Privacy Policy

This policy covers abucares.abuniverse.com and our related sites (including account.abuniverse.com, events.abuniverse.com and newsletter.abuniverse.com), our Telegram bot and our storefronts us.abuniverse.com, ca.abuniverse.com, au.abuniverse.com, uk.abuniverse.com, eu.abuniverse.com and jp.abuniverse.com.

Who is responsible

The company responsible for your data is:

Strom Holdings UK Ltd
Wainer Straße 5
89165 Dietenheim
Germany
Phone: +44 161 394 0362

For an order, the responsible company is the one whose storefront the order was placed on. Contact: abucares@abuniverse.com.

Shopping

Ordering and checkout

Our storefronts, checkout and payments run on Shopify International Limited, 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland (in the US and Canada: Shopify Inc., 151 O'Connor Street, Ground Floor, Ottawa, Ontario K2P 2L8, Canada), which hosts the storefronts and processes your data on our behalf. Shopify Privacy Policy.

When you browse or order, we process your contact details (name, billing and shipping address, phone number, email address), payment details, and transaction details (items viewed, added to your cart, purchased, returned or exchanged), as well as device and usage data. We use them to process your payment, fulfil and ship your order, handle returns and exchanges, and send order notifications, to perform your contract (Art. 6(1)(b) GDPR); to prevent fraud and secure checkout, based on our legitimate interest (Art. 6(1)(f) GDPR); and to keep order and tax records as required by law (Art. 6(1)(c) GDPR). We keep order and invoice records for the statutory retention periods, up to 10 years.

Shipping

We pass your name, shipping address and phone number to the carrier delivering your order, to perform your contract (Art. 6(1)(b) GDPR).

Shop Pay and the Shop app

If you use Shop Pay or the Shop app, Shopify processes your data on its own account. Shopify also uses data about your interactions with our store and other Shopify stores for its own enhanced features; Shopify is responsible for that processing and for requests about it. Shopify Consumer Privacy Policy, Shopify Privacy Portal.

Your account

Account data

We store your name, email address, password (hashed), region and language, and optionally your pronouns, date of birth and profile photo, to provide your account across ABUniverse services (Art. 6(1)(b) GDPR). Only the email address is required. We keep this data until your account is deleted.

Signing in with another service

If you sign in with one of the services below, we store the account ID, email address (if shared), display name and sign-in dates it provides, based on your consent (Art. 6(1)(a) GDPR). We keep this until you unlink the service in your account settings or delete your account.

• Google: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; outside the EU Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google Privacy Policy.

• Apple: Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland; outside the EU and UK Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA. Apple Privacy Policy.

• Discord: Discord Netherlands BV, Schiphol Boulevard 195, 1118 BG Schiphol, Netherlands; outside the EU Discord Inc., 444 De Haro Street #200, San Francisco, CA 94107, USA. Discord Privacy Policy.

• LINE: LY Corporation, Kioi Tower, Tokyo Garden Terrace Kioicho, 1-3 Kioicho, Chiyoda-ku, Tokyo 102-8282, Japan. LY Corporation Privacy Policy.

• X: X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland. X Privacy Policy.

• Telegram: Telegram Messenger Inc. (EU representative: EDPO, Avenue Huart Hamoir 71, 1030 Brussels, Belgium). Telegram Privacy Policy.

Contacting us

Support requests

When you contact us through our support site, by email, by SMS or through our other support channels, we store your messages, attachments and contact details to answer you, to fulfil your contract (Art. 6(1)(b) GDPR) or otherwise based on our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We keep support conversations as business correspondence for the retention periods required by law.

Order feedback and Trustpilot

After an order we may ask for feedback, based on our legitimate interest in improving our service (Art. 6(1)(f) GDPR). If you tick the box on the feedback form, we pass your email address to Trustpilot A/S, Pilestraede 58, 5th floor, 1112 Copenhagen K, Denmark, which sends you a review invitation, based on your consent (Art. 6(1)(a) GDPR). Trustpilot Privacy Policy.

