Privacy
Controller
Ronny Fischer · OverLKD Studio
An der Mehle 12b, 97295 Waldbrunn, Germany
support@overlkd.com
Orders and optional accounts
We process your email address, purchased products, amounts, language, payment and delivery status to fulfil your purchase and provide support (GDPR Article 6(1)(b)). Customer accounts are optional and additionally store an optional name, verified email address, language and consent preferences. Billing data is processed where needed for accounting and legal obligations (Article 6(1)(c)).
Electronic withdrawal
For a withdrawal declaration, we store your name, contract identification, email, declaration and receipt time, with support and delivery status. This enables processing and the legally required acknowledgement (GDPR Article 6(1)(b) and (c)). Our email provider delivers the acknowledgement. These records are retained for processing and evidence of compliance, then erased once statutory retention or necessary legal claims no longer require them. No customer account is required.
Press and creator keys
When we provide a press or creator key, we process the recipient name, email, game, allocation and delivery/access status to manage supply and prevent abuse (Article 6(1)(f)). Our email provider handles delivery. These records are kept only as needed for supply, support and necessary abuse evidence, then erased or anonymised unless statutory obligations require retention.
Sold through Link
For purchases labelled accordingly, Link processes order, contact, payment and tax data as an independent controller for the sale, tax handling, receipts and payment support. OverLKD receives order data needed for key delivery and product support. Deleting your OverLKD account does not delete a Link account or contractual records required there. Link privacy information and contact: https://link.com/privacy.
Payments
Stripe processes your payment. We do not store full card details. We receive payment references, amounts and status, together with required billing and tax information. Stripe processes data under its own privacy notice.
Sign-in, keys and email
Single-use email links verify your account and sensitive changes. Sessions and access links are protected. Transactional email supports fulfilment and account security. Promotional email requires your explicit consent (Article 6(1)(a)), which you can withdraw at any time.
Necessary cookies
A language cookie remembers your selection. Protected session cookies enable customer and administrator sign-in, with security functions to prevent misuse. Fonts are hosted locally. The store does not use advertising cookies. A necessary preference cookie (olkd_stats_pref, 90 days) remembers your choice about optional statistics.
Optional shop statistics
Only with your consent, we use a random statistics cookie (__Host-olkd_stats, up to 90 days) to connect visits and purchases in the same browser. The legal bases are GDPR Article 6(1)(a) and section 25(1) TDDDG. Our server stores a hashed browser identifier, consent time and version, public shop paths without URL parameters, timestamps, a referral category (such as Steam or Discord), approximate country derived from the connection, and an optional link to a checkout and its payment status. Statistics do not store IP addresses, browser fingerprints, full referrer URLs, names, email addresses or Steam keys. They are not used for advertising. A new visit starts after 30 minutes of inactivity. Visit data and purchase attribution are automatically deleted after at most 30 days; the browser identifier after at most 90 days. Reach counts consenting browsers, not uniquely identified people. You can decline or withdraw consent at any time using Privacy settings at the bottom of the page; this deletes statistics linked to this browser and stops further collection. Legally required order records are unaffected. The whole store remains usable without consent. Do Not Track and Global Privacy Control are respected.
Hosting and security
Our hosting, Cloudflare and email service providers process connection or delivery data needed to run the service. Security logs and abuse prevention serve our legitimate interest in protecting the service (Article 6(1)(f)). Steam keys are stored encrypted. External services such as Steam, Discord and social networks process data under their own rules when you visit them.
Cloudflare Turnstile
We use Turnstile from Cloudflare, Inc. (USA) to prevent automated abuse of email-link sign-in and registration, purchase recovery, support requests, the electronic withdrawal function and checkout. Cloudflare processes technical signals including IP address, browser identifier (User-Agent), TLS connection characteristics, site identifier and origin. Our purpose is protecting accounts, orders and email delivery (GDPR Article 6(1)(f)). Cloudflare also processes these signals as an independent controller to improve its bot detection. See the Turnstile privacy notice linked below for details.
Retention
We retain contractual and invoice records according to statutory retention obligations. Deleting a customer account therefore does not automatically delete all order records. Security and access data is retained only as long as needed for its purpose.
Your rights
You may request access, correction, erasure, restriction and data portability, and object to processing based on legitimate interests. You may withdraw consent for future processing at any time and complain to a data protection supervisory authority. Contact us at the address above; we verify your identity to protect your data.
Stripe Privacy · Cloudflare Privacy · Turnstile privacy notice · Main site privacy