Privacy policy

Privacy Policy

Last updated: 5 August 2026

QPlay GmbH ("QPlay", "we", "us", "our") operates the online store at https://www.qplayy.com/ (the "Store"). This Privacy Policy explains what personal data we collect, why we collect it, how we use it, who we share it with, how long we keep it, and what rights you have.

This policy is written in accordance with the EU General Data Protection Regulation (GDPR) (Regulation 2016/679), the UK GDPR, and applicable national implementing laws - including the German Federal Data Protection Act (BDSG), the German Telecommunications-Digital Services Data Protection Act (TDDDG), the Dutch UAVG, the French Loi Informatique et Libertes, the Belgian Act of 30 July 2018 on the Protection of Natural Persons with Regard to the Processing of Personal Data, and the Spanish Organic Law 3/2018 on Data Protection (LOPDGDD).

This policy applies to orders placed and data collected through https://www.qplayy.com/.

 

1. Data Controller

The data controller responsible for your personal data is:

QPlay GmbH Neumarkt 39 50667 Koln, Germany Commercial register: Amtsgericht Koln, HRB 90621 VAT ID: DE321170983 Email: info@qplayy.com Phone: +34 651 54 13 96

For data protection enquiries, you can contact us at the email address or postal address above.

United Kingdom: QPlay does not currently offer goods or services to customers in the United Kingdom. If we begin selling to the UK, we will appoint a UK representative under Article 27 of the UK GDPR and publish their contact details in this section.

 

2. What Personal Data We Collect

We collect personal data that you provide directly to us, and data that is generated automatically when you visit or use the Store.

Data you provide directly

  • Identity data: your name and, where relevant, company name.

  • Contact data: email address, delivery address, billing address, and phone number.

  • Order data: products ordered, order history, order status, payment status, and any returns or refund requests.

  • Communication data: messages you send to our customer service team and our replies.

  • Account data: if you create an account, your login credentials and account preferences.

  • Consent records: records of the marketing consent or cookie consent choices you make on the Store.

 

Data collected automatically

  • Technical data: IP address, browser type and version, device type, operating system, and time zone setting.

  • Usage data: pages visited, products viewed, time spent on pages, referring URLs, and other browsing behaviour on the Store.

  • Cookie data: data stored via cookies and similar technologies placed on your device when you visit the Store - see Sections 8 and 9 for full details.

We do not collect special categories of personal data (such as health data, racial or ethnic origin, religious beliefs, genetic or biometric data) and do not knowingly collect personal data from children under the age of 16.

 

3. How We Collect Your Personal Data

We collect your personal data through the following means:

  • Directly from you: when you place an order, create an account, contact our customer service team, subscribe to our newsletter, or otherwise interact with the Store.

  • Automatically: through cookies and similar tracking technologies placed on your device when you visit the Store. Consent is requested before any non-essential cookies are placed - see Sections 8 and 9.

  • From third parties: Shopify, our e-commerce platform provider, shares technical and transactional data with us in connection with operating the Store.

 

4. Purposes and Legal Basis for Processing

We only process your personal data where we have a lawful basis under Article 6 of the GDPR. The table below sets out each processing purpose, the personal data used, and the applicable legal basis.

Purpose

Personal data used

Legal basis

Processing and fulfilling your order, including shipping, invoicing, returns, and refunds

Identity, contact, and order data

Art. 6(1)(b) GDPR - performance of a contract

Customer service and responding to enquiries

Contact and order data

Art. 6(1)(b) / Art. 6(1)(f) - contract / legitimate interest

Complying with tax, accounting, and commercial law obligations

Order and invoice data

Art. 6(1)(c) GDPR - legal obligation

Fraud prevention and Store security

Technical and order data

Art. 6(1)(f) GDPR - legitimate interest

Operating and improving the Store using aggregate analytics

Technical and usage data

Art. 6(1)(f) GDPR - legitimate interest

Sending marketing emails or newsletters (only with your opt-in)

Email address, purchase history

Art. 6(1)(a) GDPR - consent

Placing non-essential cookies (analytics, marketing)

Cookie and usage data

Art. 6(1)(a) GDPR - consent

Where we rely on legitimate interests as our legal basis, we have assessed that our interests are not overridden by your rights and freedoms. You have the right to object to processing on this basis at any time - see Section 11.

