Legal
Privacy Policy
Last updated 2026-10-29.
1. Who is responsible for your data
The controller for the personal data described in this policy is the private seller who runs Fogside as a hobby:
- Seller
- Fogside
- Email for privacy questions
- [email protected]
We have not appointed a data protection officer. Questions about this policy go to the email address above.
2. What this policy covers
This policy covers personal data we process when you visit Fogside, create or use an account, buy keys, or contact support. It explains this under the EU General Data Protection Regulation (EU) 2016/679 (GDPR). It does not cover what Valve does on Steam, what Behaviour Interactive does in the game, or what Stripe does as an independent controller. Those companies have their own privacy policies.
3. The personal data we process
3.1 Account data
If you create an account: your email address, a hash of your password (we never store the password itself), whether and when your email address was verified, and when the account was created and changed. To verify your email, reset your password or change your email address we also store a one-time link, in a form that cannot be read back, together with the new email address for an email change.
3.2 Order data
For every order: the order number, the items, regions, quantities and prices, the total, the currency, the email address the keys are sent to, the billing country, the order status and its history (for example paid, refunded or disputed), the amounts refunded, the reference numbers Stripe gives the payment and the checkout, the keys delivered to you (stored encrypted), the dates and times of these events, and the IP address used when the order was placed. If you are logged in, the order is linked to your account. The delivery email contains a link to the order page, and we store that link's secret code only in a form that cannot be read back.
3.3 Key reveal records
Your keys are hidden on the order page until you choose to reveal each one. When you reveal a key for the first time, we record the time, the IP address and the browser identification (user agent) used. Later reveals of the same key are also logged with the time, IP address and user agent.
3.4 Consent records
When you place an order we record which version of the Terms of Service you accepted, which version of the consent to immediate delivery you gave, whether you confirmed the EU region restriction, the time of each of these, and the IP address used. These are contract declarations, not consent to data processing under the GDPR.
3.5 Support data
If you open a support ticket: the subject, category, the order it concerns, your messages and our replies, the status of the ticket and when messages were sent. If you email us: your email address and the content of your messages and attachments.
3.6 Technical data
- A session identifier stored in a cookie, and the session data on our server that it points to: whether you are logged in, your cart, and a security token for forms. See the Cookie Policy.
- Rate-limit records that protect logins, registration, password resets, checkout and support from abuse. Each record is a one-way hash of a value such as your IP address or the email address entered, plus a time.
- Error and security logs, which can contain your IP address, the page you requested, and an email address or order number when an error relates to it.
3.7 Emails we send
We send only emails needed to provide the service: email verification, password reset, email change confirmations and security notices, order delivery (which contains a link to your keys, not the keys themselves), withdrawal receipts, and replies to your support tickets. We keep the record of when a delivery email was sent.
3.8 Payment details, name and billing address
We do not receive or store your card number or other full payment details. Stripe handles those on its payment page. Stripe also asks for your name and billing address and sends them to us with the payment confirmation. We use only the billing country, and it is the only part we store in our own systems. Your name and full billing address stay with Stripe as part of the payment record in our Stripe account. Apart from this, we do not collect your name unless you give it to us in a message or in a withdrawal statement.
