Effective date of this version: October 6, 2026
This privacy policy applies to the use of CD-Keys’ websites, such as cd-keys.uk, cd-keys.be, cd-keys.fr, and cd-keys.de, as well as all other country-specific versions, and to the services provided by Webtron on those sites. Effective date of this version: October 6, 2026. Upon publication of a brand new version, all previous versions are no longer valid.
Below, you can read about what data we collect, on what legal basis and for what purpose, with whom we share it, how long we retain it, and what rights you have. If you have any questions, please contact us using the contact information provided in Section 5.
We process the following categories of personal data:
We process this data based on the following legal grounds under Article 6 of the GDPR:
Providing your name, address, email address, and payment information is necessary to enter into a contract with us. Without this information, we cannot process your order.
We do not subject you to automated decision-making or profiling with legal consequences.
Below, you can read about the parties we work with, what they do for us, and what data is processed in the process. We have entered into a data processing agreement with the parties that process data on our behalf, in which appropriate technical and organizational measures are specified. Some parties, such as MultiSafepay, WebwinkelKeur, Trustpilot, and Google for advertising, also process data for their own purposes and are responsible for that processing themselves. Their own privacy policies apply to that processing.
WooCommerce
Our online store runs on WooCommerce, open-source software that we manage on our own server environment. Your personal data is stored in our own database and is not shared with the WooCommerce developer. We use SSL encryption, a strict password policy, and regular backups. You can read WooCommerce’s privacy policy here.
HostedPower
We obtain our web hosting and business email services from HostedPower, a Belgian hosting partner. The servers are located within the European Economic Area. HostedPower processes personal data exclusively on our behalf and does not use it for its own purposes. However, HostedPower may collect metadata regarding the use of the services. HostedPower has implemented appropriate technical and organizational measures to prevent the loss and unauthorized use of your personal data and is bound by a confidentiality agreement. HostedPower does not have access to our inbox; we treat all our email correspondence as confidential. You can read HostedPower’s privacy policy here.
Clonable
Our websites in other languages, such as cd-keys.be, cd-keys.fr, and cd-keys.de, are translated and displayed via Clonable, a Dutch service. When you visit one of these websites, Clonable processes technical data—such as your IP address and the pages you view—solely to display the translated website to you. Clonable processes this data on our behalf and within the EEA.
cd-keys.ai and Claude (Anthropic)
We use our own platform, cd-keys.ai, to handle customer inquiries and send automated emails regarding your order. In doing so, we process your name, email address, order details, and the content of your messages. The platform is hosted on OVHcloud servers within the EEA.
To generate responses, the platform uses Claude, Anthropic’s AI model. In doing so, the content of your message and the data necessary to respond to it are sent to Anthropic, including to the United States. Anthropic processes this data on our behalf and, according to its terms of service, does not use it to train AI models. The transfer of data outside the EEA is based on the European Commission’s Standard Contractual Clauses. No automated decision-making with legal consequences takes place. You can read Anthropic’s privacy policy here.
Selzy
We send our newsletter using Selzy. Selzy never uses your name and email address for its own purposes. At the bottom of each newsletter, you’ll find an unsubscribe link; once you unsubscribe, you will no longer receive the newsletter. Selzy uses cookies and similar technologies to track whether emails are opened and read. You will only receive our newsletter if you have subscribed to it. Selzy is based in Cyprus (EU). If data is processed outside the EEA—for example, in the United States or Canada—this is done in accordance with the European Commission’s Standard Contractual Clauses. You can read Selzy’s privacy policy here and their GDPR statement here.
MultiSafepay
We use MultiSafepay to process payments. MultiSafepay processes your name, address, and city information, as well as your payment details, such as your account or card number. We do not receive full card details ourselves. For this processing, MultiSafepay acts as an independent data controller in accordance with its legal obligations and does not retain your data longer than permitted by law. You can read MultiSafepay’s privacy policy here.
