Here you can read which personal data we process when you visit vivakeys.eu, vivakeys.com, vivakeys.co.uk or vivakeys.us and order from us, why we need it, who receives it and what rights you have.
1. Controller
EUROPE SOFTWARE PARTNER AND PAYMENT SOLUTIONS OÜ
Valge tn 13, 11415 Tallinn, Harju maakond, Estonia
Telephone: +372 668 3082
Email for data protection matters: datenschutz@vivakeys.de
Further details are in the Legal Notice.
2. Data protection officer
Dipl.-Ing. Michael Heisekamp
c/o EUROPE SOFTWARE PARTNER AND PAYMENT SOLUTIONS OÜ, Valge tn 13, 11415 Tallinn, Estonia
Email: datenschutz@vivakeys.de
3. Visiting the website
Hosting and server logs
Our website and our mailbox run on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner processes the data on our behalf (Art. 28 GDPR).
With every request, the server stores a log: IP address, date and time, requested address, status code, amount of data transferred, the previously visited page (referrer) and browser and operating system. We need this data to deliver the website, find errors and fend off attacks. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). The logs are deleted after six weeks at the latest.
Necessary cookies
To make the cart, checkout and customer account work, our shop (WooCommerce) sets the following cookies. They are strictly necessary for the service you requested and do not require consent (Art. 5(3) of Directive 2002/58/EC as implemented in the Member States; Art. 6(1)(b) GDPR).
wp_woocommerce_session_…: cart and checkout session; stored for two dayswoocommerce_cart_hashandwoocommerce_items_in_cart: detect whether the cart has changed; until the browser is closedwordpress_logged_in_…andwordpress_sec_…: login to the customer account; until the browser is closed, with “Remember me” 14 dayswordpress_test_cookie: checks whether your browser accepts cookies; until the browser is closed
The payment service providers set their own cookies during payment (section 5).
Your choice in the cookie notice
On your first visit, the notice “Cookies and Google services” asks whether you allow Google Analytics (statistics) and other Google services. We do not load any Google code before your decision. Declining has no disadvantages.
We store your choice only in your browser (local storage, entry vk_consent: choice and time). The entry is not transmitted to us. We ask again after twelve months. Using the “Cookie settings” link at the bottom of every page, you can change your choice or withdraw your consent with effect for the future at any time. The legal basis for storing the choice is Art. 5(3) of Directive 2002/58/EC as implemented in the Member States and Art. 6(1)(c) GDPR.
Google Analytics 4 (only with “Statistics” consent)
With your consent, we use Google Analytics 4 by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”) to understand how our shop is used. Google sets the cookies _ga and _ga_… for up to two years. Pseudonymous usage data is processed, such as pages viewed, time spent, source of the visit, device and browser details and the approximate region. According to Google, Google Analytics 4 does not store IP addresses. Event data is kept for no more than 14 months.
We use Google’s consent mode: after your consent we tell Google that only analytics is allowed. Storage and use for advertising remain denied. Logged-in staff are not tracked. The legal basis is your consent (Art. 6(1)(a) GDPR, Art. 5(3) of Directive 2002/58/EC).
Google services (only with “Google services” consent)
Merchant widget: with your consent, we show a Google widget with our shop rating at Google on the shop pages (not in the cart, checkout or customer account). It is loaded from Google servers (gstatic.com, google.com). Google receives your IP address, browser and device details and the page viewed.
Google Customer Reviews: with your consent, Google shows a window on the order confirmation page after an order. In it, you decide whether Google may ask you by email to rate your purchase. For this window, we send Google: order number, email address, delivery country, estimated delivery date and, where available, the GTIN of the products purchased. Google sends you the survey only if you agree in the window. Google publishes your rating under its own terms.
The legal basis for both services is your consent (Art. 6(1)(a) GDPR, Art. 5(3) of Directive 2002/58/EC).
4. Order and customer account
For an order, we need your email address and your country; you can provide your name voluntarily. If you order for a company, we need the company, name, address and, if you want to use reverse charge, the VAT identification number. With the order, we also store the products ordered, prices and taxes, the payment method and payment status, the product keys delivered, your declarations during checkout and the IP address and browser details at the time of the order (to protect against misuse).
We use this data to conclude and perform the contract, deliver the keys to you, issue invoices, answer enquiries about the order and fulfil legal obligations. The legal bases are Art. 6(1)(b) GDPR (contract), Art. 6(1)(c) GDPR (tax and commercial law obligations) and, for protection against misuse, Art. 6(1)(f) GDPR.
A customer account is voluntary; you can also order as a guest. In the account we store your login data (the password only in encrypted form), your details and your orders with product keys so that you can retrieve them at any time. You can have your account deleted at any time; data we are required to keep remains stored until the end of the retention period.
Checking the VAT identification number
If you enter a VAT identification number, we check it when you order in the VAT Information Exchange System (VIES) of the European Commission. We transmit the number and the country. We store the result and the consultation number with the order as tax evidence. The legal basis is Art. 6(1)(c) GDPR in conjunction with the VAT evidence obligations. If VIES reports the number as invalid, you can order without the number; we then charge VAT.
Order emails
We send the order confirmation, delivery of the keys and other order emails via Scaleway Transactional Email of Scaleway SAS, 8 rue de la Ville l’Evêque, 75008 Paris, France, as processor (Art. 28 GDPR). The sender is shop@vivakeys.com; replies go to office@vivakeys.de. Scaleway receives your email address and the content of the email. The legal basis is Art. 6(1)(b) GDPR.
