Privacy Policy
Last updated November 7, 2026. This notice explains what personal data Lootora collects, why, and your rights under the UK GDPR and the Data Protection Act 2018 and, where it applies to you, the EU GDPR.
1. Controller
The controller is KRENHOLM LIMITED, company number 17546294, registered office 7 High Street, Kington, HR5 3AX, United Kingdom, trading as Lootora, which runs the shop. We have not appointed a data protection officer because we are not required to.
2. What we collect
- Account: your name, email address and a one-way hash of your password.
- Orders: what you bought, prices, payment status, the time you asked for supply within the cancellation period, and any cancellation.
- Keys: the codes supplied to you, stored encrypted, when you confirmed the order details and when you first revealed each one.
- Payment: a reference from our payment provider. We never see or store your full card number.
- Security: your IP address when you check out (passed to our payment provider for its fraud checks), the result of the Cloudflare Turnstile check on forms, and short-lived counters of sign-in and form attempts. Those counters are keyed to a one-way hash, never your IP address or email in plain text, and are cleared out once they expire (15 minutes to an hour).
- Messages you send us through the contact form.
Most of this data comes directly from you. Payment status and fraud-check results come from our payment provider. Where you do not provide data we need to create your account or take payment, we cannot supply the order.
Our staff are notified of each order through a private Telegram group: your name, email address, billing country, IP address at checkout, what you ordered and its payment status. Keys are never sent there.
3. Why we use it, and on what basis
| Purpose | Legal basis |
|---|---|
| Create your account and supply what you buy | Performance of a contract (Art. 6(1)(b) GDPR) |
| Keep tax and accounting records | Legal obligation (Art. 6(1)(c)) |
| Prevent fraud and misuse, including holding some orders for a manual check, and protect forms from bots | Legitimate interests (Art. 6(1)(f)) in keeping the shop, buyers and card holders safe |
| Answer your messages and handle complaints | Legitimate interests (Art. 6(1)(f)), or contract where your message concerns an order |
| Record your request for supply and cancellation choices | Legal obligation and legitimate interests (proving compliance with consumer law) |
We do not use your data for marketing and do not send marketing emails. We email you only about your account and orders.
4. Automated decisions
Our payment provider runs automated fraud checks. If an order is held, it is reviewed by a person before we decide to refuse it. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.
5. Transfers outside the UK and the EEA
Where a provider processes data outside the United Kingdom and the European Economic Area, it does so under adequacy regulations or an adequacy decision (for example the EU–US Data Privacy Framework and its UK Extension where the provider is certified) or standard contractual clauses with the UK Addendum. You can ask us for details of the safeguards used.
Telegram, which we use for the staff order notifications described in section 2, may process that data outside the United Kingdom and the EEA.
6. Security
We protect your data with measures such as encrypted storage of keys, hashed passwords, access controls for staff, and encrypted connections (HTTPS). No online service is completely secure, so please use a strong, unique password.
7. Your rights
You can ask for a copy of your data, ask us to correct or delete it, ask us to restrict how we use it, ask to receive data you gave us in a portable format, and object to processing based on legitimate interests. Where we rely on your consent, you can withdraw it at any time. Write to us at the contact address above; we will answer within one month.
You can complain to a data protection authority, including the Information Commissioner's Office in the UK (ico.org.uk) or the authority in the country where you live or work.
8. Children
The Shop is intended for adults. We do not knowingly collect data from children without a parent or guardian’s permission. If you think a child has given us data, contact us and we will delete it.
9. Cookies
How we use cookies is explained in our Cookie policy.
10. Changes
We will update this notice when our use of data changes and show the date of the latest update above. For material changes we will tell account holders by email.