Privacy Policy

Protecting your data when you shop in our online shop and when you contact us is important to us. Your personal data is processed in accordance with the General Data Protection Regulation (GDPR) and the national data protection provisions applicable to us. Below we explain how we handle your data.

1. Controller and data protection officer

Controller responsible for data processing:

Simon Lederer, trading as “BuyDigitalStuff”
Zugspitzweg 18
83533 Edling, Germany
Email: support@buydigitalstuff.com
Phone: +49 160 7768954

In our assessment, we are not obliged to appoint a data protection officer under Art. 37 GDPR in conjunction with Section 38 of the German Federal Data Protection Act (BDSG), as the relevant conditions (including the regular employment of at least 20 persons in the automated processing of personal data) are not met. For all questions regarding data protection, please use the contact details above.

2. Hosting and accessing the shop

Our online shop runs on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Nuremberg. A data processing agreement pursuant to Art. 28 GDPR is in place with Hetzner.

When you access our shop, the server necessarily processes your IP address, the date and time of access, the page requested and information about your browser and operating system in order to deliver the page to you. This data is processed only for the duration of the connection; we do not keep access logs containing your IP address. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in providing a functioning shop.

Protection against attacks. All requests to our shop and its services pass through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare fends off overload attacks and in doing so processes your IP address and the technical details of your request on our behalf; a data processing agreement pursuant to Art. 28 GDPR is in place with Cloudflare. Data may be transferred to the USA; Cloudflare is certified under the EU-US Data Privacy Framework, and the EU Commission's standard contractual clauses apply in addition. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in protecting the shop against attacks and overload. More information: https://www.cloudflare.com/privacypolicy/

Visitor statistics. To understand how our shop is used, we count page views with the open-source software Umami. We run Umami ourselves on the same servers as the shop; the data is not passed on to third parties. Umami does not set cookies and does not store anything in your browser. We record the page you visit and its title (without order numbers, access codes or appended parameters), the website you came from, your browser, operating system, device type, screen size and browser language, as well as the country, region and city derived from your IP address. We do not store your IP address itself: Umami combines it with technical information about your browser and a key that changes every month to form an identifier that groups page views within one month. It cannot be used to recognise you beyond that month. If your browser sends the "Do Not Track" signal, we record nothing. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in analysing how our shop is used and improving it. You can object to this processing (see section 7).

3. Cookies

Without your consent we use only technically necessary cookies without which the shop cannot function. We do not use advertising cookies, and no third-party audience measurement services are integrated. Our own visitor statistics work without cookies (see section 2). What we store only with your consent is described at the end of this section.

  • Shopping cart (“_medusa_cart_id”): stores your shopping cart, 7 days.
  • Cache (“_medusa_cache_id”): ensures that you see up-to-date content, 1 day.
  • Language (“bds_sprache”): stores a language you have chosen, 1 year; only if you change the language.
  • Security check (“cf_clearance”): set by Cloudflare only if it shows a browser check during unusual traffic; records for a short time that the check was passed.
  • Payment (“__stripe_mid”, 1 year; “__stripe_sid”, 30 minutes): set by our payment provider Stripe on the checkout page, and on the product page only once you start express checkout there by ticking the box, to detect and prevent card payment fraud. Stripe is not loaded there before that.

The legal basis is Section 25 (2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG), as these cookies are strictly necessary for the service you have requested, as well as Art. 6 (1) (b) and (f) GDPR.

  • Consent ("bds_einwilligung", 1 year): remembers whether you agreed to the review badge and to the referral source, each separately. Without it we would have to ask again on every page view.
  • Chat ("bds_chat", 1 year): remembers whether you agreed to the live chat. Without it we would have to ask again on every page change.

Not strictly necessary, and therefore only loaded after your consent, is the review badge in the footer: only after you agree does Trustami set a cookie ("trustamiwidgetcookie") and an entry in your session storage (see section 5 e).

Also only with your consent do we remember whether you came to us via a price comparison site. If you arrive via a link from idealo, we set a cookie ("bds_herkunft", 30 days) that contains nothing but the name of the site. If you place an order within that time, we note the site on your order. This lets us assess whether the cost of our listings on that site is worthwhile. The cookie contains no identifier that could be used to recognise you, and we do not transmit anything to the site. The legal basis is your consent pursuant to Section 25 (1) TDDDG and Art. 6 (1) (a) GDPR. You can withdraw it at any time with effect for the future: use "Cookie settings" in the footer of any page to bring the notice back, untick "Referral source" and choose "Save selection" (or "Decline all"). The cookie is then deleted.