Where we rely on consent, you may withdraw that consent at any time - see Section 11. Withdrawal does not affect the lawfulness of processing that took place before withdrawal.

 

5. Who We Share Your Personal Data With

We only share personal data with service providers who need it to operate the Store or to comply with legal obligations, under data processing agreements that meet GDPR requirements. We do not sell your personal data.

Recipient

Role

Data shared

Location

Their privacy information

Shopify Inc.

E-commerce platform - hosts the Store, processes payments (Shopify Payments), and provides built-in analytics

Order, contact, and technical data

USA - Standard Contractual Clauses (SCCs) apply

shopify.com/legal/privacy

Cornelissen Logistics (Goudwerf 15, 6641 TE Beuningen, Netherlands)

Fulfilment warehouse - packs and dispatches your order

Name, delivery address, order details

Netherlands (EEA)

cornelissen.eu

DPD

Shipping carrier - delivers your order and provides tracking

Name, delivery address, contact details

EEA

dpd.com

DERYAN B.V. (6662 WD Elst, Gelderland, Netherlands)

Returns processing - receives and processes returned items

Name and order details

Netherlands (EEA)

deryan.com

Returnless

Return portal - only if you register a return

Name, email, order number, return reason

Netherlands (EEA)

returnless.com

Pandectes GDPR

Consent management platform - records and manages your cookie consent choices on the Store

Consent records, technical identifiers

EEA

pandectes.io

Tax, legal, and accounting advisors; public authorities

Compliance with legal obligations - only where required by law

As required by applicable law

EEA

-

Shopify sub-processors. Shopify engages its own sub-processors, and maintains a current list that may be updated from time to time:

We do not sell your personal data, and we do not share it with advertising networks or data brokers.

 

6. International Data Transfers

Your personal data is primarily processed within the European Economic Area (EEA). Where a service provider processes data outside the EEA - for example, Shopify Inc. operates infrastructure in the United States and Canada - we ensure that an adequate level of protection is in place through one or more of the following mechanisms:

  • The European Commission's Standard Contractual Clauses (SCCs) under Article 46(2)(c) GDPR.

  • A European Commission adequacy decision covering the destination country or territory.

You can request information about the specific safeguards applicable to a particular transfer by contacting us at info@qplayy.com.

 

7. Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy or as required by applicable law. When data is no longer needed, it is securely deleted or irreversibly anonymised.

Data category

Retention period

Order and invoice data

10 years from the date of the transaction, as required by German commercial and tax law (HGB § 238, AO § 147)

Account data

For as long as your account is active, or until you request deletion and no statutory retention obligation applies

Customer service communications

Up to 3 years from the date of last contact, unless a longer period is required for a pending legal claim

Marketing consent records

Until you withdraw consent (unsubscribe), plus up to 3 years for evidence of consent

Cookie consent records

Up to 3 years, in line with the Pandectes GDPR consent record retention period

Technical and log data

Up to 12 months

 

8. Cookies and Consent Management

The Store uses cookies and similar technologies. Cookies are small text files stored on your device when you visit a website. We use the following categories of cookies:

Category

Purpose

Consent required?

Strictly necessary

Required for core Store functions: shopping cart, session management, secure checkout, login, and fraud prevention. These cannot be switched off as the Store cannot function without them.

No - essential to the service

Analytics / performance

Help us understand how visitors use the Store so we can improve it. Includes Shopify's built-in aggregate analytics.

Yes - prior consent required

Marketing

Used to personalise and measure the performance of marketing communications. Not currently active unless separately disclosed.

Yes - prior consent required

Consent management - Pandectes GDPR

We use Pandectes GDPR as our consent management platform. When you first visit the Store, a cookie consent banner is displayed where you can accept or reject non-essential cookies by category. Your choices are recorded by Pandectes GDPR and applied immediately.

