EUR
Last updated: 27 August 2026
This Privacy Policy explains how SIA EVO (“we”, “us”, “our”) collects, uses, and protects your personal data when you visit arcadealley.store (the “Website”) and purchase our digital games, game keys, gift cards, software, and other digital products.
We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), the Latvian Personal Data Processing Law, and other applicable data protection laws.
The controller responsible for your personal data is:
Company: SIA EVO
Registered office: Bruņinieku iela 78A – 11, Rīga, LV-1009, Latvia
Registration number: 40203710527
VAT number: LV40203710527
Director: Kristaps Ilcukovs
Email: support@arcadealley.store
If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at support@arcadealley.store.
We may collect and process the following categories of personal data:
Account data: name, username, email address, and password (stored securely using appropriate cryptographic protection).
Order and transaction data: products purchased, order history, licence keys issued, billing country, transaction details, and amounts paid.
Payment data: payments are processed by our third-party payment service providers. We receive payment confirmation and limited payment information where applicable, such as card type and the last digits of a payment card. We do not store full payment card numbers.
Technical and usage data: IP address, device type, browser type, operating system, referral source, pages viewed, timestamps, and download activity.
Communications data: messages you send us by email or through customer support channels, including support requests and responses to surveys or marketing communications.
Marketing preferences: information about whether you have agreed to receive newsletters or other promotional communications from us.
We do not intentionally collect special categories of personal data, such as information concerning health, religion, racial or ethnic origin, political opinions, biometric data, or sexual orientation.
We rely on the following lawful bases under Article 6 GDPR:
| Purpose | Lawful basis |
|---|---|
| Creating and managing your account | Performance of a contract – Art. 6(1)(b) |
| Processing orders and delivering digital products | Performance of a contract – Art. 6(1)(b) |
| Processing payments and preventing fraud | Performance of a contract – Art. 6(1)(b) and legitimate interests – Art. 6(1)(f) |
| Providing customer support | Performance of a contract – Art. 6(1)(b) and legitimate interests – Art. 6(1)(f) |
| Complying with tax, accounting, and legal obligations | Legal obligation – Art. 6(1)(c) |
| Sending marketing communications | Consent – Art. 6(1)(a) |
| Improving, maintaining, and securing the Website | Legitimate interests – Art. 6(1)(f) |
| Using non-essential cookies and analytics | Consent – Art. 6(1)(a) |
Where we rely on legitimate interests, we assess those interests against your rights and freedoms. You have the right to object to certain processing based on legitimate interests as described in Section 8.
4.1 The Website is a general-audience service and is not specifically directed at children.
Where processing is based on consent in relation to information society services offered directly to a child, we comply with the applicable requirements of Article 8 GDPR and Latvian law.
4.2 Where parental or guardian consent is legally required, we may take reasonable steps to verify that such consent has been given or authorised by the holder of parental responsibility.
4.3 If you believe that a child has provided us with personal data without the consent required by applicable law, please contact us at support@arcadealley.store and we will take appropriate steps to investigate and, where required, delete the information.
5.1 We use cookies and similar technologies to operate the Website, remember your preferences, maintain Website security, and—subject to your consent—analyse Website usage and support marketing activities.
5.2 Strictly necessary cookies may be used without consent where permitted by applicable law. Non-essential cookies, including analytics and advertising cookies, are activated only where the required consent has been obtained through our cookie consent mechanism.
5.3 You can manage or withdraw your cookie consent at any time through Cookie Setting.
For more information about the cookies we use, their purposes, providers, and retention periods, please see our Cookie Policy .
We may share personal data where necessary with:
Payment service providers that process payments and assist with fraud prevention.
Hosting, infrastructure, security, email, and IT service providers that operate or support the Website.
Game and software publishers, distributors, suppliers, and licensors where necessary to deliver, activate, or support a product or licence.
Analytics and marketing providers where you have provided the required consent.
Professional advisers, accountants, auditors, insurers, legal advisers, regulators, courts, law enforcement agencies, or other public authorities where required by law or where necessary to establish, exercise, or defend legal claims.
Where a service provider processes personal data on our behalf, we require appropriate contractual and data protection safeguards.
We do not sell your personal data.
