Privacy and Cookie Policy

Version of 9 November 2026

This policy explains which personal data we process when you visit softflix.com, create an account, buy a product key or contact us, why we process it, on what legal basis, how long we keep it and what rights you have. It also describes the cookies and similar technologies used on the website (section 5). "Personal data" is any information relating to an identified or identifiable natural person.

1. Controller and contact

The controller is SOFTFLIX AG, Kurfürstendamm 14, 10719 Berlin, Germany, telephone +49 800 7777 199, e-mail contact@softflix.com. For all questions about data protection and to exercise your rights, write to contact@softflix.com with the subject "Data protection". We have not appointed a data protection officer.

2. Overview: what we process and why

Visiting the website — Data: IP address, date and time, requested page, referrer, browser and operating system, country derived from the IP address, currency and language setting; Purpose: Delivering the pages, security, error analysis, showing prices and legal information for your country; Legal basis (GDPR): Art. 6(1)(f) – legitimate interest in a functioning and secure website; Art. 6(1)(c) where legal information depends on your country; Retention: Server logs: up to 30 days; country/currency setting: session or until changed
Order (guest or account) — Data: E-mail address, country, selected products, price, currency, payment method and payment status (we do not receive your full card number), IP address and technical data of the order, order and key delivery history; optionally invoice data (name, company, address, VAT number); Purpose: Concluding and performing the contract, delivering the key, invoicing, handling complaints and refunds, fraud prevention; Legal basis (GDPR): Art. 6(1)(b) – contract; Art. 6(1)(c) – tax and accounting law; Art. 6(1)(f) – fraud prevention; Retention: Order and invoice data: 10 years after the end of the year of the order (German tax and commercial law, §§ 147 AO, 257 HGB); fraud-prevention data: up to 3 years after the order
Customer account — Data: E-mail address, password (stored hashed), name, country, order history and key library, bonus points, vouchers, complaints; for business accounts: company data, VAT number and a document confirming the identity of the person registering; Purpose: Providing the account and its functions, access to your keys, business verification; Legal basis (GDPR): Art. 6(1)(b) – contract (user agreement); Art. 6(1)(f) – preventing misuse of business accounts; Retention: Until you close the account, then deletion within 3 months, except data we must keep under tax law (see above). Identity documents: deleted after verification, at the latest 30 days after upload
Contact, complaints, live chat — Data: Your message and the data you give us (name, e-mail, order number), chat transcript; Purpose: Answering your request, handling complaints under the contract; Legal basis (GDPR): Art. 6(1)(b); otherwise Art. 6(1)(f) – legitimate interest in answering requests; Retention: Until the request is closed; complaint files: 3 years after closing
Newsletter (checkbox in the checkout, in the footer or on the business portal) — Data: E-mail address, date and source of subscription, opening and click statistics; Purpose: Sending information about offers and promotions; Legal basis (GDPR): Art. 6(1)(a) – consent, which you may withdraw at any time via the link in every e-mail or by e-mail to us; Retention: Until you withdraw consent, then up to 30 days for technical removal
Affiliate programme and business portal — Data: Contact and company data, website, commission statements, licence allocations to employees entered by the company; Purpose: Running the partnership or business account, paying commissions; Legal basis (GDPR): Art. 6(1)(b) – contract; Art. 6(1)(c) – accounting; Retention: Duration of the partnership; accounting documents 10 years
Analytics, marketing and chat tools — Data: See section 5.3; Purpose: Measuring the use of the website, advertising, chat; Legal basis (GDPR): Art. 6(1)(a) – consent given in the cookie banner for the relevant category; § 25(1) TDDDG; Retention: See section 5.3

3. Where the data comes from

We process data that you give us (order, account, contact) and data generated when you use the website (technical data, order history). Payment providers tell us whether a payment succeeded, failed or was reversed, and may give us a risk assessment for the transaction. We do not buy personal data from third parties.

