Last updated: May 11, 2026
This Privacy Policy explains how Shop Key Online collects, uses, and protects your personal data when you visit https://shopkeyonline.com or buy a software licence from us. Above all, we take your privacy seriously, and we comply fully with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), and the UK Data Protection Act 2018.
In short, this Privacy Policy tells you what data we collect, why we collect it, who we share it with, and how you can take control of your information at any time.
1. Who We Are
OFFICE ONE SUPERSTORE UK LTD operates the Shop Key Online website (referred to as “we,” “us,” or “our” in this Privacy Policy). We are a company registered in England and Wales, and we act as the data controller for the personal data we collect through https://shopkeyonline.com.
You can contact us at any time using the details in Section 14 — Contact Us below.
2. What Personal Data We Collect
We collect only the data we genuinely need to process your order, deliver your software, and improve your experience. Specifically, we collect the following types of personal data:
Information you give us directly
- Account details: name, email address, password (encrypted)
- Order details: billing address, telephone number, products purchased, order history
- Payment data: we do not store your card number or CVV — our payment partners handle this directly (see Section 5)
- Communications: messages you send us via the contact form, live chat, email, or phone
- Newsletter: email address if you subscribe to our marketing list
- Reviews: name and review text if you leave product feedback
Information we collect automatically
- Log data: IP address, browser type and version, operating system, referring page, pages visited, time and date of visit, time spent on each page
- Cookies and tracking: small files that remember your preferences, cart contents, and language/currency settings (see Cookie Policy)
- Device data: screen resolution, device type, and approximate location (city-level, derived from IP)
3. How We Collect Your Personal Data
We collect your data in three ways:
- Directly from you — when you create an account, place an order, contact our support team, or subscribe to our newsletter
- Automatically — through cookies, analytics tools, and server logs as you browse the site
- From third parties — such as payment processors confirming that a transaction succeeded
4. Why We Use Your Personal Data (Lawful Basis)
Under UK and EU GDPR, we must have a lawful basis for every type of data processing. Therefore, we have set out below exactly why we use your information and the legal grounds for doing so:
| Purpose | Lawful Basis |
|---|---|
| Processing your order and delivering your product key | Performance of a contract |
| Providing customer support and resolving issues | Performance of a contract |
| Managing your account and order history | Performance of a contract |
| Sending marketing emails and special offers | Consent (you can withdraw at any time) |
| Detecting and preventing fraud | Legitimate interests |
| Improving our website and services with analytics | Legitimate interests / Consent (for non-essential cookies) |
| Complying with legal, accounting, or tax obligations | Legal obligation |
5. Who We Share Your Personal Data With
We do not sell or rent your personal data to anyone — ever. However, in order to run our business, we share specific data with carefully selected third-party processors who help us deliver our service. Each one is bound by a Data Processing Agreement (DPA) and can use your data only for the purposes we authorise.
| Processor | Purpose | Data Shared |
|---|---|---|
| Stripe | Card payment processing | Name, billing address, card details (collected directly by Stripe) |
| PayPal | PayPal payment processing | Email, name, billing address (handled directly by PayPal) |
| Tawk.to | Live chat support | Name (if provided), email (if provided), chat transcript, IP |
| Google Analytics | Website usage analytics | Anonymised IP, page views, device data |
| Google AdSense / DoubleClick | Advertising | Cookie identifiers, browsing behaviour |
| Email service provider | Order confirmations and newsletter | Email address, name |
| Web hosting provider | Website hosting and security | All data stored on our website |
| Cloudflare | CDN and security/anti-bot protection | IP address, browser data |
In addition, we may disclose your data to law enforcement, regulators, or other authorities if the law requires us to do so.