Invoices and accounting
We create invoices in the shop and transfer the data to our accounting. We must keep invoices and accounting records for seven years from the end of the financial year under § 12 of the Estonian Accounting Act (raamatupidamise seadus). Where necessary, our tax advisers and the tax authorities receive this data (Art. 6(1)(c) GDPR).
5. Payment
For payment, we pass the necessary data to the payment service provider of the payment method you chose, such as order number, amount, currency, email address, country and, if provided, name and address:
- card payment, Apple Pay and Google Pay: Revolut Bank UAB, Konstitucijos pr. 21B, 08130 Vilnius, Lithuania
- PayPal and the local payment methods offered via PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg, Luxembourg
You enter your payment details directly with the payment service provider. We do not receive full card or account details. The payment service providers also process your data under their own responsibility, for example to prevent fraud and fulfil legal obligations; their own privacy notices apply. With Apple Pay and Google Pay, Apple or Google also process data under their own terms. The legal basis is Art. 6(1)(b) GDPR.
Payment features at checkout only: we embed the payment buttons and input fields of PayPal and Revolut only on the checkout page, not on product or cart pages. At checkout they are loaded when the page opens, before you choose a payment method. Your browser loads program code from PayPal and Revolut servers. PayPal also uses its FraudNet service and the reCAPTCHA service of Google Ireland Limited to prevent fraud. Revolut’s program sends error reports to the Sentry service of Functional Software, Inc., San Francisco, USA, which Revolut uses for this. The providers receive in particular your IP address, browser and device details and the page viewed and may use cookies or similar technologies. The legal basis is Art. 6(1)(b) GDPR, because you want to complete and pay for your order at checkout, and, for fraud prevention and error reports, our legitimate interest in secure and functioning payment (Art. 6(1)(f) GDPR).
6. Contact and support
If you write to us by email or via the contact form, we process your details (in the form: name, email address, subject and message) and the content of your enquiry in order to answer it. The form is sent by email to our mailbox and is not additionally stored on the website. The legal basis is Art. 6(1)(b) GDPR if it concerns a contract, otherwise our legitimate interest in answering (Art. 6(1)(f) GDPR).
Report a problem: if a key you received does not work, you can report it via “Report a problem” in your order or the “Report a key problem” page. To receive the link to the form, you enter the order number and the email address of the order; we send the link only to this address. With the report, we process the order, the affected key, any error code you enter and your description in order to check the case and supply a replacement. The legal basis is Art. 6(1)(b) GDPR (performance of the contract and of the rights for lack of conformity).
AI-assisted processing: we use AI systems of OpenAI Ireland Limited, Dublin, Ireland, as processor (Art. 28 GDPR) to process enquiries. The content of your enquiry is processed. We send replies as “Kundenservice VivaKeys”. You can ask at any time for a person to review and answer your request.
Appointment booking: you can book a callback or remote help appointment via Calendly (Calendly LLC, 115 E Main St, Ste A1B, Buford, GA 30518, USA). Calendly is only called up when you click a booking link. Calendly processes the details you enter there (such as name, email address, telephone number, appointment and note) and your IP address. The legal basis is Art. 6(1)(b) GDPR or our legitimate interest in simple appointment scheduling (Art. 6(1)(f) GDPR).
Remote help: for remote help we use TeamViewer of TeamViewer Germany GmbH, Bahnhofsplatz 2, 73033 Göppingen, Germany. A session only takes place if you start TeamViewer and give us your ID and password. TeamViewer ID, IP address, session duration and the screen content visible during the session are processed. The legal basis is Art. 6(1)(b) GDPR.
7. Withdrawal
If you withdraw from a contract, we process your notice and the order details in order to handle the withdrawal, refund the payment and be able to document the process (Art. 6(1)(b) and (c) GDPR).
8. Transfers to countries outside the EU
Google, Calendly, OpenAI and Sentry belong to companies based in the USA, and payment service providers may also process data in third countries. With Calendly, processing takes place in the USA. Google LLC and Calendly LLC are certified under the EU-US Data Privacy Framework; transfers to certified companies are covered by the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR). Where this does not apply, we base transfers on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR). On request, we will tell you the safeguard concerned.
9. Storage period
We delete your data as soon as we no longer need it for the purpose and there is no obligation to retain it. In detail:
- server logs: six weeks at most
- cart session: two days
- your choice in the cookie notice: twelve months in the browser
- invoices and accounting records: seven years from the end of the financial year
- orders and keys delivered: as long as claims under the contract are possible and the retention obligation applies
- customer account: until you delete it or have it deleted
- customer service enquiries: until the matter is closed and no claims are expected from it
10. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)).
Right to object: where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).
To do so, write to datenschutz@vivakeys.de. If we have reasonable doubts about your identity, we may ask for proof.
11. Complaint to a supervisory authority
You can lodge a complaint with a data protection supervisory authority. The Estonian data protection authority is responsible for us:
Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate)
Tatari 39, 10134 Tallinn, Estonia
Email: info@aki.ee, telephone: +372 627 4135
Website: aki.ee
You can also contact the supervisory authority in the EU Member State where you live or work. It forwards your complaint to the Estonian authority.
12. Further information
You must provide the details required for an order; otherwise we cannot conclude the contract. All other details are voluntary.
We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).
We update this privacy policy when our processing or the legal situation changes. The version published here applies.
Last updated: 9 November 2026