4. Why we process it and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Create and run your account: log you in, verify your email, reset your password, change your email, show your order history and keys | Account data, order data | Contract, article 6(1)(b) |
| Take orders, take payment through Stripe, reserve and deliver keys, send the delivery email | Order data, and the name and billing address Stripe sends us (section 3.8) | Contract, article 6(1)(b) |
| Confirm the contract and your consent to immediate delivery on a durable medium | Consent records, email address | Legal obligation, article 6(1)(c), under lag (2005:59) om distansavtal och avtal utanför affärslokaler, 2 kap. 4 § |
| Keep proof of your consents and region confirmation, so that we can show the right of withdrawal ended and that the region restriction was accepted | Consent records including IP address | Legitimate interest, article 6(1)(f): establishing and defending legal claims |
| Keep evidence that a key was delivered and revealed, so that we can handle claims that a key did not work and prevent fraud | Key reveal records including IP address and user agent, order data | Legitimate interest, article 6(1)(f): establishing and defending legal claims and preventing fraud |
| Keep records of sales so that the income can be declared and shown to the Swedish Tax Agency | Order data including billing country | Legal obligation, article 6(1)(c), under Swedish tax law (skatteförfarandelagen (2011:1244)) |
| Answer support requests, handle complaints and claims for faulty keys | Support data, order data | Contract, article 6(1)(b), and legal obligation, article 6(1)(c), for statutory claims |
| Prevent fraud and payment abuse, handle chargebacks and payment disputes | Order data, consent records, IP address | Legitimate interest, article 6(1)(f): protecting the shop and its customers from fraud and defending claims |
| Keep the site secure, limit abusive requests, find and fix errors | Technical data | Legitimate interest, article 6(1)(f): running a secure and working website |
| Tell you about security events on your account, for example that your email address was changed or that someone tried to register with it | Account data | Legitimate interest, article 6(1)(f): protecting your account |
| Comply with orders from courts and authorities | The data the order concerns | Legal obligation, article 6(1)(c) |
You need to give us an email address, and Stripe the payment details it asks for, to buy from us. Without them we cannot take payment or deliver keys. An account is optional.
Where we rely on legitimate interest, we have weighed our interest against your privacy and only use the data that is needed. You can object to this processing, see section 11.
5. Where the data comes from
- From you, when you fill in forms on the site, place an order or contact us.
- From Stripe, after you pay: the email address you entered on the payment page, your name and billing address (we store only the country), the payment status, the amounts, Stripe's reference numbers, and later any refund or dispute.
- From your browser, automatically: your IP address and the requests it makes to the site.
6. Who receives your data
We do not sell personal data and we do not share it for advertising. We share it only with:
- Stripe (Stripe Payments Europe, Limited and Stripe Technology Europe, Limited, Ireland, and the Stripe group companies they use). Stripe runs the payment page and processes your payment. We send Stripe your order number, the items and amount, and your email address if you are logged in. You give Stripe your payment details and billing address directly. Stripe processes the payment for us, and for some purposes, such as fraud prevention, security and its own legal obligations as a regulated payment provider, Stripe acts as an independent controller under its own privacy policy.
- Our email provider, which sends our emails on our behalf. It receives your email address and the content of the email. Delivery emails contain a link to your order, not your keys.
- Hetzner Online GmbH (Germany), which hosts the website and database on servers in the EU on our behalf. All data described in this policy is stored there.
- Authorities and courts, such as the Swedish Tax Agency or the police, when the law requires it or when needed to establish or defend a legal claim.
- Professional advisers, such as an accountant, lawyers or a debt collection agency, when needed for their work and under a duty of confidentiality.
- Behaviour Interactive and Valve, only in cases of fraud or unjustified chargebacks, and only the information needed to block the keys concerned, such as the keys and the date of the order.
- A new owner of the shop, if the shop is sold or transferred. The new owner must handle the data as this policy describes.
Companies that process data on our behalf do so under a data processing agreement and only on our instructions.
7. Transfers outside the EU and EEA
Our hosting is in the EU. Stripe may process data in the United States and other countries outside the EU and EEA. For transfers to the United States, Stripe relies on the EU-U.S. Data Privacy Framework for its certified companies and on the European Commission's standard contractual clauses. If our email provider processes data outside the EU and EEA, the transfer relies on an adequacy decision by the European Commission or on the standard contractual clauses. You can ask us for information about these safeguards using the contact details in section 1.