Some of our service providers may process personal data outside Latvia or the European Economic Area (“EEA”).
Where personal data is transferred outside the EEA to a country that has not been recognised by the European Commission as providing an adequate level of data protection, we use an appropriate transfer mechanism as required by GDPR. This may include European Commission Standard Contractual Clauses or another legally recognised safeguard.
Where required, we also assess whether additional technical, contractual, or organisational safeguards are necessary.
You may contact us at support@arcadealley.store for further information about the safeguards applicable to international transfers of your personal data.
Subject to the conditions and limitations provided by GDPR, you may have the right to:
Access – obtain confirmation of whether we process your personal data and request a copy of that data.
Rectification – request correction of inaccurate or incomplete personal data.
Erasure – request deletion of your personal data where the applicable legal requirements are met.
Restriction – request restriction of processing in certain circumstances.
Data portability – receive certain personal data you provided to us in a structured, commonly used and machine-readable format and, where applicable, request its transmission to another controller.
Object – object to processing based on legitimate interests and object to direct marketing at any time.
Withdraw consent – withdraw consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
Rights relating to automated decision-making – exercise the rights available to you under Article 22 GDPR where applicable.
To exercise any of your data protection rights, please contact us at support@arcadealley.store.
We will normally respond to your request within one month of receipt. Where permitted by GDPR, this period may be extended by up to two additional months where necessary due to the complexity or number of requests.
Requests are generally handled free of charge. However, where a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act on the request where permitted by GDPR.
We may request information necessary to verify your identity before processing a request.
If you believe that your personal data has been processed in violation of applicable data protection law, you have the right to lodge a complaint with a competent supervisory authority.
Our supervisory authority in Latvia is:
Data State Inspectorate of Latvia (Datu valsts inspekcija)
Elijas iela 17
Rīga, LV-1050
Latvia
Email: pasts@dvi.gov.lv
Telephone: +371 67223131
Website: www.dvi.gov.lv
You may also have the right to lodge a complaint with a supervisory authority in the EU/EEA country where you live or work, or where you believe an infringement has occurred.
We encourage you to contact us first so that we have an opportunity to address your concerns.
We retain personal data only for as long as necessary for the purposes described in this Privacy Policy and to comply with applicable legal, accounting, tax, fraud-prevention, and regulatory obligations.
Account data: retained while your account remains active and for [INSERT PERIOD] after account closure, unless a longer period is required for legal or legitimate business purposes.
Order, transaction, invoice, and accounting records: retained for at least the period required under applicable Latvian accounting and tax legislation. Certain accounting and transaction records are generally required to be retained for at least 5 years, while longer retention periods may apply to specific categories of records.
Customer support and communications: retained for [INSERT PERIOD] after the relevant enquiry or support case has been resolved, unless longer retention is reasonably required for legal claims or compliance purposes.
Marketing data: retained until you withdraw your consent, unsubscribe, or object to direct marketing. We may retain limited information necessary to record and respect your opt-out preference.
Technical and security logs: retained for [INSERT PERIOD], unless a longer period is reasonably necessary to investigate security incidents, prevent fraud, or establish or defend legal claims.
When personal data is no longer required, we securely delete or anonymise it.
We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.
Depending on the nature of the processing, these measures may include encryption in transit, access controls, authentication measures, system monitoring, backups, secure hosting, and restrictions on access to personal data.
In the event of a personal data breach, we will assess the risks to affected individuals and notify the competent supervisory authority and affected individuals where required under Articles 33 and 34 GDPR.
We may update this Privacy Policy from time to time to reflect changes to our Website, services, processing activities, service providers, or applicable legal requirements.
The “Last updated” date at the top of this Policy indicates when it was most recently revised.
Where appropriate, we may notify you of material changes through the Website, by email, or through another appropriate communication method.
For questions about this Privacy Policy, the processing of your personal data, or to exercise your data protection rights, please contact:
SIA EVO
Bruņinieku iela 78A – 11
Rīga, LV-1009
Latvia
Registration number: 40203710527
VAT number: LV40203710527
Website: arcadealley.store
Email: support@arcadealley.store
This Privacy Policy should be reviewed against the Website’s actual technical setup, cookies, payment providers, analytics services, and data-processing activities before publication.