1. Controller and contact
Assetora is operated by the legal entity identified on the Company, Contact and Imprint Information page. That page forms part of these terms and must display the operator’s current legal name, registered address, public contact method, registration details and tax/VAT identifiers where applicable before commercial transactions are enabled.
Legal and support notices may be submitted through the Contact Assetora form and any additional channel published on the Company, Contact and Imprint Information page. Users must not send passwords, private keys or full payment-card credentials through support channels.
2. Account and profile data
We process account identifiers, email address, authentication metadata, profile details, language/preferences and account settings to create and administer accounts, provide requested services and secure access. The usual legal bases are performance of a contract or steps requested before a contract, and legitimate interests in account security and service integrity.
3. Orders, downloads and payments
We process order identifiers, product and seller information, price, tax and discount data, payment status, limited payment-provider metadata, invoices where applicable, download entitlements and download/security logs to perform purchases, provide digital access, prevent fraud and meet accounting or tax obligations. Payment card numbers are handled by the payment provider rather than stored by Assetora.
4. Seller and compliance data
For sellers we may process legal/business identity, tax and payout information, verification status, storefront details, product records, moderation history, refund/chargeback data and payout events for seller onboarding, marketplace operation, fraud prevention, legal compliance and payment administration.
5. Support, reviews, reports and moderation
We process support messages, reviews, seller replies, reports, evidence, complaint records and moderation decisions to provide support, enforce marketplace rules, protect users and establish or defend legal claims. Depending on context, the legal basis may be contract necessity, legal obligation or legitimate interests.
6. Security, device and technical data
We may process IP address, device/browser information, timestamps, login events, rate-limit data, bot/security signals, checksum and file-scan results, and audit logs for security, abuse prevention, fraud detection and service reliability. These activities generally rely on legitimate interests and, where applicable, legal obligations.
7. Cookies and analytics
Necessary storage is used to operate accounts, security and checkout. Optional analytics or marketing technologies are used only where an appropriate legal basis exists, including consent where required. See the Cookie Policy and Cookie Table for current details.
8. Recipients and processors
Personal data may be disclosed to hosting, database, object-storage, email, analytics, security, customer-support, payment, accounting, legal and other service providers where necessary for the purposes described above. Data may also be disclosed to competent authorities or rights holders where required by law or necessary to establish, exercise or defend legal claims.
9. International transfers
Where personal data is transferred outside the European Economic Area or another protected jurisdiction, Assetora will use an available lawful transfer mechanism, such as an adequacy decision or appropriate contractual safeguards, where required.
10. Retention
Data is kept only for as long as necessary for the relevant purpose. Active account data is generally retained while the account exists. Order, tax and accounting records are kept for legally required periods. Security, fraud, moderation, consent and dispute records may be retained for applicable limitation periods or while a legal claim, investigation or enforcement need remains. Technical data that is no longer necessary is deleted or anonymized.
11. Your rights
Depending on applicable law, you may have rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent. You may also have the right to complain to a competent data-protection authority. Requests may be subject to identity verification and lawful exceptions.
Document control
Permanent URL: /legal/privacy-policy. Previous versions: 1.0.