4. Who receives your data

We use service providers who process data on our behalf under data processing agreements (Art. 28 GDPR), and we transmit data to independent controllers where this is necessary for the contract:

Hosting and infrastructure: Microsoft Ireland Operations Ltd. (Microsoft Azure, data centres in the European Union). Microsoft Application Insights is used for error monitoring on the server side; browser telemetry only with your consent (section 5.3).
E-mail delivery (order confirmations, keys, password resets): Twilio Inc. (SendGrid), on the basis of the EU–US Data Privacy Framework and standard contractual clauses.
Payments: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland (cards, Apple Pay, Google Pay, SEPA Direct Debit, Bancontact, iDEAL, EPS, Przelewy24, Alipay, WeChat Pay and the other methods shown in the checkout). Stripe receives the data needed to process your payment (amount, currency, order reference, e-mail address, and the payment data you enter in the payment form) and acts as an independent controller for its own processing, including fraud checks, under its privacy policy (stripe.com/privacy). We receive the result of the payment, a masked card reference and, for refunds, the reference needed to return the money. If we add further payment providers, we list them here before they are used.
VAT number check: the EU VAT number you enter is checked against the European Commission's VIES service (ec.europa.eu/taxation_customs/vies), which receives the number only.
Suppliers and platform operators: when we check a key that you have complained about, we send the key identifier and the order date to the distributor from which we bought it; we do not send your name or e-mail address unless you ask us to.
Accounting, tax advisors and auditors (Art. 6(1)(c) and (f) GDPR), and public authorities where we are legally obliged.
Live chat: tawk.to Inc. (section 5.3).

5. Cookies and similar technologies

5.1 Cookies are small text files stored in your browser; "similar technologies" include local storage and tracking pixels. We use technically necessary technologies without consent (Art. 6(1)(f) GDPR, § 25(2) TDDDG). All other tools are used only with your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you give in the cookie banner either for all categories ("Accept all") or for selected categories ("Customize"). The categories are Analytics, Marketing and Live chat (section 5.3).

5.2 Technically necessary:

softflix_tracking_consent — Purpose: Stores your cookie choice for each category; Duration: 12 months
Session and authentication cookies / tokens — Purpose: Keep you logged in and protect your account and the checkout; Duration: Session or until logout
Cart, currency and country settings; NEXT_LOCALE (language) — Purpose: Remember your cart and the shop version you chose; Duration: Up to 12 months; NEXT_LOCALE: session
Local storage "contactData" — Purpose: Keeps the contact data you entered in the checkout so that you do not have to re-enter it if you return; stored only in your browser, until you clear it; Duration: Until you clear your browser storage
Stripe cookies (__stripe_mid, __stripe_sid) during checkout — Purpose: Fraud prevention and operation of the payment form; set by Stripe when you open the payment step; Duration: 12 months / 30 minutes

5.3 Tools used only with your consent. The tools of a category are loaded only after you have accepted that category (with "Accept all" or under "Customize"). They set cookies or similar identifiers, read your IP address and browser information and track pages visited and actions on the website. Data may be transferred to the USA; Google, Meta and Microsoft are certified under the EU–US Data Privacy Framework (Commission decision of 10 July 2023), and we have standard contractual clauses in place as a fallback. If you click "Reject all", none of these tools is loaded. You can change your decision at any time via "Cookie settings" in the footer of the website, which reopens the settings; if you withdraw consent for a category whose tools are already running, the page reloads so that they stop. Cookies already set by these tools remain in your browser until they expire; you can delete them in your browser settings.

Google Analytics 4 (category Analytics) — Provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland; Purpose: Statistics on the use of the website (pages, traffic sources, devices, approximate location); the Google tag receives your cookie choice (Google Consent Mode) and uses advertising identifiers only if you have also accepted the Marketing category; Data and duration: Cookies _ga, ga* (up to 14 months); Google Analytics 4 does not store full IP addresses. Google privacy: policies.google.com/privacy; opt-out add-on: tools.google.com/dlpage/gaoptout
Meta Pixel (category Marketing) — Provider: Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland; Purpose: Measuring the effectiveness of our advertising on Facebook and Instagram and showing relevant advertising to visitors of our website; Meta and we are joint controllers for the collection and transmission of event data (Art. 26 GDPR, joint controller addendum available at facebook.com/legal/controller_addendum); Data and duration: Cookie _fbp (3 months), pages viewed, browser and device data, IP address. Meta privacy: facebook.com/privacy/policy
Microsoft Application Insights – browser telemetry (category Analytics) — Provider: Microsoft Ireland Operations Ltd., One Microsoft Place, Dublin 18, Ireland; Purpose: Measuring page load times, errors and the technical performance of the shop; Data and duration: Cookies ai_user (12 months) and ai_session (30 minutes), browser and performance data; stored in the EU
tawk.to live chat (category Live chat) — Provider: tawk.to Inc., 187 East Warm Springs Rd, SB298, Las Vegas, NV 89119, USA; Purpose: Live chat with our support; the chat widget loads only after consent and stores a visitor identifier to continue a conversation; Data and duration: Cookies and local storage of tawk.to (up to 6 months), chat transcript, IP address, browser data; transfer to the USA on the basis of standard contractual clauses. tawk.to privacy: tawk.to/privacy-policy

