Solid2k takes the protection of your personal data seriously. This Privacy Policy explains what personal data we collect when you visit solid2k.com or purchase Digital Content from us, why we collect it, how we use it, and the rights available to you under applicable data protection law, including the EU General Data Protection Regulation (“GDPR”).
1. About Us
1.1 This website is operated by Solid2k.
1.2 Solid2k is a Dutch platform for digital products and games, active since 2023, with customers worldwide. Its mission is to give people effortless access to games and digital products.
1.3 The website solid2k.com (the “Platform”) offers various items of digital content for sale, including activation codes, gift cards and top-up credits (“Digital Content”), which allow you to unlock, access or redeem the relevant content on the platform of the developer, publisher or brand that issues it (“Publisher”). We sell this Digital Content directly and are not the Publisher; we do not own or operate the Publisher’s own platform.
1.4 This Privacy Policy should be read together with our Terms and Conditions and, where published, our Cookie Policy, which describe in more detail the technologies used on the Platform and how you can manage your preferences.
2. Scope of this Policy
2.1 This Privacy Policy applies to individuals who visit, browse or use the Platform. It explains how we collect and process your personal data when you access the Platform, register an Account, contact us, leave feedback or product reviews, purchase Digital Content, take part in promotions or surveys, or participate in an affiliate or partnership programme through the Platform.
2.2 Please read this Privacy Policy together with any additional notice we may provide on specific occasions when we collect or process personal data about you, so that you are fully aware of how and why your data is being used.
2.3 This Privacy Policy does not apply to third-party websites, platforms or services that you may reach through links on the Platform, or to any Publisher’s own platform, which are governed by their own privacy notices, as explained in Section 8.
3. Legal Basis for Processing Your Personal Data
3.1 Under the GDPR, we may only process your personal data where we have a valid legal basis to do so. Depending on the purpose, we rely on one or more of the following:
(a) Performance of a contract: where processing is necessary to create your Account, process an Order, deliver Digital Content, or otherwise perform our Terms and Conditions with you;
(b) Legal obligation: where processing is necessary to comply with a legal or regulatory obligation to which we are subject, such as tax, accounting or anti-fraud obligations;
(c) Legitimate interests: where processing is necessary for our legitimate interests, or those of a third party, provided your interests and fundamental rights do not override those interests for example, to keep the Platform secure, prevent fraud, and improve our services; and
(d) Consent: where you have given clear consent for us to process your personal data for a specific purpose, such as sending marketing communications or using non-essential cookies. You may withdraw such consent at any time, as described in Section 13.
3.2 Where we are required to collect personal data by law, or under our Terms and Conditions, and you do not provide that data when requested, we may be unable to perform the relevant contract, for example to process your Order. We will indicate where provision of personal data is mandatory and where it is optional.
3.3 We apply the principle of data minimisation: we only collect and process the personal data that is adequate, relevant and limited to what is necessary for the purposes described in this Privacy Policy.
3.4 We use automated fraud-prevention checks to help decide whether to accept an Order or to flag it for manual review, based on factors such as payment verification, device and location signals, and order patterns. These checks do not produce legal or similarly significant effects on their own; a suspicious Order is reviewed by a member of our team before being declined, and you may contact us as described in Section 16 if you believe an Order was wrongly declined.
4. Types of Personal Data We Collect
4.1 “Personal data” means information about an identified or identifiable individual. It does not include data from which your identity has been removed (anonymous data). The personal data we collect depends on how you use the Platform, and typically includes:
(a) Identity and Contact Data your name, email address, postal address, date of birth (where relevant, for example to confirm you meet the minimum age requirement) and any other details you provide when contacting us;
(b) Financial Data information necessary to process payments and prevent fraud. Where you pay by card, this may include the card number, cardholder name, security code and expiry date; for other payment methods, we process the payment details received from your chosen payment provider;
(c) Transaction Data details of Orders you have placed, payments made to and from you, and the Digital Content you have purchased;
(d) Technical Data your IP address, browser type and version, device information, operating system, time zone setting and location, and other technology on the devices you use to access the Platform;
(e) Usage Data information about how you use the Platform, such as pages viewed, links clicked, search terms, page response times and length of visits; and
(f) Marketing and Communications Data your preferences in receiving marketing from us and your communication preferences.
