Privacy

Who is responsible

The controller for the processing described here, within the meaning of the GDPR, is:

Controller

Evgeni Karb, trading as Darkpact Tokens

Address

Bertrand-Russell-Allee 8, 18147 Rostock, Germany

Email

hey@drkpact.com

Phone

+49 381 12782666

We are not required to appoint a data protection officer, and have not appointed one. Write to the address above with any data question.

What we collect, and why

Placing an order

We store your email address, name, delivery address, the items you bought, the amount, and the payment reference Stripe returns to us. We need this to take the order, ship it, answer questions about it, and handle returns.

Legal basis: Article 6(1)(b) GDPR, performance of the contract you entered into. Providing it is not a statutory requirement, but without it we cannot deliver an order.

Order emails

We send an order confirmation and a dispatch notice with tracking. These are transactional messages tied to your purchase, not marketing, and you cannot opt out of them while an order is open.

Legal basis: Article 6(1)(b) GDPR.

Newsletter

If you enter your email in the newsletter field, we store that address and the time you submitted it, and use it to email you about new designs and finish drops. Nothing else, and never to a third party.

Legal basis: Article 6(1)(a) GDPR, your consent. You can withdraw it at any time through the unsubscribe link in any of those emails or by writing to us. Withdrawing does not affect the lawfulness of what we sent beforehand.

Running the site

Our host records technical request data: IP address, time, the page requested, referrer, and browser user agent. We use it to serve the site, keep it up, and investigate abuse. We also rate-limit checkout and sign-up requests using a shortened identifier derived from the request.

Legal basis: Article 6(1)(f) GDPR, our legitimate interest in a site that stays available and is not abused.

Admin access

Shop staff sign in to an admin area to manage products and orders. That account data belongs to the staff member, not to customers. The shop does not offer customer accounts at all.

What we never hold

Card numbers, expiry dates, and security codes. The payment fields at checkout are served by Stripe inside their own frames, so those details travel from your browser to Stripe and never touch our servers. We see only the result: paid or not, and a reference.

We also run no advertising pixels, no analytics product, no cross-site trackers, and no A/B testing tools. There is no consent banner on this site because there is nothing to consent to.

Cookies and local storage

Your cart is kept in your browser's local storage under the key darkpact-cart-v1. It holds only which product variants you picked and how many, it never leaves your device except when you ask to see prices or check out, and it is not a cookie. Clearing your browser data clears the cart.

Stripe sets cookies necessary to process the payment and prevent fraud when the payment step loads. The admin area sets a session cookie for signed-in staff. Neither is used for advertising.

Who else processes your data

We use the following processors, each under a data processing agreement and each only on our instructions:

• Stripe Payments Europe, Ltd. (Ireland, with processing in the United States) — Takes payment, runs fraud checks, and issues refunds. Receives your name, email, billing and delivery address, and the order amount. Your card details go to Stripe directly and never pass through us.
• Resend (United States) — Sends the order confirmation and dispatch emails. Receives your email address and the contents of those emails.
• Neon (European Union) — Hosts the database holding orders, order items, and newsletter sign-ups.
• Vercel Inc. (United States, served from EU regions) — Hosts the site and stores product images. Processes the technical request data described below.
• Upstash (European Union) — Rate-limits checkout and sign-up requests to block automated abuse. Sees a truncated request identifier, not order contents.
• Clerk (United States) — Authenticates shop staff signing in to the admin area. Handles no customer accounts, because the shop has none.

We also pass your name and address to the carrier delivering your parcel, which is necessary to deliver it.

Transfers outside the EU

Some of the processors above are based in the United States. Those transfers are covered by the European Commission's standard contractual clauses, and, where the provider is certified, by the EU-US Data Privacy Framework. You can ask us for a copy of the safeguards in place.

How long we keep it

• Order records are kept for ten years from the end of the year the order was placed. German tax and commercial law requires this, so we cannot delete a paid order on request.
• Newsletter addresses are kept until you unsubscribe, then removed.
• Support email is kept as long as needed to resolve the matter and to show it was resolved.
• Technical request logs are kept short-term by our host for security and reliability.

Your rights

Under the GDPR you have the right to:

• ask what we hold about you and get a copy (Article 15);
• have inaccurate data corrected (Article 16);
• have data erased where we no longer have a basis to keep it (Article 17);
• ask us to restrict processing (Article 18);
• receive the data you gave us in a portable format (Article 20);
• object to processing based on legitimate interest, on grounds relating to your situation (Article 21);
• withdraw consent at any time, for anything based on consent.

Write to hey@drkpact.com. We answer within one month, and will tell you if we need longer.

Complaining to a regulator

You can complain to a supervisory authority, in the member state of your residence, place of work, or the place of the alleged infringement. Ours is:

Der Landesbeauftragte für Datenschutz und Informationsfreiheit Mecklenburg-Vorpommern
Werderstraße 74a, 19055 Schwerin, Germany
datenschutz-mv.de

Changes to this policy

If we add a tool or change what we collect, this page changes with it and the date at the top moves. Our trader details are on the legal notice.