MC Capes Store
English
EUR USD
Sign in Cart

Legal

Privacy policy

Last updated: 20 October 2026. TODO: review before going live.

1. Controller

MC Capes Store, TODO, TODO TODO, NL. Email: info@mc-capes-store.com.

2. What we collect and why

  • Order data: email address, items, price, payment method, order status, IP address and browser type. Needed to deliver your code, send the confirmation email, prevent fraud and meet our bookkeeping obligations.
  • Account data (optional): email address and a hashed password, stored by our authentication provider Supabase.
  • Code reveals: when a code is shown we log the time, IP address and browser type. This protects you and us in case of disputes.
  • Support messages: name, email and the content of your message.

We do not see or store your bank, PayPal or card details. Those are processed by Mollie B.V. under its own privacy policy.

3. Legal basis

Performance of the contract (delivering your order), our legal obligations (tax records, 7 years) and our legitimate interest in preventing fraud and abuse.

4. Who receives your data

  • Mollie B.V. (payments, Netherlands)
  • Supabase (database and authentication, EU region)
  • Postmark (transactional email)
  • Netlify (hosting)
  • Cloudflare Turnstile (bot protection on forms)

We do not sell personal data and we do not use advertising trackers.

5. Retention

Order and invoice data: 7 years (Dutch tax law). Account data: until you delete your account. Support messages: up to 2 years. Server logs: up to 30 days.

6. Cookies

We only use strictly necessary cookies: a session cookie when you sign in and local storage for your cart. No analytics or marketing cookies, so no cookie banner is needed.

7. Your rights

You can request access, correction, deletion or a copy of your data, and object to processing, by emailing info@mc-capes-store.com. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

8. Security

Connections are encrypted (HTTPS). Redeem codes are stored encrypted and are only decrypted for the buyer after a confirmed payment. Access to the administration is restricted and logged.