8. How long we keep data
| Data | How long |
|---|---|
| Account data | Until you delete your account. |
| Accounts whose email address was never verified | Deleted 30 days after registration, unless a verification or reset link sent to the address is still valid. |
| One-time links for email verification, email change and password reset | They expire after 24 hours (60 minutes for password reset) and are deleted 7 days after they expire, or earlier with your account. |
| Paid orders, including refunded and disputed orders, with their consent records, key reveal records, IP addresses and delivered keys | Until the end of the seventh year after the calendar year in which the order was placed, so that the income can be shown to the Swedish Tax Agency. After that the data is deleted or anonymised. Orders are kept after you delete your account. |
| Orders that were never paid (cancelled, expired or failed) | 12 months, to prevent fraud and answer questions about payment attempts. After that the email address, IP address and account link are removed. |
| Support tickets and their messages | As long as your account exists. They are deleted when you delete your account. |
| Emails sent to our support address | As long as needed to deal with the matter and any claim connected to it, and no longer than three years after the matter is closed. |
| Rate-limit records | About 24 hours. |
| Session data on our server | Removed after 24 hours without activity. The session cookie itself is deleted when you close your browser. |
| Error and security logs | 90 days. |
| Records of actions our staff take on your order, for example resending a delivery email, entries in our audit log when you reveal a key (with the IP address and user agent), and withdrawal statements sent through the withdrawal form | As long as the order record. |
We may keep specific data longer if it is needed for an ongoing dispute, a claim or an investigation, but only until that matter is finished.
9. Deleting your account
You can delete your account in your account settings. This deletes your account data, your support tickets and their messages, and any unused one-time links. Your orders are not deleted, because we must keep them for tax records and may need them for claims. They stay in our records without a link to an account for the periods in section 8. After deletion you can still view your keys through the link in the delivery email, and we can resend that email to the address used for the order.
10. Security
The site is served over an encrypted connection. Passwords are stored only as strong one-way hashes. Keys are stored encrypted. Only our staff have access to the admin system, they must log in with two-factor authentication, and every time a staff member views a full key it is logged.
11. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy of it (article 15);
- have incorrect data corrected (article 16);
- have your data erased (article 17), except data we must keep by law, such as order records kept for tax purposes, or need to establish or defend a legal claim;
- restrict our processing, for example while we check whether your data is correct (article 18);
- receive the data you gave us in a structured, machine-readable format and have it sent to another controller (data portability, article 20), for data we process on the basis of the contract;
- object to processing based on our legitimate interest (article 21). We then stop, unless we have compelling legitimate grounds that override your interests, or need the data to establish or defend a legal claim.
12. How to use your rights
Email [email protected], preferably from the email address on your account or order so that we can confirm it is you. If we cannot, we may ask for information that shows you are the person the data is about. You can change your email address and password and delete your account yourself in your account settings.
We answer within one month. If a request is complex or we receive many requests, we may extend this by up to two more months and will tell you why within the first month (article 12(3)). Using your rights is free. If a request is clearly unfounded or excessive, we may refuse it or charge a reasonable fee (article 12(5)).
13. Complaints to the supervisory authority
If you think we handle your personal data incorrectly, please tell us first. You also have the right to complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), or to the supervisory authority in the EU country where you live or work (article 77).
- Name
- Integritetsskyddsmyndigheten (IMY)
- Postal address
- Box 8114, 104 20 Stockholm, Sweden
- Website
- www.imy.se
14. Automated decisions and profiling
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects (article 22), and we do not profile you. Our rate limits only slow down repeated requests for a short time. Stripe screens payments automatically for fraud under its own responsibility and may decline a payment. If that happens, you can contact us or Stripe.
15. No marketing
We do not send newsletters or marketing emails, and we do not use your data for advertising. The only emails we send are the ones listed in section 3.7.
16. Children
The shop is not meant for children. You must be at least 18, or have permission from a parent or guardian, to buy. We do not knowingly collect personal data from children under 13. If you believe a child has given us personal data, contact us and we will delete it unless the law requires us to keep it.
18. Changes to this policy
We update this policy when our processing changes and show the date of the latest change at the top. If a change significantly affects you, we tell account holders by email before it takes effect.