Also not strictly necessary, and therefore only loaded after your consent, is the live chat: only when you open it and agree does it set a cookie and entries in your browser's local storage (see section 4 c).

4. Orders and contact

a) When you place an order

To process your order, we process your email address, name, country and the order details. We need the email address to provide the digital content, and the country among other things to calculate the VAT applicable in your country correctly. Only if you request an invoice do we additionally process your street, house number, postcode and city as a billing address. As we only provide digital content, no delivery address for shipping physical goods is required. The legal basis is Art. 6 (1) (b) GDPR (performance of a contract) and, where statutory retention obligations under tax and commercial law apply, Art. 6 (1) (c) GDPR.

We keep your data for as long as it is required to perform the contract. After that, its further processing is restricted, and it is deleted once the statutory retention periods (e.g. under commercial and tax law) have expired, unless you have expressly consented to further use. Shopping carts in which you have already entered your email address but not completed the order are deleted after 30 days.

If you order via express checkout (Apple Pay, Google Pay or PayPal), the respective payment service transmits your email address, name and billing address to us. Of these, we only take your email address, name and country into your order; we only store your street, house number, postcode and city if you explicitly request an invoice with express checkout, and then for that invoice. Otherwise we only request the address because the payment services do not transmit the country on its own. It remains stored with Stripe as part of the payment details (see Section 5 a).

b) Contacting us

If you contact us by email, via our contact form or by phone, we process your details in order to handle your enquiry. For the contact form these are your name, email address, your message and, if provided, the order number; we receive them as an email in our mailbox and do not store them separately. The legal basis is Art. 6 (1) (b) GDPR where the enquiry relates to a contract, and otherwise Art. 6 (1) (f) GDPR.

c) Live chat

Our shop offers a live chat. We run the software for it (Chatwoot) ourselves, on the same servers as the shop (see section 2); the contents of your conversation are not passed on to third parties.

The chat is only loaded once you open it and give your consent. As long as you have not done so, no chat script is present in the page and no request goes to our chat server. After your consent, the chat sets a cookie as well as entries in your browser's local storage in order to keep your conversation together across page changes; in doing so, your IP address and technical information about your browser are transmitted to our server.

We process the messages you send us and any details you provide voluntarily (such as your name or email address). The legal basis for storing data in your browser is your consent pursuant to Section 25 (1) TDDDG; for handling your enquiry it is Art. 6 (1) (b) GDPR where the enquiry relates to a contract, and otherwise Art. 6 (1) (f) GDPR. We delete conversations as soon as they are no longer needed to handle the matter; statutory retention obligations remain unaffected.

You can withdraw your consent at any time with effect for the future by deleting the cookies and storage entries set by the chat in your browser. You can also reach us by email at any time without the chat.

5. Disclosure of data and service providers used

We only pass on your personal data to third parties where this is legally permitted and necessary to perform the contract with you. We use the following service providers for this purpose.

a) Payment processing (Stripe)

Payments are processed by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. The payment details you enter during checkout are transmitted directly to Stripe; we ourselves do not receive complete card details. Stripe may also transfer data to Stripe, Inc. in the USA; Stripe, Inc. is certified under the EU-US Data Privacy Framework. The legal basis is Art. 6 (1) (b) GDPR. Further information: https://stripe.com/privacy

Apple Pay, Google Pay and PayPal. If you choose one of these payment methods, at checkout or via express checkout, Stripe processes the payment, and the respective provider additionally processes your data under its own responsibility: Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland (https://www.apple.com/legal/privacy/), Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (https://policies.google.com/privacy) or PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (https://www.paypal.com/legalhub/privacy-full). The provider receives the details required for the payment, including the amount and the payee. Where the providers transfer data to the USA, they rely on the EU-US Data Privacy Framework or standard contractual clauses. The legal basis is Art. 6 (1) (b) GDPR.

Protection against payment fraud. Stripe assesses every payment for fraud risk (among other things based on payment details, device characteristics and 3D Secure authentication) and informs us of the result. If Stripe rates a payment as elevated risk or flags it for review, we put the order on hold and decide ourselves, after a review by a human, whether to fulfil it or refund the amount; no decision based solely on automated processing within the meaning of Art. 22 GDPR takes place. The legal basis is our legitimate interest in protection against payment fraud (Art. 6 (1) (f) GDPR).

b) Hosting and automated delivery (Hetzner)

We use servers of Hetzner Online GmbH (see Section 2) to run the shop and to deliver the digital content automatically.