4.2 We may also derive aggregated or statistical data from your personal data, for example to calculate what percentage of Customers use a particular feature. Aggregated data is not personal data unless it is combined with other information in a way that could identify you, in which case we treat the combined data as personal data under this Privacy Policy.
4.3 We do not intentionally collect any special categories of personal data about you (such as data revealing racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, genetic or biometric data, health data or data concerning sexual orientation), nor data relating to criminal convictions or offences. Please do not include such information in any communication with us or in any content you submit through the Platform.
5. How We Collect Your Personal Data
5.1 Direct interactions: you may give us Identity, Contact, Financial and Transaction Data by creating an Account, placing an Order, filling in a form, leaving a review, corresponding with us by email or otherwise, or taking part in a promotion, survey or affiliate programme.
5.2 Automated technologies: as you use the Platform, we automatically collect Technical Data and Usage Data using cookies, similar tracking technologies and server logs. Details of the specific technologies used and how to manage your preferences are set out in our Cookie Policy, where published.
5.3 Third-party sources: we may also receive personal data about you from third parties, including:
(a) Transaction Data from Publishers, confirming redemption of Digital Content you purchased from us;
(b) Technical and Usage Data from analytics providers, such as Google Analytics;
(c) Identity, Contact and Financial Data from our payment service providers, in connection with processing your payment;
(d) Identity and Contact Data from publicly available sources, such as a commercial register; and
(e) Identity and Contact Data (such as your name and email address) where you choose to log in to the Platform using a third-party account, such as Google or Facebook.
6. How We Use Your Personal Data
6.1 We use your personal data, on the legal bases described in Section 3, for the following purposes:
(a) to create and administer your Account, and to process, deliver and provide support in relation to your Orders;
(b) to process payments and prevent, investigate and detect fraud or other unlawful activity, including abuse of promotions and discount codes;
(c) to communicate with you about your Account or Orders, including Order confirmations, delivery notices and responses to complaints;
(d) to send you marketing communications where you have consented, or where we have a legitimate interest to do so, as described in Section 7;
(e) to maintain the security of the Platform, and to administer and troubleshoot it, including data analysis, testing and statistical purposes;
(f) to improve the Platform, our products and our services, and to measure the effectiveness of the marketing we provide to you; and
(g) to recommend Digital Content that may be of interest to you, based on your previous purchases and browsing activity on the Platform;
(h) to manage promotions, competitions and affiliate or partnership programmes that you choose to take part in; and
(i) to comply with a legal or regulatory obligation to which we are subject, including responding to lawful requests from public authorities.
6.2 Where we rely on legitimate interests as our legal basis, we have considered and balanced any potential impact on you and your rights before processing your personal data for that purpose. You have the right to obtain further information about this balancing test, and to object to such processing, as described in Section 13.
7. Marketing Communications and Cookies
7.1 Where you have consented, or it is in our legitimate interest to do so, we may send you information about our products, offers and upcoming releases by email or other electronic means.
7.2 You can withdraw your consent to marketing communications at any time by using the ‘unsubscribe’ link included in our emails, or by managing your preferences through your Account settings or by contacting us as described in Section 16.
7.3 The Platform uses cookies and similar technologies to operate, secure and improve the Platform, and, where you consent, to measure and personalise marketing. Further information about the specific cookies used and how to manage them is available in our Cookie Policy, where published on the Platform.
7.4 A cookie consent banner allows you to accept or decline non-essential cookies when you first visit the Platform, and to change your choice at any time through the cookie settings link available on the Platform. Essential cookies, which are necessary for the Platform’s core functionality such as maintaining your shopping basket, do not require consent.
7.5 Some browsers offer a ‘Do Not Track’ signal. Because there is currently no common industry standard for how to respond to such signals, the Platform does not currently respond to them differently than it would to your cookie preferences set out above.
