Privacy Policy

Blast Entertainment Limited, trading as Bulk Game Keys, operates this website and is the controller of the personal data described in this policy.

Registration number

72463858

Place of incorporation

Hong Kong

Registered office

UNIT 1603, 16TH FLOOR, THE L. PLAZA, 367 - 375 QUEEN'S ROAD CENTRAL, SHEUNG WAN, HONG KONG

Privacy contact

data@bulkgamekeys.com

This policy applies to the Bulk Game Keys website, trade-account portal, onboarding, support, invoices, wallet activity, and orders. It does not govern third-party platforms on which a game key is redeemed.

• Account and contact data: business name, representative's name, work email, contact numbers, account status, password hash, two-factor authentication state, and account security records.
• Business-verification data: legal company and registration details, registered address, website, business activity, purchase-volume range, sales markets, authorised representative details, owners and controllers, registration certificates, address evidence, verification answers, status, and review notes. We ask for government identity documents, bank evidence, or source-of-funds evidence only when a proportionate risk-based follow-up is needed.
• Billing and funding data: billing names and addresses, top-up amounts, invoice and payment references, payment status, wallet credits and holds, and related bank transfer information. We do not offer card checkout and do not collect card numbers through this storefront.
• Order and delivery data: products, quantities, prices, order status, delivery records, buyer acknowledgements, invalid-key claims, and records of access to delivered keys. The digital keys themselves are commercially sensitive order data.
• Technical and security data: IP address, request and event timestamps, session identifiers, device or browser information available in ordinary server logs, error reports, and security or fraud signals.
• Communications: messages, attachments, feedback, and support or dispute history when you contact us.

We normally receive this information from you or your business. We also generate records as you use the service and may receive payment confirmation from banking records, verification information from public business sources, or security and delivery information from our service providers.

We balance our legitimate interests against the rights and reasonable expectations of the people concerned. We do not currently send marketing email or use personal data for behavioural advertising. If we introduce optional marketing, we will provide the choices and notices required by law.

Basic account information is required to create and secure a trade account. Billing information is required to request funding, and order information is required to purchase and deliver keys. Business-verification information is required before purchasing, although creating an account does not guarantee approval. The verification form marks authorisation letters and general supporting documents as optional unless we explain why they are needed for your review.

We do not sell personal data. We disclose it only where needed to operate, protect, or administer the service, including to:

• infrastructure and hosting providers, including Vercel and Render;
• database and storage providers, including MongoDB Atlas;
• transactional email providers, including Mailjet;
• error monitoring and service-security providers, including Sentry;
• banks, professional advisers, auditors, insurers, and debt or dispute advisers where relevant;
• vetted suppliers and delivery partners, using limited order information where necessary to source or fulfil a purchase; and
• courts, regulators, law-enforcement bodies, tax authorities, or a buyer of all or part of our business where disclosure is lawful and necessary.

Providers may act as our processors under contract or as independent controllers for their own regulated functions. We limit access to the data reasonably needed for the relevant service.

We are established in Hong Kong and serve businesses internationally. Our providers may process data in Hong Kong, the United Kingdom, the European Economic Area, the United States, or other locations in which they operate. This means personal data may be transferred outside the country where you are located.

Where applicable law requires a transfer safeguard, we use an available legal mechanism such as an adequacy decision, approved contractual protections, or another permitted safeguard. Contact us for information about safeguards relevant to your data.

• Orders, invoices, wallet and payment records: at least seven years after the relevant transaction, or longer if required for an audit, dispute, investigation, or legal obligation.
• Account and business-verification records: while the application or account is active and afterwards only while needed for fraud prevention, compliance, a dispute, or another lawful business need. We periodically review supporting company and any follow-up identity documents and delete or restrict them when they are no longer required.
• Security, access, and service logs: for the period reasonably needed to detect abuse, investigate incidents, demonstrate delivery, and protect the service.
• Support communications: until the request is resolved and for a reasonable period afterwards to manage follow-up, complaints, and legal claims.

When retention is no longer necessary, we delete or anonymise the data unless it must be preserved by law. Backup copies may remain until the applicable backup cycle completes and are protected from ordinary use in the meantime.

We currently use only first-party storage needed to provide, secure, or remember the service you request. We do not use advertising cookies or third-party analytics cookies.

These technologies are not used to follow you across unrelated services. You can clear them through your browser, but blocking essential storage may stop sign-in, two-factor setup, checkout, or preference features from working.

We use measures appropriate to the nature of the data, including encrypted transport, hashed passwords, secure HTTP-only authentication cookies, optional two-factor authentication, role-based access controls, request-origin checks, logging, and restricted key delivery. No internet service can guarantee absolute security, so please use a unique password, protect your authenticator, enable two-factor authentication where possible, and contact us promptly if you suspect misuse.

Business verification and order approval are reviewed by people. Automated controls may prevent a transaction when, for example, an account is not approved, credit is insufficient, stock is unavailable, required confirmations are missing, or a security check fails. We do not use solely automated decision-making that produces legal or similarly significant effects about individuals. You may contact us to ask for a human review of an account or order decision.

Depending on where you are located and the law that applies, you may have rights to ask whether we hold your data, request access or correction, request deletion or restriction, object to certain uses, receive portable data, or withdraw consent where consent is the basis. These rights may be limited where we must retain records, protect another person, or establish or defend a claim.

Hong Kong data subjects have rights of access and correction under the Personal Data (Privacy) Ordinance. UK and EEA data subjects may also complain to their local supervisory authority. You may contact the Hong Kong Office of the Privacy Commissioner for Personal Data or the UK Information Commissioner's Office, as applicable.

To exercise a right, email data@bulkgamekeys.com. We may need to verify your identity and authority before responding.

Bulk Game Keys is for business buyers and authorised business representatives aged 18 or over. It is not directed to children, and we do not knowingly seek personal data from anyone under 18.

We keep this policy under review. If a change materially affects how we use existing personal data, we will provide appropriate notice before the new use begins. The effective date at the top identifies the current version.

Questions, complaints, access requests, and correction requests should be sent to data@bulkgamekeys.com or by post to our registered office stated in section 1.