WebshopKeur
We collect reviews through WebwinkelKeur. When you leave a review, you provide your name, city, and email address. WebwinkelKeur shares this information with us so we can link the review to your order, and publishes your name and city on its own website. In some cases, WebwinkelKeur may contact you for further clarification. If we invite you to leave a review, we will share your name and email address with WebwinkelKeur for that purpose; they will use that information exclusively for that invitation. WebwinkelKeur may engage third parties to provide its services; the guarantees mentioned above also apply to those services. You can read WebwinkelKeur’s privacy policy here.
Trustpilot
In addition, we collect reviews via Trustpilot. If you leave a review there, you’ll provide your name, city, and email address. Trustpilot shares this information with us so that we can link the review to your order, and publishes your name and city on its own website. If we invite you to leave a review, we’ll share your name and email address with Trustpilot for that purpose. Trustpilot is based in Denmark and processes your data within the EEA. You can read Trustpilot’s privacy policy here.
Octopus
We use the Belgian platform Octopus for our accounting and administration. In doing so, your name, address, email address, phone number, and order details are processed for the purposes of order fulfillment, invoicing and accounting, communication regarding your order, and compliance with legal obligations. The data is processed within the EEA. You can read Octopus’s privacy policy here.
Google Analytics, Google Ads, and ChatGPT Ads
We use Google Analytics to understand how visitors use our website, and Google Ads to promote our products. This involves processing data such as your IP address and the pages you visit, and may involve placing or reading cookies in your browser.
We ask for your consent to place analytics and advertising cookies via our cookie banner. You can change or withdraw your consent at any time using the button in section n.
Google is based in the United States. Data transfers to the U.S. are made pursuant to the EU-U.S. Data Privacy Framework, for which the European Commission has issued an adequacy decision, supplemented by standard contractual clauses. You can view details about how Google uses data in its privacy policy, as well as in its policies regarding ads and sites that use Google services.
In addition, we may use OpenAI’s ChatGPT Ads conversion pixel to measure whether ads in ChatGPT lead to an order. We also place this pixel only after you’ve given your consent via our cookie banner. If data is processed outside the EEA in this context, it is done so based on appropriate safeguards, such as the European Commission’s standard contractual clauses. You can read OpenAI’s privacy policy here.
CookieYes
We use CookieYes to request and record your cookie consent. CookieYes stores your choice, along with an anonymous consent ID and the time stamp, so that we can demonstrate whether you have given or denied consent. CookieYes processes this data on our behalf. You can read CookieYes’s privacy policy here.
reCAPTCHA and YouTube
To protect our forms from automated abuse, we use Google reCAPTCHA. This involves sending your IP address and information about your use of the website to Google. The legal basis for this is our legitimate interest in securing our website.
On some pages, we embed videos from YouTube. If you play a video, YouTube may set cookies and process data related to the playback.
We do not retain your data any longer than necessary:
Cookies are small text files that store small pieces of information. They are placed on your device when the website loads in your browser. Cookies help us ensure the website functions properly, make it more secure, provide a better user experience, and understand how the website performs.
We use strictly necessary cookies that are required for the website to function, such as for your basket, checkout, security, and remembering your cookie preferences. We place these without your consent, as permitted by law.
We only set all other cookies—such as functional, analytical, and advertising cookies—if you give your consent. This includes both our own cookies (first-party) and third-party cookies, such as those from Google. We request your consent for these cookies via our cookie banner. You can see which cookies fall into each category in the overview below.
You can change your cookie preferences at any time by clicking the button above. This will reopen the consent banner, allowing you to adjust your preferences or withdraw your consent.
You can also block or delete cookies through your browser settings. Below you’ll find the support pages for the most popular browsers.
We reserve the right to modify this privacy policy. You will always find the most recent version on this page. If a change affects how we process data we have already collected, we will notify you delivered instantly.
Under the General Data Protection Regulation, you have the rights listed below. You can submit a request via info@cd-keys.uk. We will respond without delay and no later than one month. If your request is complex, we may extend that period by two months; we will inform you of this within the first month.
To prevent misuse, we send receipts and copies exclusively to the email address on file with us. We maintain records of processed requests; in the event of a deletion request, we record only anonymized data. There is no charge for processing your request.