6. International Data Transfers
Some of our processors (for example, Stripe, PayPal, Google, and Tawk.to) are based outside the UK and EU, primarily in the United States. Whenever we transfer your data outside the UK/EEA, we make sure appropriate safeguards are in place. Specifically, we rely on:
- Standard Contractual Clauses approved by the UK Information Commissioner’s Office (ICO) and the European Commission
- The UK-US Data Bridge and the EU-US Data Privacy Framework where the processor is certified
- Additional technical and organisational measures, such as encryption and access controls
7. How Long We Keep Your Personal Data
We keep your personal data only for as long as we need it. Specifically:
- Order and invoice records: 6 years after the order date (to comply with UK tax and accounting law)
- Account data: for as long as your account remains active, plus 12 months after closure
- Marketing data: until you unsubscribe or withdraw consent
- Support tickets and chat logs: 24 months from the date of the conversation
- Website analytics: typically 14 months in Google Analytics
- Server logs: 30 days for security and fraud-prevention purposes
Once these periods expire, we either securely delete your data or anonymise it so we can no longer identify you.
8. Cookies and Tracking Technologies
We use cookies and similar technologies to make our website work, remember your preferences, analyse traffic, and show relevant offers. You can manage your cookie preferences at any time through the cookie banner or your browser settings. For full details on which cookies we use and how to control them, please see our Cookie Policy.
9. Your Rights Under GDPR
Under UK and EU GDPR, you have the following rights regarding your personal data:
- Right to be informed — to know what data we collect and why (this Privacy Policy explains it)
- Right of access — to request a copy of the personal data we hold about you
- Right to rectification — to correct any inaccurate or incomplete data
- Right to erasure (“right to be forgotten”) — to ask us to delete your data, subject to legal retention requirements
- Right to restrict processing — to ask us to pause processing your data in certain situations
- Right to data portability — to receive your data in a portable format or have it transferred to another provider
- Right to object — to object to processing based on legitimate interests, including profiling and direct marketing
- Right to withdraw consent — at any time, where we rely on consent (for example, marketing emails)
- Right not to be subject to automated decision-making — including profiling that produces legal effects
To exercise any of these rights, please contact us using the details in Section 14. We will respond within 30 days, and we will not charge you for the request (except in rare cases where the request is excessive or repetitive).
Furthermore, if you believe we have not handled your data correctly, you have the right to complain to the UK Information Commissioner’s Office (ICO):
- Website: ico.org.uk
- Helpline: 0303 123 1113
If you are located in the EU, you can also complain to your local data protection authority.
10. Data Security
We take the security of your personal data seriously. Therefore, we use a combination of technical and organisational measures to protect it:
- Site-wide 256-bit SSL/TLS encryption (HTTPS)
- Encrypted password storage using industry-standard hashing
- PCI-DSS-compliant payment processing through Stripe and PayPal
- Firewall and bot-protection services through Cloudflare
- Restricted internal access on a need-to-know basis
- Regular software updates and security patches
However, no method of internet transmission or electronic storage is 100% secure. While we do everything we reasonably can to protect your data, we cannot guarantee absolute security. As a result, you should keep your account password confidential and notify us immediately if you suspect unauthorised access.
11. Links to Other Websites
Our website may contain links to third-party websites that we do not operate (for example, Microsoft, AVG, McAfee). If you click on a third-party link, you will be directed to that party’s site. Importantly, we have no control over the content, privacy policies, or practices of any third-party site. Therefore, we strongly advise you to review the privacy policy of every website you visit.
12. Children’s Privacy
Our website and services are not directed at anyone under the age of 16. Furthermore, we do not knowingly collect personal data from children under 16. If you are a parent or guardian and you believe your child has provided us with personal data, please contact us immediately. As a result, we will delete that information from our records.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other reasons. Whenever we make material changes, we will post the updated version on this page and update the “Last updated” date at the top. Therefore, we encourage you to review this Privacy Policy periodically.
14. Contact Us
If you have any questions about this Privacy Policy, want to exercise your data protection rights, or wish to raise a complaint, please contact us:
Data Controller: OFFICE ONE SUPERSTORE UK LTD
Email: Through our Contact Form
Phone/WhatsApp: +44 0743 887 5393
Live Chat: Click to Chat
We will respond to your enquiry as quickly as possible, and always within 30 days.