If you purchase a newly created platform account (e.g. Steam) from us, we provide you with a temporary email mailbox on these servers for the initial access. When you log into this mailbox on the website we provide, technically necessary data (e.g. IP address, time of login) is processed temporarily to ensure the functioning and security of the mailbox.

For downloads, we provide you with a personal download page. For your access we store only its period of validity, the number of downloads remaining and the related order, but no IP address and no information about your device.

The legal basis for this processing is Art. 6 (1) (b) GDPR (performance of a contract).

c) Sending emails (ALL-INKL.COM)

We send confirmation and delivery emails via the mail servers of ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider. The legal basis is Art. 6 (1) (b) GDPR.

d) Accounting (Lexoffice)

For our accounting we use the cloud-based accounting software of Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany (Lexoffice). The provider processes incoming and outgoing invoices and, where applicable, bank transactions in order to record invoices and prepare the financial accounts. Where personal data is processed in this context, this is done on the basis of our legitimate interest in the efficient organisation and documentation of our business transactions pursuant to Art. 6 (1) (f) GDPR. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.

e) Review badge (Trustami)

In the footer of our shop you can choose to display our review badge together with customer reviews. The provider is Trustami GmbH, Friedrich-Wilhelm-Str. 68, 12103 Berlin, Germany.

The badge is only loaded once you have given your consent. On your first visit we ask you about this in a notice at the bottom of the screen; there you decide on the badge and on the referral source (section 3) separately. As long as you have not agreed, no connection to Trustami is established and no data is transmitted there. After your consent, the widget is loaded from Trustami's servers; your IP address and technical information about your browser are transmitted to Trustami, and a cookie ("trustamiwidgetcookie") as well as an entry in your browser's session storage are set in order to control the display of the badge.

The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. You can withdraw your consent at any time with effect for the future: use "Cookie settings" in the footer of any page to bring the notice back, untick "Review badge" and choose "Save selection" (or "Decline all"). The badge will then no longer be loaded; cookies already set by Trustami can be deleted in your browser. Further information: https://www.trustami.com/datenschutz

We store your decision itself in a cookie ("bds_einwilligung", 1 year). Without it we would have to ask you again on every page view, so it is strictly necessary for the service you have requested (Section 25 (2) no. 2 TDDDG).

f) No disclosure to shipping providers

No physical goods are shipped; data is therefore not passed on to any transport or delivery company.

6. Your rights

You have the right:

  • under Art. 15 GDPR, to request information about your personal data processed by us, in particular about the purposes of processing, the categories of personal data, the categories of recipients, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the source of your data if it was not collected by us, and the existence of automated decision-making including profiling and, where applicable, meaningful information about its details, as well as whether your data is transferred to a third country or an international organisation and which appropriate safeguards pursuant to Art. 46 GDPR are in place;
  • under Art. 16 GDPR, to request without delay the rectification of inaccurate data or the completion of your data stored by us;
  • under Art. 17 GDPR, to request the erasure of your data stored by us, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims;
  • under Art. 18 GDPR, to request the restriction of the processing of your data, insofar as you dispute the accuracy of the data, the processing is unlawful but you oppose its erasure, we no longer need the data but you require it for the establishment, exercise or defence of legal claims, or you have objected to the processing pursuant to Art. 21 GDPR;
  • under Art. 19 GDPR, to be notified: if you have exercised the right to rectification, erasure or restriction of processing, we are obliged to communicate this to all recipients to whom the data concerned has been disclosed, unless this proves impossible or involves disproportionate effort. You have the right to be informed about these recipients;
  • under Art. 20 GDPR, to receive the data you have provided to us in a structured, commonly used and machine-readable format or to request its transmission to another controller;
  • under Art. 7 (3) GDPR, to withdraw any consent you have given to us at any time, with the effect that we may no longer continue the data processing based on this consent in the future; and
  • under Art. 77 GDPR, to lodge a complaint with a supervisory authority, usually the supervisory authority of your habitual residence, your place of work or our place of business.

7. Right to object

Where your personal data is processed on the basis of legitimate interests pursuant to Art. 6 (1) (f) GDPR, you have the right to object to the processing pursuant to Art. 21 GDPR on grounds relating to your particular situation, or where the objection is directed against direct marketing. In the latter case, you have a general right to object, which we will implement without you having to state a particular situation. If you wish to exercise your right of withdrawal or objection, an email to support@buydigitalstuff.com is sufficient.

Last updated: 9 October 2026