change your choice at any time via "Cookie settings" at the bottom of the page.

5. External links

Our shop links to external services such as our Discord server. When you follow such a link, the privacy policy of that service applies.

6. How long we keep data

We keep your data as long as it is needed for the purposes above. Order and invoice records are kept for the periods required by law, usually up to 10 years. Other data is deleted when it is no longer needed.

7. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests. To exercise these rights, open a ticket or contact us using the details on our Company Info page. You also have the right to lodge a complaint with a data protection supervisory authority.

8. Changes

We may update this privacy policy when our shop or the law changes. The current version is always available on this page.