Privacy Policy

This policy explains what happens to your personal data when you use abucares.abuniverse.com and our related sites (including account.abuniverse.com, events.abuniverse.com and newsletter.abuniverse.com), our Telegram bot and text alerts, and our regional storefronts: us.abuniverse.com, ca.abuniverse.com, au.abuniverse.com, uk.abuniverse.com, eu.abuniverse.com and jp.abuniverse.com.

Personal data is any information that can identify you, such as your name, email address or IP address. Some of it you give us directly, for example when you create an account or send a support request. Some is collected automatically when you visit, mostly technical data such as your browser type and the time of your visit.

Who is responsible

Each storefront is run by a separate company. The company responsible for your data is the one tied to the storefront you use:

us.abuniverse.com, au.abuniverse.com: Strom Holdings LLC, 3335 Paine Ave, Everett, WA 98201, United States
ca.abuniverse.com: Strom International Corporation, 3915 78 Avenue Southeast, Bay A, Calgary, Alberta T2C 2J6, Canada
uk.abuniverse.com, eu.abuniverse.com: Strom Holdings UK Ltd, Burnside House, Hexham Business Park, Burn Lane, Hexham NE46 3RU, England
jp.abuniverse.com: 株式会社Strom Holdings Japan, 33-4 Yamagawa-cho, Ashikaga, Tochigi 326-0021, Japan

EU address: Strom Holdings UK Ltd, Wainer Straße 5, 89165 Dietenheim, Germany.

Our support site and account system are shared across all storefronts. For an order, the responsible company is the one whose storefront the order was placed on. All companies can be reached at abucares@abuniverse.com.

Hosting and infrastructure

Hetzner

On infrastructure runs on servers in Germany provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Everything you send to our sites is stored and processed on these servers.

We use Hetzner on the basis of our legitimate interest in reliable, secure hosting (Art. 6(1)(f) GDPR). Processing takes place in Germany. We have a data processing agreement with Hetzner. More information: Hetzner Privacy Policy.

Cloudflare

Our sites are delivered through Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. All traffic between your browser and our sites passes through Cloudflare's network. This lets Cloudflare deliver our pages quickly and filter out malicious traffic before it reaches our servers. To do this, Cloudflare processes your IP address and technical details of your requests. Files uploaded to our sites, such as support attachments and résumés, are stored with Cloudflare.

We use Cloudflare on the basis of our legitimate interest in delivering our sites securely and without disruption (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-U.S. Data Privacy Framework and its UK Extension. We have a data processing agreement with Cloudflare. More information: Cloudflare Privacy Policy.

Data we collect on our sites

Server logs

Each time you open a page, our servers automatically record your IP address, the date and time, the page requested, the page you came from, and your browser and operating system. We do not combine these logs with other data. We use them to keep our sites running, investigate errors and defend against attacks, and delete them after a short period.

Legal basis: our legitimate interest in operating secure, working sites (Art. 6(1)(f) GDPR).

Cookies

Cookies are small text files your browser stores for a website. Our sites only use cookies that are strictly necessary to provide the service you ask for. None are used for advertising or tracking, so no consent is needed for them.

Cookie	Purpose	Lifetime
abucares-session	Keeps you signed in and secures your session	14 days
XSRF-TOKEN	Protects forms against forged requests	14 days
remember_web_*	Keeps you signed in between visits	14 days
abu_region	Remembers your storefront region	1 year
abu_language	Remembers your language	1 year
abu_auth	Records that you are signed in, so our sites show the right menus	30 days
abu_staff	Shows staff tools to our team members	30 days
appearance	Remembers your light or dark theme	1 year
sidebar_state	Remembers whether the sidebar is open	7 days

Legal basis: storing these cookies is strictly necessary for the service you request (for example § 25(2) TDDDG in Germany); the processing rests on our legitimate interest in a working site (Art. 6(1)(f) GDPR). You can block or delete cookies in your browser settings, but signing in will then no longer work. Our storefronts set their own cookies; see Our storefronts below.

Your account

When you create an account we store your name, email address, password (only in encrypted form), region and language. If you add them, we also store your pronouns, date of birth and profile photo. Your email address identifies your account and is required; everything else is optional. Your profile is also kept in our self-hosted helpdesk, so our team sees the right details when you contact us.

We keep your account data until you delete your account or ask us to. Legal basis: providing the account you asked for (Art. 6(1)(b) GDPR).

Support requests

When you contact us through our support site, by email or through our Telegram bot, we store your message, any files you attach and your contact details in our self-hosted helpdesk, so we can answer you and follow up.