You can review or update your cookie preferences at any time by clicking the cookie settings link in the footer of the Store.

Your consent is stored for 12 months. After that period, you may be asked to confirm your preferences again. You may withdraw consent at any time through the cookie settings link - this does not affect the lawfulness of consent-based processing that took place before withdrawal.

 

9. Managing Cookies in Your Browser

In addition to the cookie settings on the Store, you can control, restrict, or delete cookies directly through your browser settings. Please be aware that blocking or deleting certain cookies may affect Store functionality, including the shopping cart and checkout process.

How to manage cookies in common browsers:

For other browsers, please refer to your browser's help or support documentation to find cookie management options.

You can also opt out of interest-based advertising through the European Interactive Digital Advertising Alliance (EDAA) opt-out platform at https://www.youronlinechoices.com.

 

10. Payments and Payment Data

Payments on the Store are processed by Shopify Payments. We do not store, access, or process your full payment card details. Card data is handled directly by Shopify and its payment processing partners in accordance with PCI-DSS standards.

For details of how Shopify processes your personal and payment data, see Shopify's Privacy Policy at https://www.shopify.com/legal/privacy.

 

11. Your Rights

Under the GDPR and equivalent national data protection laws in your country of residence, you have the following rights regarding your personal data:

Right

What it means

Right of access (Art. 15 GDPR)

You can request a copy of the personal data we hold about you, together with information on how we use it.

Right to rectification (Art. 16 GDPR)

You can ask us to correct personal data that is inaccurate or incomplete.

Right to erasure (Art. 17 GDPR)

You can ask us to delete your personal data where it is no longer necessary, where you withdraw consent and no other legal basis applies, or where processing is unlawful.

Right to restriction (Art. 18 GDPR)

You can ask us to restrict processing of your data in certain circumstances - for example, while you contest its accuracy or object to its processing.

Right to data portability (Art. 20 GDPR)

Where processing is based on consent or contract and carried out by automated means, you can request your data in a structured, commonly used, machine-readable format.

Right to object (Art. 21 GDPR)

You can object at any time to processing based on legitimate interests - including profiling - or to direct marketing. We must stop unless we can demonstrate compelling legitimate grounds that override your interests.

Right to withdraw consent (Art. 7(3) GDPR)

Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

Right not to be subject to automated decisions (Art. 22 GDPR)

You have the right not to be subject to a decision based solely on automated processing that produces significant legal or similarly significant effects. We do not carry out such automated decision-making.

UK customers: Equivalent rights apply under the UK GDPR and the Data Protection Act 2018.

French customers: Under French law (Loi Informatique et Libertes, Article 85), you have the right to give instructions about what happens to your personal data after your death. You can submit such instructions to us at info@qplayy.com.

 

12. How to Exercise Your Rights

To exercise any of the rights listed in Section 11, please contact us:

  • Email: info@qplayy.com

  • Post: QPlay GmbH, Neumarkt 39, 50667 Koln, Germany

We will respond within one month of receiving your request. In complex cases or where we receive a high volume of requests, we may extend this by up to two further months and will inform you if this applies.

We may ask you to verify your identity before processing your request. We will not charge a fee unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable administrative fee or decline to act, and will explain our reasons.

 

13. Supervisory Authorities

You have the right to lodge a complaint with a data protection supervisory authority if you believe we have not handled your personal data in accordance with applicable law. You may contact the supervisory authority in your country of residence, place of work, or the country where the alleged infringement occurred.

As a controller registered in North Rhine-Westphalia, Germany, our lead supervisory authority is:

Landesbeauftragte fur Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW) Kavalleriestrasse 2-4, 40213 Dusseldorf, Germany Website: https://www.ldi.nrw.de

You may also contact the supervisory authority in your own country. The authorities for every country we ship to are listed below.

