Privacy Policy

This policy explains what personal data D4Loot collects, why we collect it, how long we keep it and what rights you have. We are the data controller for the information described here.

1. What we collect

• You give us: username, email address, BattleTag, password (stored only as a PBKDF2 hash), order details and anything you type in live chat.
• Collected automatically: IP address, sign-in timestamps, pages viewed, browser and device type.
• From payment providers: transaction ID, amount, status and the last four digits of a card. We never see or store your full card number.

2. Why we use it

• to create and secure your account, and to prevent duplicate registrations
• to process orders, deliver them in-game and confirm payment
• to run the Points programme
• to answer support requests through live chat and email
• to detect fraud, chargeback abuse and unauthorised access
• to meet accounting and tax obligations

3. Legal bases (UK/EU customers)

We rely on contract for account creation, order processing and delivery; legitimate interests for fraud prevention, security and service improvement; legal obligation for tax and accounting records; and consent for optional cookies and marketing, which you can withdraw at any time.

4. How long we keep it

• Account data: until you delete your account
• Deleted-account BattleTag record (to enforce the 90-day re-registration rule): 90 days
• Sign-in and access logs: 12 months
• Order and payment records: 5 years, as tax law requires
• Live chat transcripts: 12 months

5. Who we share it with

We do not sell your personal data. We share only what is needed with:

• Cloudflare, Inc. (USA) — hosting, database, DDoS protection and CDN
• Payment providers (PayPal and our card / cryptocurrency processors) — to take and verify payment
• Law enforcement or regulators — only where legally required

These transfers may involve countries outside your own. Where required, they are covered by Standard Contractual Clauses or an equivalent safeguard.

6. Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or export it in a portable format. You can also complain to your local data-protection authority.

Email [email protected] or use live chat. We reply within 30 days. Most changes you can make yourself from your profile page.

7. Cookies

We use cookies that are strictly necessary to keep you signed in and to keep your cart. We do not use advertising cookies. You can block cookies in your browser, but the site will not work correctly without the necessary ones.

8. Security

• passwords hashed with PBKDF2 — never stored in readable form
• all traffic encrypted in transit (HTTPS)
• sign-in attempts rate-limited (locked for 30 minutes after 5 failures)
• administrative access restricted and logged

No system is perfectly secure. If a breach affects your data, we will notify you and the relevant authority without undue delay.

9. Children

The Service is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

10. Changes

We will post any update here and change the date at the top. Material changes will also be announced on the site.

11. Contact

Data protection contact: [email protected]. General support: live chat, or [email protected].