Legal basis: handling your order or contract (Art. 6(1)(b) GDPR); for other questions, our legitimate interest in answering them (Art. 6(1)(f) GDPR). We keep support conversations as long as needed to resolve and document them.

Orders

When you look up or manage an order through your account or our Telegram bot, we fetch it from Shopify using your order number and email address. We do not keep our own copy of your order history.

Legal basis: performing your purchase contract (Art. 6(1)(b) GDPR).

Order feedback and Trustpilot

After an order, we may email you a short feedback form on our own site. The form has an optional box to also receive a review invitation from Trustpilot. Only if you tick it do we pass your email address to Trustpilot, which then sends you the invitation.

Legal basis: our legitimate interest in improving our products and service for the feedback request (Art. 6(1)(f) GDPR); your consent for the Trustpilot invitation (Art. 6(1)(a) GDPR). Trustpilot is Trustpilot A/S, Pilestraede 58, 5th floor, 1112 Copenhagen K, Denmark, so this processing stays within the EU. More information: Trustpilot Privacy Policy.

If you sign up for our newsletter, we store your email address, your region and where you signed up. The newsletter runs on our own mailing list system, hosted on our servers, and no third-party marketing platform receives your address. Every newsletter has an unsubscribe link.

Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by unsubscribing. We keep your address until you unsubscribe.

Telegram order updates

If you link a Telegram account to receive order updates, we store your Telegram chat ID and the messages exchanged with our bot. Linking does not share your phone number with us. You can unlink at any time.

Legal basis: your consent (Art. 6(1)(a) GDPR). Telegram Messenger Inc. delivers the messages as an independent provider under its own terms; its EU representative is EDPO, Avenue Huart Hamoir 71, 1030 Brussels, Belgium. More information: Telegram Privacy Policy.

Restock text alerts

If you sign up for a back-in-stock text alert, we store your phone number and use it only to send that alert. The text is delivered through our SMS delivery provider.

Legal basis: your consent (Art. 6(1)(a) GDPR).

Events

If you submit an event, we publish the event details you enter, including the organiser name and link, and record which account submitted it so you can manage it.

Legal basis: providing the listing you asked for (Art. 6(1)(b) GDPR).

Job applications

If you apply for a role, we store the contact details and documents you submit, including your résumé. Résumés are stored separately from other data and are never public. If you agree, we keep your application for future openings; you can withdraw that at any time.

Legal basis: steps taken at your request before a possible employment contract (Art. 6(1)(b) GDPR); your consent for keeping your application for future openings (Art. 6(1)(a) GDPR).

Spam protection (Cloudflare Turnstile)

Some forms, such as support requests, job applications, event submissions and complaints, use Cloudflare Turnstile to tell people apart from bots. Turnstile runs in your browser and sends technical data about your browser and device, including your IP address, to Cloudflare for this check.

Legal basis: our legitimate interest in keeping our forms free of abuse (Art. 6(1)(f) GDPR).

Email delivery (Amazon SES)

We send account, order and support emails through Amazon Simple Email Service, provided by Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109-5210, USA; in the EU, Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. Amazon receives your email address and the content of each email in order to deliver it. Emails are processed in the United States. Amazon Web Services is certified under the EU-U.S. Data Privacy Framework and its UK Extension.

Legal basis: providing your account and orders (Art. 6(1)(b) GDPR). We have a data processing agreement with Amazon Web Services. More information: AWS Privacy Notice.

Signing in with another service

Instead of a password or email link, you can sign in with one of the services below. For each one you use, we store the service's account ID for you, the email address if the service shares one (and whether it is verified), your display name, and when you linked it and last signed in with it. We do not receive your contacts, posts or passwords. If a service does not share an email address, we ask you for one before creating your account.

You can unlink a service in your account settings at any time. Legal basis: your consent, given by choosing that service (Art. 6(1)(a) GDPR). Each service acts under its own privacy policy for the sign-in itself.

Google

Provided in the EU by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and elsewhere by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google shares your account ID, email address and name with us. More information: Google Privacy Policy.

Apple

Provided in the EU and UK by Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, and elsewhere by Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA. Apple shares your account ID and email address, and your name on your first sign-in. If you use Hide My Email, we receive an Apple relay address instead of your real one. More information: Apple Privacy Policy.

Discord

Provided in the EU by Discord Netherlands BV, Schiphol Boulevard 195, 1118 BG Schiphol, Netherlands, and elsewhere by Discord Inc., 444 De Haro Street #200, San Francisco, CA 94107, USA. Discord shares your account ID, email address and display name with us. More information: Discord Privacy Policy.

LINE

Available on our Japanese sites. Provided by LY Corporation, Kioi Tower, Tokyo Garden Terrace Kioicho, 1-3 Kioicho, Chiyoda-ku, Tokyo 102-8282, Japan. LINE shares your account ID and display name, and your email address if you allow LINE to share it. More information: LY Corporation Privacy Policy.