7.6 The cookies and similar technologies used on the Platform generally fall into the following categories:
(a) Essential cookies required for the Platform to function, such as keeping items in your shopping basket and keeping you logged into your Account; these cannot be switched off;
(b) Performance and analytics cookies help us understand how Customers use the Platform, for example through Google Analytics, so that we can improve it; these are used only with your consent;
(c) Functionality cookies remember choices you make, such as your preferred language or currency, to give you a more personalised experience; and
(d) Marketing cookies used, with your consent, to measure the effectiveness of our marketing and, where applicable, to show you more relevant offers.
8. Third-Party Links and Services
8.1 The Platform may contain links to third-party websites, plug-ins and applications. Clicking on those links, or enabling those connections, may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy practices; we encourage you to read the privacy notice of every website you visit.
8.2 Redeeming Digital Content generally requires you to use a Publisher’s own platform, which is governed by that Publisher’s own privacy notice and terms. Solid2k is not responsible for the processing of your personal data by a Publisher once you leave the Platform to redeem Digital Content.
9. Disclosure of Your Personal Data
9.1 Except as set out in this Privacy Policy, we do not disclose personal data that we collect from you, or that you provide to us, to third parties. We may share personal data with the following categories of recipients, for the purposes described in Section 6:
(a) Service providers who process personal data on our behalf, such as payment service providers, IT hosting and support providers, analytics providers, and providers of customer support tools, each bound by contractual obligations to protect your data and to use it only for the purposes we specify;
(b) Professional advisors, including lawyers, accountants and auditors, where necessary for their services to us;
(c) Public and government authorities, where we are required to disclose personal data to comply with a legal obligation, or to enforce or apply our Terms and Conditions and other agreements, or to protect the rights, property or safety of Solid2k, our Customers or others; and
(d) Prospective buyers or successors, in the event that we sell, transfer or reorganise all or part of our business or assets; if this happens, we will ensure the new owner uses your personal data in a manner consistent with this Privacy Policy.
9.2 We require every third party with whom we share personal data to respect its security and to treat it in accordance with applicable law. We do not allow our service providers to use your personal data for their own purposes, and only permit them to process it for specified purposes and in accordance with our instructions, generally under a written data processing agreement as required by Article 28 of the GDPR.
9.3 We do not sell your personal data to third parties for their own independent marketing purposes, and we do not share your personal data with third parties for cash or other valuable consideration in exchange.
9.4 Where a service provider we use also acts as an independent controller of your personal data, for example a payment provider that must comply with its own regulatory obligations, that provider’s own privacy notice applies to its processing in that capacity, in addition to this Privacy Policy.
10. International Data Transfers
10.1 Solid2k is established in the Netherlands, and your personal data is primarily processed within the European Economic Area (EEA).
10.2 Some of our service providers, such as certain payment, analytics or hosting providers, may be located outside the EEA. Where this is the case, we ensure that an adequate level of protection is applied, for example through the European Commission’s Standard Contractual Clauses, an adequacy decision, or another safeguard recognised under the GDPR.
10.3 You may request further information about the safeguards we have put in place for a specific international transfer by contacting us as described in Section 16.
11. Data Retention
11.1 We retain your personal data only for as long as reasonably necessary to fulfil the purposes for which we collected it, including to satisfy any legal, regulatory, tax, accounting or reporting requirement.
11.2 We may retain personal data for a longer period in the event of a complaint, or if we reasonably believe there is a prospect of litigation in respect of our relationship with you.
11.3 To determine the appropriate retention period, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it, whether those purposes can be achieved by other means, and applicable legal requirements. Where we no longer need your personal data, we will securely delete or anonymise it.
11.4 As a general guide: Account data is retained for as long as your Account remains open, and for a limited period afterwards in case you wish to reopen it; Transaction Data, including invoices, is retained for the period required by Dutch tax and accounting law, which is currently seven years; Marketing preference data is retained until you withdraw your consent or object to further processing; and Technical and Usage Data collected through analytics cookies is retained for the period set out in our Cookie Policy, where published.