Emails and notifications

Email delivery

We send our emails, both transactional emails and newsletters, through Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109-5210, USA (in the EU: Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg), which receives your email address and the email content. For transactional emails this serves to perform your contract (Art. 6(1)(b) GDPR); for newsletters it is based on your consent (Art. 6(1)(a) GDPR). AWS Privacy Notice.

Newsletter

We store your email address, region and signup source to send the newsletter, based on your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time.

Telegram order updates

If you link a Telegram account, we store your Telegram chat ID and bot messages to send order updates through Telegram, based on your consent (Art. 6(1)(a) GDPR). We keep this until you unlink your Telegram account.

Events and jobs

Events

Event listings submitted by users are user-generated content. If you submit an event, we store the details you enter, including organiser name and link, venue and address, and which account submitted it. We review submissions before publishing them. Published events, including the organiser name and link, are visible to everyone. We process this to provide the listing you asked for (Art. 6(1)(b) GDPR). We keep your event until you ask us to remove it, which you can do at any time.

Job applications

If you apply for a role, we store your name, email address, phone number, city, the documents you upload (such as your résumé) and your answers in the application form, such as your field, availability, languages and willingness to relocate. We process this to handle your application (Art. 6(1)(b) GDPR). If you agree, we keep your application on file for future openings based on your consent (Art. 6(1)(a) GDPR) until you withdraw it. Otherwise we delete your application 30 days after the job posting has expired.

Visiting our sites

Hosting

Our infrastructure runs on servers in Germany provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner Privacy Policy. Our sites are delivered and protected by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, which processes your IP address and request details and stores files uploaded to our sites. Cloudflare Privacy Policy. Our storefronts are hosted by Shopify, which processes your IP address, device and usage data when you visit them. All of this is based on our legitimate interest in delivering our sites securely (Art. 6(1)(f) GDPR).

Server logs

Our servers log your IP address, date and time, the page requested, the referring page, and your browser and operating system to operate and secure our sites, based on our legitimate interest (Art. 6(1)(f) GDPR). Logs are deleted after 14 days.

Spam protection

Some of our forms use Cloudflare Turnstile. When such a form loads, Turnstile checks your IP address, browser and device characteristics and interaction signals, and sends them to Cloudflare to tell people apart from bots. This is based on our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR). Cloudflare may process this data in the United States and is certified under the EU-U.S. Data Privacy Framework.

Maps

Our store locator and event pages show maps from Google Maps. The map loads when you open the page, so Google receives your IP address and browser data, and may set cookies or use local storage on your device. Addresses you type into an address search are also sent to Google. This is based on our legitimate interest in showing locations clearly (Art. 6(1)(f) GDPR). Google may process this data in the United States and is certified under the EU-U.S. Data Privacy Framework.

Cookies and analytics

Our sites

Our sites only use strictly necessary cookies, based on our legitimate interest in a working site (Art. 6(1)(f) GDPR):

Storefronts: necessary cookies

Always set, to perform your contract (Art. 6(1)(b) GDPR):

Storefronts: analytics and advertising

With your consent (Art. 6(1)(a) GDPR), Shopify collects usage statistics on our storefronts, Google Analytics measures store usage using your IP address and device data, and Shopify and our advertising partners use your storefront activity to show you personalised advertising on other websites. You can withdraw consent at any time in the storefront's cookie settings. These cookies are only set with your consent:

International transfers

We may process your data outside the country you live in. Transfers out of the EU or UK rely on an adequacy decision or on the European Commission's standard contractual clauses and their UK equivalent.

Retention

Unless stated above, we keep data only as long as needed for its purpose, or longer where the law requires, such as order and tax records.

Your rights

Under the GDPR and UK GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), to withdraw consent at any time with effect for the future (Art. 7(3)), and to complain to a supervisory authority (Art. 77).

Right to object (Art. 21 GDPR): you may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests, and at any time to processing for direct marketing.

To exercise your rights, email abucares@abuniverse.com.