Last updated: 17 August 2026  •  Effective from: 17 August 2026

This Privacy Policy explains how GAMEDRP LTD (“Gameodrop”, “we”, “us”, “our”) collects, uses, shares and protects personal data when you visit gameodrop.com, create an account, or buy digital game keys and gift cards from us.

1. Scope of this policy

This policy applies to all personal data we process as a controller in connection with our website, our customer accounts, our order and delivery process, and our customer support and marketing activities. It does not apply to third-party websites or platforms that you reach from our site — for example Steam, Xbox, PlayStation Store, Nintendo eShop, Epic Games or Ubisoft Connect — each of which operates under its own privacy policy.

2. Personal data we collect

2.1 Data you give us

• Account data — email address, username, password (stored only as a salted hash), display name.
• Order and billing data — name, billing address, country, email address, phone number where provided, order history, order notes.
• Payment data — we do not store full card numbers. Card and wallet details are captured and processed directly by our payment service providers. We receive only a transaction reference, the payment method type, the last four digits of the card and the authorisation result.
• Support data — the content of messages you send through our contact forms, by email or through any support channel, including any attachments and screenshots.
• Marketing data — your email address and preferences if you subscribe to our newsletter.

2.2 Data we collect automatically

• Technical data — IP address, browser type and version, operating system, device type, screen resolution, language and time-zone settings, referring URL.
• Usage data — pages viewed, products viewed, items added to basket or wishlist, search terms used on our site, session duration, clicks.
• Cookie data — identifiers stored in cookies and similar technologies. See our Cookies Policy for the full list and for how to change your choices.
• Security data — records of login attempts, bot-protection challenge results, and signals used to detect fraudulent orders.

2.3 Data we do not want

We do not ask for and do not need special category data (such as health, religious or political data). Please do not include such information in support messages or order notes.

3. Why we use your data and our lawful bases

Purpose	Data used	Lawful basis
Creating and managing your account	Account data	Performance of a contract
Processing your order and delivering game keys or gift card codes	Order, billing and payment data	Performance of a contract
Taking payment and handling refunds and chargebacks	Order and payment data	Performance of a contract; legal obligation
Providing customer support and handling complaints	Support, account and order data	Performance of a contract; legitimate interests
Preventing fraud, key resale abuse and unauthorised access	Technical, security and order data	Legitimate interests; legal obligation
Keeping accounting, tax and VAT records	Order and billing data	Legal obligation
Sending our newsletter and offers	Marketing data	Consent (withdrawable at any time)
Measuring how the site is used and improving it	Usage and cookie data	Consent (analytics cookies)
Personalising recommendations and advertising	Usage and cookie data	Consent (marketing cookies)
Keeping the website secure, available and correctly configured	Technical and security data	Legitimate interests

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You may object to that processing at any time — see section 9.

4. Cookies and similar technologies

We use strictly necessary cookies to run the basket, checkout, login sessions and bot protection. These do not require consent. Analytics and marketing cookies are set only if you accept them in our cookie banner. You can change or withdraw your choice at any time using the Cookie settings link in the footer of every page. Full details are in our Cookies Policy.

5. Who we share your data with

We do not sell your personal data. We share it only with the categories of recipient listed below, and only to the extent needed for the purpose shown.

• Payment service providers — to authorise and settle payments, process refunds and investigate chargebacks. They act as independent controllers for the payment data they collect.
• Key supply partners and digital distributors — including Kinguin, to source and issue the specific licence key or gift card code for your order. They receive the minimum data needed to fulfil and support the order.
• Hosting and infrastructure providers — to store the website, the database and backups.
• Security and anti-bot providers — including Cloudflare, for Turnstile challenges, network protection and abuse prevention.
• Email and marketing providers — including Mailchimp (Intuit), to send transactional emails and, where you have consented, our newsletter.
• Professional advisers — accountants, auditors and lawyers, under duties of confidentiality.
• Authorities — where we are legally required to disclose data, or to establish, exercise or defend legal claims.
• A buyer or successor — if we sell or reorganise our business, subject to equivalent protections.

All processors act on our documented instructions under a written data processing agreement.

6. International transfers

Some of our providers are located outside the United Kingdom and the European Economic Area. Where personal data is transferred to such a country, we rely on one of the following safeguards: an adequacy decision or UK adequacy regulations covering the destination country; the European Commission’s Standard Contractual Clauses together with the UK International Data Transfer Addendum; or another lawful transfer mechanism. You may request a copy of the safeguards we use by writing to support@gameodrop.com.

7. How long we keep your data

Category	Retention period
Account data	For as long as your account is open, then 12 months after closure
Order, invoice and payment records	7 years from the end of the relevant accounting period, to meet UK tax and accounting requirements
Delivered key and code records	7 years, so that we can verify and support past purchases and resolve disputes
Support correspondence	3 years from the date the case was closed
Fraud and abuse records	Up to 6 years where needed to prevent repeat abuse or defend claims
Newsletter subscription data	Until you unsubscribe, then up to 12 months to record your opt-out
Server and security logs	Up to 12 months
Cookie data	As stated in the Cookies Policy

8. How we protect your data

• All traffic to and from our website is encrypted with TLS.
• Passwords are stored only as salted hashes and are never readable by our staff.
• Access to customer data is restricted to staff who need it, and is logged.
• We use bot protection, rate limiting and a hardened login endpoint to reduce the risk of account takeover.
• Backups are taken regularly and stored securely.

No online service can be completely secure. If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office within 72 hours and, where the risk is high, notify you directly.

9. Your rights

Under the UK GDPR and the EU GDPR you have the right to:

• Access — obtain a copy of the personal data we hold about you.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — ask us to delete your data where there is no continuing lawful reason for us to keep it.
• Restriction — ask us to pause processing while a dispute about accuracy or legitimate interests is resolved.
• Portability — receive the data you gave us in a structured, machine-readable format, or have it sent to another controller.
• Objection — object to processing based on legitimate interests, and object at any time to direct marketing.
• Withdraw consent — withdraw consent for marketing or non-essential cookies at any time, without affecting processing carried out before withdrawal.
• Human review — we do not make decisions producing legal or similarly significant effects by automated means alone. Automated fraud checks may flag an order, but a person reviews any decision to cancel it.

To exercise any right, email support@gameodrop.com from the address linked to your account. We respond within one month; for complex or multiple requests we may extend this by two further months and will tell you if we do. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive.

10. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at support@gameodrop.com so that we can put it right — see our Complaints Policy.

You also have the right to complain to a supervisory authority:

• United Kingdom — Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline 0303 123 1113, ico.org.uk.
• European Economic Area — the data protection authority of the country where you live, work, or where the alleged infringement took place.

11. Children

Our store is not directed at children. You must be at least 16 years old to create an account and place an order, and old enough under the applicable age rating (for example PEGI or ESRB) to play the game you are buying. If we learn that we have collected personal data from a child below the applicable age of digital consent without parental authorisation, we will delete it.

12. Third-party links

Our site links to platform stores, publisher sites, gaming news outlets and social networks. We are not responsible for their content or their privacy practices. Please read the privacy policy of any site you visit.

13. Changes to this policy

We may update this policy to reflect changes in our services, technology or the law. The “Last updated” date at the top always shows the current version. Where a change materially affects your rights, we will give you notice by email or by a prominent notice on the site before it takes effect.

14. Contact us

Questions, requests or concerns about this policy:

• Email: support@gameodrop.com
• Post: GAMEDRP LTD, 14/2e Docklands Business Centre, 10-16 Tiller Road, London, E14 8PX, United Kingdom