5.4 Fonts and embedded videos. The fonts and stylesheets of the website are served from our own servers; displaying a page does not load fonts from Google Fonts or files from other content delivery networks. On game pages that have a trailer, the preview image of the trailer is loaded from YouTube's image server (i.ytimg.com – Google Ireland Ltd.), which receives your IP address and browser information (Art. 6(1)(f) GDPR – legitimate interest in presenting the product). The video itself is loaded from YouTube only after you click play; YouTube may then set cookies under Google's privacy policy.

5.5 Do Not Track signals sent by your browser are not read by our website; please use the cookie banner or "Cookie settings" instead.

6. Fraud prevention and payment security

Because keys are delivered immediately and can be misused, we check orders for signs of fraud: we compare the country derived from your IP address with the billing and account data, look at order frequency, the payment result and chargeback history, and may ask you to confirm an order by e-mail. Our payment provider runs its own automated risk checks (Stripe Radar) and may decline a payment. If we refuse an order on the basis of these checks, you can contact us and have the decision reviewed by a person. Legal basis: Art. 6(1)(f) GDPR (protection against fraud and chargebacks) and Art. 6(1)(b) for the payment itself. We do not use the result for any other purpose.

7. Transfers outside the European Economic Area

Our systems are hosted in the European Union. Some providers listed above process data in the USA or other third countries. We rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework for certified companies (Google, Meta, Microsoft, Stripe, Inc., Twilio) and otherwise on the standard contractual clauses of the Commission (Art. 46(2)(c) GDPR) with additional safeguards. The clauses are published by the Commission at ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en; you can also obtain a copy of our signed clauses by writing to contact@softflix.com. If you are in the United Kingdom, the UK GDPR applies to our processing of your data in the same way; transfers from the UK rely on the UK Extension to the Data Privacy Framework or the UK International Data Transfer Addendum.

8. How long we keep data

We keep personal data only as long as needed for the purpose, as set out in the table in section 2. Afterwards we delete it or anonymise it, unless a statutory retention period (in particular 10 years for accounting documents under German law) or an ongoing dispute requires longer storage; in that case access is restricted to that purpose.

9. Your rights

You have the right to obtain information about the personal data we hold about you (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw any consent you have given at any time with effect for the future (Art. 7(3)), for example via "Cookie settings" or the unsubscribe link in newsletters.

Right to object (Art. 21 GDPR). Where we process your data on the basis of legitimate interests, you may object on grounds relating to your particular situation; we then stop the processing unless we can demonstrate compelling legitimate grounds. Where we process your data for direct marketing, you may object at any time and we will stop.

You have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your residence or workplace. The authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin, Germany (datenschutz-berlin.de). In Poland: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa (uodo.gov.pl). In the United Kingdom: Information Commissioner's Office (ico.org.uk).

To exercise your rights, write to contact@softflix.com. We may ask you to confirm your identity, for example by writing from the e-mail address of your account. We answer within one month.

10. Is providing data mandatory? Automated decisions

To order you must provide an e-mail address and your country; without them we cannot deliver the key or determine the correct price and tax. Invoice data is required only if you want an invoice or enter a VAT number. All other data is optional. Apart from the fraud checks described in section 6, which are reviewed by a person on request, we do not make decisions based solely on automated processing that produce legal effects for you.

11. Children

The shop is intended for adults. We do not knowingly process data of children under 16 without the consent of a parent or guardian. If you believe a child has given us data, contact us and we will delete it.

12. Residents of the United States

If you live in the United States, you can make access, deletion and correction requests by e-mail to contact@softflix.com and opt out of advertising tools via "Reject all" in the cookie banner or by switching off the Marketing category under "Cookie settings". We do not sell personal data for money.

13. Changes to this policy

We update this policy when our processing or the law changes. The current version with its date is always available on this page. For material changes affecting your account we inform you by e-mail.