X

Provided in the EU and UK by X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland. X shares your account ID, display name and handle. It does not share an email address. More information: X Privacy Policy.

Reddit shares your account ID and username. It does not share an email address. More information: Reddit Privacy Policy.

Provided by Telegram Messenger Inc.; its EU representative is EDPO, Avenue Huart Hamoir 71, 1030 Brussels, Belgium. Telegram shares your account ID, name and username. It does not share your phone number. More information: Telegram Privacy Policy.

Maps (Google Maps)

Our store locator and event pages show maps from Google Maps. The map loads directly from Google, so Google receives your IP address and browser information when you view it, and may set its own cookies. Addresses you type into an address search are sent to Google to suggest matches.

Legal basis: our legitimate interest in showing locations clearly and making them easy to find (Art. 6(1)(f) GDPR). The provider in the EU is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may process data in the United States; Google is certified under the EU-U.S. Data Privacy Framework and its UK Extension. More information: Google Privacy Policy.

Our storefronts

Shopify

Our storefronts, checkout and payments run on Shopify, provided in the EU and UK by Shopify International Limited, 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland, and in the US and Canada by Shopify Inc., 151 O'Connor Street, Ground Floor, Ottawa, Ontario K2P 2L8, Canada. Shopify processes your order, payment and delivery details for us. Shopify sets the cookies the store needs to work, such as for your cart, checkout and sign-in. With your consent, Shopify also collects statistics about how you use the store.

Shopify handles some data on its own account, for example for fraud prevention and for the Shop app and Shop Pay if you use them. That processing is covered by Shopify's own policies: the Shopify Privacy Policy and the Shopify Consumer Privacy Policy, which covers the Shop app and Shop Pay.

Legal basis: performing your purchase contract (Art. 6(1)(b) GDPR) for the store, cart and checkout; your consent (Art. 6(1)(a) GDPR) for statistics.

Google Analytics

With your consent, our storefronts use Google Analytics to measure how visitors use them, for example which pages are viewed and how visitors found the store. Google Analytics sets cookies and processes your IP address and details of your device and browser. We use the results to improve the store.

Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in the storefront's cookie settings. The provider in the EU is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may process data in the United States; Google is certified under the EU-U.S. Data Privacy Framework and its UK Extension. More information: Google Privacy Policy.

International transfers

Our servers are in Germany, but some of the providers above are based in the United States, and our systems are operated from the United States. When data leaves the EU or UK, the transfer relies either on an adequacy decision (for the UK, Canada, Japan, and US companies certified under the EU-U.S. Data Privacy Framework and its UK Extension) or on the European Commission's standard contractual clauses with the UK Addendum.

How long we keep your data

Unless a section above names a specific period, we keep your data only as long as we need it for the purpose it was collected for. When you ask us to delete your data or withdraw your consent, we delete it, unless the law requires us to keep it longer, for example order and tax records. In that case we delete it once that period ends.

Your rights

Under the GDPR and UK GDPR you have the right to:

Access: find out what personal data we hold about you, where it came from, who received it and why we process it (Art. 15)
Correction: have inaccurate data corrected (Art. 16)
Deletion: have your data deleted (Art. 17)
Restriction: have us limit processing, for example while we check a disputed correction (Art. 18)
Portability: receive data you gave us in a common, machine-readable format, or have it sent to another provider where technically possible (Art. 20)
Withdrawal of consent: withdraw any consent at any time, with effect for the future (Art. 7(3))
Complaint: complain to a data protection supervisory authority, in particular in the country where you live, work or where the issue occurred (Art. 77)

Right to object (Art. 21 GDPR): where we process your data based on our legitimate interests, you can object at any time for reasons arising from your particular situation. We will then stop, unless we have compelling legitimate grounds that override your interests, or we need the data to establish, exercise or defend legal claims. You can object to the use of your data for direct marketing at any time, without giving reasons.

To use any of these rights, email abucares@abuniverse.com. This is free of charge.

Automated decisions

We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects on you.

Encryption

All our sites use TLS encryption, shown by "https://" and the lock icon in your browser's address bar. Data you send us over an encrypted connection cannot be read by third parties in transit. No transmission over the internet is completely secure, but we protect your data with appropriate technical and organisational measures.

Children

Our services are not directed at children. Account holders must be of legal age in their state, province or country, as set out in our Terms of Service.

Changes to this policy

We update this policy when our services or the law change. The date at the top shows when it last changed.

Contact

Questions about this policy or your data: abucares@abuniverse.com.