Country

Authority

Website

Austria

Datenschutzbehörde (DSB)

https://www.dsb.gv.at

Belgium

Gegevensbeschermingsautoriteit (GBA / APD)

https://www.gegevensbeschermingsautoriteit.be

Bulgaria

Commission for Personal Data Protection (CPDP)

https://www.cpdp.bg

Croatia

Agencija za zaštitu osobnih podataka (AZOP)

https://azop.hr

Cyprus

Commissioner for Personal Data Protection

https://www.dataprotection.gov.cy

Czech Republic

Úřad pro ochranu osobních údajů (ÚOOÚ)

https://www.uoou.cz

Denmark

Datatilsynet

https://www.datatilsynet.dk

Estonia

Andmekaitse Inspektsioon (AKI)

https://www.aki.ee

Finland

Tietosuojavaltuutetun toimisto

https://tietosuoja.fi

France

Commission Nationale de l'Informatique et des Libertés (CNIL)

https://www.cnil.fr

Germany (federal)

Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI)

https://www.bfdi.bund.de

Greece

Hellenic Data Protection Authority

https://www.dpa.gr

Hungary

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)

https://naih.hu

Ireland

Data Protection Commission (DPC)

https://www.dataprotection.ie

Italy

Garante per la protezione dei dati personali

https://www.garanteprivacy.it

Latvia

Datu valsts inspekcija (DVI)

https://www.dvi.gov.lv

Liechtenstein

Datenschutzstelle Liechtenstein

https://www.datenschutzstelle.li

Lithuania

Valstybinė duomenų apsaugos inspekcija (VDAI)

https://vdai.lrv.lt

Luxembourg

Commission nationale pour la protection des données (CNPD)

https://cnpd.public.lu

Malta

Information and Data Protection Commissioner (IDPC)

https://idpc.org.mt

Monaco

Commission de Contrôle des Informations Nominatives (CCIN)

https://www.ccin.mc

Netherlands

Autoriteit Persoonsgegevens (AP)

https://www.autoriteitpersoonsgegevens.nl

Poland

Urząd Ochrony Danych Osobowych (UODO)

https://uodo.gov.pl

Portugal

Comissão Nacional de Proteção de Dados (CNPD)

https://www.cnpd.pt

Romania

Autoritatea Naţională de Supraveghere (ANSPDCP)

https://www.dataprotection.ro

Slovakia

Úrad na ochranu osobných údajov

https://dataprotection.gov.sk

Slovenia

Informacijski pooblaščenec (IP)

https://www.ip-rs.si

Spain

Agencia Española de Protección de Datos (AEPD)

https://www.aepd.es

Sweden

Integritetsskyddsmyndigheten (IMY)

https://www.imy.se

The European Data Protection Board maintains the official index of all national authorities, including current contact details, at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.

United Kingdom: the Information Commissioner's Office (ICO) at https://ico.org.uk is the equivalent authority. We do not currently sell to the United Kingdom - see Section 1.

 

14. Children's Privacy

The Store is intended for adult customers. We do not knowingly collect personal data from children under the age of 16. If you believe we have inadvertently collected personal data from a child under 16, please contact us immediately at info@qplayy.com and we will delete that data without undue delay.

 

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the services we offer, or applicable legal requirements. The "Last updated" date at the top of this page indicates when the policy was most recently revised.

Where changes are material, we will notify you by email (where we hold your address) or by displaying a prominent notice on the Store before the changes take effect.

 

16. Contact

For any questions or concerns about this Privacy Policy or how we handle your personal data:

Email: info@qplayy.com Phone: +34 651 54 13 96 Post: QPlay GmbH, Neumarkt 39, 50667 Koln, Germany Customer service hours: Monday-Friday, 9:00-17:00 CET/CEST (Amsterdam time) Response time: We aim to respond within 8 hours on business days.

 

17. Company Information

Store name: QPlay Legal business operator: QPlay GmbH Commercial register: Amtsgericht Koln, HRB 90621 VAT ID: DE321170983 Registered business address: Neumarkt 39, 50667 Koln, Germany Email: info@qplayy.com Phone: +34 651 54 13 96

 

18. Related Policies

Shipping Policy | Returns & Refund Policy | Right of Withdrawal | Terms and Conditions | Cookie Policy | Legal Notice (Impressum) | Contact | FAQ