Privacy statement

Who is responsible

DoorDarius B.V., trading as FullSpeed Games, Paxtonstraat 3 N box C6618, 8013 RP Zwolle, Netherlands. Chamber of Commerce (KvK) 42101671. Privacy questions: hello@fullspeedgames.com.

Which data, for what and on what legal basis

• Order: name, email address, shipping and billing address, phone number (if you enter one), ordered products and amounts. To have your order printed and delivered and to communicate with you. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
• Payment: your payment details go directly to Stripe. We only see the payment method and status, not your full card details. Stripe checks payments for fraud. Legal basis: performance of the contract and our legitimate interest in preventing fraud (b and f).
• Account (optional): name, email address, password (stored hashed), addresses and order history. Legal basis: performance of the contract (b).
• Withdrawals, complaints and questions: what you send us. Legal basis: performance of the contract and legal obligations (b and c).
• Accounting: order and payment records we must keep for the tax authorities. Legal basis: legal obligation (c).
• Technical data: IP address and server logs at our hosting providers, for security and fixing faults. Legal basis: legitimate interest (f).

We make no decisions about you based solely on automated processing, except Stripe's fraud check on a payment.

Who we share data with

We do not sell your data. We only share it with service providers that process it for us:

• Printful (USA, with production in Europe and the USA): prints and ships your order. Receives your name, shipping address, email address or phone number for the carrier, and the ordered products. The carrier receives your name and address.
• Stripe Payments Europe Ltd. (Ireland): payments and fraud checks.
• Vercel Inc. (USA): hosting of the webshop.
• Contabo GmbH (Germany): the webshop's server and database.
• Resend (USA): sending emails such as the order confirmation.

Some of these providers process data in the United States. This is based on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

How long we keep data

• Order and payment records: 7 years, because of the tax retention obligation.
• Account: until you ask us to delete it. Your orders then remain only in our accounting records.
• Emails about questions, complaints and withdrawals: as long as needed to handle them, and then as long as the tax retention obligation or a possible dispute requires.
• Server logs: no longer than needed for security and fixing faults.

Cookies

We only use cookies the shop needs to work. These do not require consent.

• _medusa_locale: your language and country (1 year).
• _medusa_cache_id: makes sure you see current prices and stock (1 day).
• _medusa_cart_id: your shopping cart (7 days).
• _medusa_jwt: your login session (7 days).
• _medusa_pending_customer: only while you create an account (1 day).
• __stripe_mid and __stripe_sid: only at checkout, set by Stripe for fraud prevention (1 year and 30 minutes).

Security

The shop only works over an encrypted connection (HTTPS). Passwords are stored hashed, and only we have access to the admin environment.

Your rights

You may access, correct or delete your data, restrict its processing, object to it and receive your data in a common file format. Send your request to hello@fullspeedgames.com; we reply within one month. Data we are legally required to keep can only be deleted when that period ends.

If you disagree with how we handle your data, you can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or to the supervisory authority in your own country.

Changes

If the way we process data changes, we update this statement. The date of the current version is shown at the top.