Legal · United Kingdom
Privacy Notice
Last updated: 1 July 2026
GearDropMania Ltd is the data controller for personal data processed through GearDropMania. This notice explains what we collect, why, and the rights you have under the UK GDPR and the Data Protection Act 2018.
1. Controller and contact details
Controller: GearDropMania Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Company number 15428037. Data protection contact: legal@geardropmania.co.uk. We are registered with the Information Commissioner's Office (ICO) as a data controller.
2. What we collect and why
| Data | Purpose | Lawful basis | Retention |
|---|---|---|---|
| Name, email, billing address | Creating your account and fulfilling orders | Performance of a contract | 6 years after last order (tax law) |
| Payment metadata (last four digits, transaction ID) | Processing payments, refunds and chargebacks | Contract; legal obligation | 6 years |
| Game account handles and order notes | Delivering items and boosting services | Performance of a contract | 12 months after completion |
| Identity documents (high-value or flagged orders) | Fraud prevention and AML checks | Legal obligation; legitimate interests | 5 years after the business relationship ends |
| Support messages and chat transcripts | Answering enquiries and handling complaints | Contract; legitimate interests | 24 months |
| Analytics and marketing cookie data | Measuring and improving the service | Consent (PECR) | Up to 13 months |
3. Legitimate interests
Where we rely on legitimate interests, those interests are preventing fraud, keeping the marketplace secure and improving our service. We balance them against your rights and have completed a legitimate interests assessment, available on request.
4. Who we share data with
- Payment providers (card processing, 3-D Secure, chargeback handling).
- Sellers and boosters — only the minimum needed to deliver your order.
- Hosting, email and customer-support providers acting as our processors.
- Fraud-prevention and identity-verification agencies.
- Law enforcement, HMRC or regulators where we are legally required to disclose.
We never sell your personal data.
5. International transfers
Some processors are outside the UK. Where that happens we rely on UK adequacy regulations or the International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment.
6. Your rights
- Access a copy of your personal data.
- Rectify inaccurate data.
- Erase data where we no longer need it.
- Restrict or object to processing, including profiling for fraud scoring.
- Portability of data you gave us, in a machine-readable format.
- Withdraw consent at any time, without affecting prior processing.
Email legal@geardropmania.co.uk to exercise a right. We respond within one month. You can complain to the ICO at ico.org.uk or on 0303 123 1113, though we would like the chance to resolve things first.
7. Children
Our services are for adults aged 18 or over. We do not knowingly collect data from children. If you believe a child has provided data, contact us and we will delete it.
8. Security
We use TLS encryption in transit, encryption at rest for sensitive fields, role-based access controls, logging and regular reviews. If a breach is likely to pose a risk to you, we will notify the ICO within 72 hours and tell you where required.
9. Cookies
Cookies and similar technologies are covered by our Cookie Policy. Non-essential cookies are only set with your consent, which you can change at any time.