Privacy Policy

This Privacy Policy explains how DAD.gg ("we", "us", or "our") collects, uses, stores, and protects your personal data when you visit our website, browse our store, verify your email, or purchase digital products from us.

We are committed to protecting your privacy and to complying with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Finnish Data Protection Act (Tietosuojalaki). This policy describes your rights and how you can exercise them.

This policy applies to all visitors and customers of DAD.gg. It does not apply to the websites or services of third parties, such as our payment processor, which have their own privacy policies.

The data controller responsible for your personal data is the legal entity that operates DAD.gg. The controller determines the purposes and means of processing your personal data.

We collect only the personal data necessary to operate the Service and fulfill your orders. The categories of data we may collect include:

Information you provide

• Email address: Used for email verification, order confirmation, delivery, and customer support. This is required for guest checkout.
• Order details: The products you purchase, quantities, and the order total.
• Account information: If you create a registered account, your email and any profile details you provide.

Information collected automatically

• IP address: Used for security, rate limiting on verification codes, and fraud prevention.
• Technical data: Browser type, device information, and usage data collected through cookies and similar technologies (see Section 5).
• Verification data: A hashed record of one-time verification codes, used only to validate your email and then deleted.

Payment data

We do not collect or store your cryptocurrency wallet private keys, seed phrases, or full payment credentials. Cryptocurrency payments are processed by NOWPayments, our payment processor. We receive only the payment status, the cryptocurrency and amount, and the destination address associated with your order. See Section 6 for details on NOWPayments.

We process your personal data for the following purposes, each with a corresponding legal basis under the GDPR:

• Order fulfillment and delivery — to process your order, confirm payment, and deliver digital products. Legal basis: performance of a contract (Article 6(1)(b)).
• Email verification — to send and validate one-time codes that protect against fraud and ensure we can reach you. Legal basis: our legitimate interests in security and fraud prevention (Article 6(1)(f)).
• Customer support — to respond to your questions and complaints about your order. Legal basis: performance of a contract or legitimate interests.
• Security and rate limiting — to protect the Service from abuse, unauthorized access, and automated attacks. Legal basis: legitimate interests (Article 6(1)(f)).
• Legal obligations — to comply with applicable laws, including accounting and tax record-keeping requirements. Legal basis: legal obligation (Article 6(1)(c)).

We do not use your personal data for marketing or profiling unless you have given us separate consent. We do not sell your personal data to third parties.

DAD.gg uses cookies and similar technologies to maintain your session, keep your cart contents, and support the authentication and guest-session features of the website.

• Session cookies: Used to keep you logged in or to maintain your verified guest session. These are necessary for the Service to function.
• Cart cookies: Used to remember the contents of your cart as you browse.

You can control or delete cookies through your browser settings. Disabling essential cookies may prevent parts of the Service, such as checkout and guest verification, from working correctly.

We share your personal data only with service providers who help us operate DAD.gg and fulfill orders, and only to the extent necessary for that purpose. Our current processors include:

• NOWPayments: Our cryptocurrency payment processor. It receives the payment amount, currency, and order reference needed to process your cryptocurrency payment. NOWPayments is an independent controller of the payment data it collects from you.
• Base44: The platform that hosts the DAD.gg website and provides the database, authentication, and email infrastructure. Base44 acts as a processor under our instructions.
• Email delivery provider: Used to send verification codes, order confirmations, and support responses to your email address.

We may also disclose your data where required by law, court order, or competent authority, or to protect our rights, safety, or the safety of others.

Some of our processors may process personal data outside the European Union or European Economic Area (EU/EEA). Where this occurs, we rely on appropriate safeguards to ensure that your data is protected to a standard equivalent to that within the EU/EEA.

These safeguards may include the European Commission's adequacy decisions for the destination country, or Standard Contractual Clauses (SCCs) adopted by the European Commission, together with any supplementary measures where necessary.

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy and to comply with legal obligations. The retention periods we apply are:

• Guest sessions: Active for 24 hours from verification. Session data is invalidated after this period.
• Verification records: One-time verification codes are deleted or rendered unusable once verified or expired.
• Order data: Retained for the duration necessary to fulfill the order, handle any complaints or refund requests, and meet accounting and tax requirements under Finnish law.
• Account data: If you create a registered account, your data is retained until you request deletion, subject to legal retention obligations.

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may ask us to correct inaccurate or incomplete data.
• Right to erasure: You may ask us to delete your personal data, subject to legal retention obligations.
• Right to restriction: You may ask us to limit the processing of your data in certain circumstances.
• Right to data portability: You may receive your data in a structured, machine-readable format and transmit it to another controller.
• Right to object: You may object to processing based on legitimate interests, unless we have compelling legitimate grounds.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing before the withdrawal.

To exercise any of these rights, please contact us using the details in Section 13. We will respond to your request within the timeframe required by the GDPR (generally within one month).

Right to lodge a complaint

If you believe that we have not handled your personal data in accordance with this policy or applicable law, you have the right to lodge a complaint with the Finnish supervisory authority, the Data Protection Ombudsman (Tietosuojavaltuutettu), or with the supervisory authority of the EU member state in which you reside.

DAD.gg is not directed at children, and we do not knowingly collect personal data from children below the age at which they can lawfully consent to the processing of their data under applicable law.

If you believe that a child has provided us with personal data without the required consent, please contact us so we can take appropriate action.

We take reasonable technical and organizational measures to protect your personal data from unauthorized access, loss, alteration, or disclosure. These measures include access controls, encryption of data in transit, rate limiting on verification endpoints, and secure server-side validation of guest sessions.

Payment data is handled by NOWPayments, which is responsible for the security of its own payment infrastructure. We do not store cryptocurrency private keys or full payment credentials.

No online service can be guaranteed to be completely secure. If a data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required, affected individuals, in accordance with the GDPR.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. When we make changes, we will post the updated policy on this page with a new effective date.

If we make material changes that affect how we process your personal data, we will bring them to your attention, for example by displaying a notice on the website or, where appropriate, by contacting you using the email address you provided.

If you have any questions about this Privacy Policy, your personal data, or your rights under the GDPR, please contact us using the details below.

We are committed to working with you to resolve any concerns about your privacy. If you are not satisfied with our response, you have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).