12. Data Security
12.1 We have appropriate technical and organisational measures in place to prevent your personal data from being accidentally lost, used, altered, disclosed, or accessed without authorisation.
12.2 Access to your personal data is limited to employees, agents and service providers who have a genuine business need to know it; they process your personal data only on our instructions and are subject to a duty of confidentiality.
12.3 We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so. Where required under the GDPR, we will notify the Autoriteit Persoonsgegevens of a qualifying breach without undue delay and, where feasible, within 72 hours of becoming aware of it.
12.4 Payment card data is processed by our payment service providers in accordance with the Payment Card Industry Data Security Standard (PCI-DSS); Solid2k does not store full card numbers or security codes on its own systems.
12.5 No method of transmission or storage is completely secure. If you have reason to believe your interaction with the Platform is no longer secure, please contact us immediately as described in Section 16.
13. Your Rights Under Data Protection Law
13.1 Under the GDPR, you have a number of rights in relation to your personal data, including the right to:
(a) Access request a copy of the personal data we hold about you and check that we are processing it lawfully;
(b) Rectification request correction of incomplete or inaccurate personal data we hold about you;
(c) Erasure request deletion of your personal data where there is no good reason for us to continue processing it, where you have objected to processing, where it has been processed unlawfully, or where erasure is required to comply with a legal obligation;
(d) Restriction request that we suspend the processing of your personal data in certain circumstances, for example while we verify its accuracy or assess an objection you have raised;
(e) Object object to processing of your personal data that is based on our legitimate interests, including for direct marketing, in which case we will stop such processing unless we can demonstrate compelling legitimate grounds that override your interests;
(f) Data portability request that we provide your personal data to you, or transfer it to a third party you nominate, in a structured, commonly used, machine-readable format, where processing is based on consent or on the performance of a contract and is carried out by automated means; and
(g) Withdraw consent withdraw your consent at any time where we rely on consent to process your personal data, without affecting the lawfulness of processing carried out before withdrawal.
13.2 To exercise any of these rights, please contact us in writing using the details in Section 16, describing your request and the personal data it relates to. We may need to verify your identity, and request further information, before we can act on your request.
13.3 We aim to respond to legitimate requests within one month, as required by the GDPR. Occasionally it may take us longer, for example if your request is particularly complex or you have made a number of requests; in that case we will notify you of the extension and keep you updated.
13.4 You will not usually have to pay a fee to exercise any of the above rights. We may, however, charge a reasonable fee, or refuse to act on a request, if it is clearly unfounded, repetitive or excessive.
13.5 Your Account settings page allows you to view, update and, in some cases, delete certain personal data associated with your Account directly.
13.6 If you are not satisfied with how we have handled your personal data, you have the right to lodge a complaint with the relevant supervisory authority. In the Netherlands, this is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority). We would, however, appreciate the opportunity to address your concerns directly before you approach the supervisory authority, so please contact us first using the details in Section 16.
14. Children’s Privacy
14.1 The Platform is not directed at, and is not intended for use by, children below the age of legal majority described in our Terms and Conditions. We do not knowingly collect personal data from children.
14.2 If you believe that a child has provided us with personal data without appropriate consent, please contact us using the details in Section 16 so that we can take appropriate action, which may include deleting that information.
15. If You Are a Business Customer
15.1 Where you interact with the Platform on behalf of a company or other organisation, for example to place a bulk Order under Section 6.8 of our Terms and Conditions, we process the personal data of the individuals involved (such as the name and business email address of your organisation’s contact person) on the basis of our legitimate interest in performing and administering that business relationship, in addition to the purposes described in Section 6 above.
16. Contact Us
16.1 If you have any questions about this Privacy Policy, including any request to exercise your rights under Section 13, please contact Solid2k through the contact details published on the Platform’s Contact page.
17. Changes to This Privacy Policy
17.1 We may update this Privacy Policy from time to time, for example to reflect changes in our data practices or in applicable law. Any changes will be posted on the Platform together with a revised “last updated” date, and material changes will, where appropriate, be brought to your attention.
17.2 We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data.