Privacy Policy

ALVIRAN Privacy

How we process data for account requests, shop checkout, payment, delivery, support, security and consent-based ads tracking.

Contract data only Consent-based ads Encrypted handover Fraud evidence
English / EN

Privacy Policy

Last updated: 5 December 2025

1. Controller and scope

The controller responsible for this website, the ALVIRAN ticket system, shop, checkout, delivery flow and related support is ALVIRAN – Kerim Akgül, sole proprietor, Germany.

This Privacy Policy explains how we process personal data when you visit the website, create a ticket, submit a custom request, buy a shop listing, pay through Stripe or PayPal, receive account access, contact support, use restock alerts, submit a rating or interact with consent-based advertising measurement.

2. Ticket requests and shop orders

For ticket requests, custom account searches and shop purchases we process data needed to handle your request and perform the contract. This can include email address, ticket/order ID, game, platform, region, desired rank or items, budget, notes, messages, uploaded screenshots or files, selected listing, coupon, price, currency, order reference, payment status, delivery status and timestamps.

For shop listings we also process listing ID, product details shown before purchase, checkout email, payment method, claim/delivery status and internal stock status. We use this data to process the order, prevent duplicate sale of limited stock, deliver the account access and handle support.

3. Account handover and claim flow

After successful payment, shop delivery can create a private access claim. The access page verifies the claim code and the same checkout email address before credentials are revealed. The claim code is normally valid for 30 days.

For delivery evidence and security we may store delivery metadata such as the related ticket or order reference, checkout email, event type, timestamps, access-page activity, verification attempts, view count and basic technical security signals. Delivery event logs are designed not to store passwords, 2FA secrets, reveal tokens or full raw credentials.

Account credentials are processed only where required for handover and support. They are protected by access controls and, where supported by the system, by the plugin’s encryption layer.

4. Payments, invoices and providers

Payments may be processed through Stripe and PayPal. Depending on the payment method, we and the provider process data such as email address, amount, currency, order reference, provider transaction references, payment status, invoice or receipt data, basic payment method metadata and risk/fraud information required for payment handling.

ALVIRAN does not store full card numbers. Card and wallet details are handled by the payment provider. Stripe and PayPal may also process data as independent controllers for their own compliance, fraud prevention, payment processing and legal obligations.

5. Consent records and checkout acceptance

Before checkout the system logs the legal acceptance required for digital delivery. Consent records can include ticket or listing reference, consent type, version, accepted text, linked legal pages, timestamp and basic technical proof such as IP address, user agent or derived security hashes.

We use these records to prove the checkout acceptance, immediate digital delivery request and related legal acknowledgements where necessary for contract handling, fraud prevention, chargeback defence or legal claims.

6. Support, emails, follow-ups and reviews

We send transactional emails for ticket creation, ticket replies, payment confirmations, delivery emails, access codes, invoices, security notices and important order updates. Emails are sent through WordPress mail and the configured SMTP/mail delivery provider, which may include SMTP2GO, Brevo/Sendinblue or another provider configured for the website.

For ticket follow-ups, abandoned requests, payment reminders and review requests we process the order email, ticket/order ID, scenario, sent time and unsubscribe status. Each follow-up email includes an unsubscribe option where applicable. Restock alerts use double opt-in, store email, game, status, token, IP and timestamps, and are deleted after the alert is sent or when you unsubscribe. Unconfirmed restock alerts are cleaned up automatically.

If you submit a customer rating, we store score, optional comment, timestamp and IP. Reviews are only shown publicly if enabled manually; customer emails are masked and internal emails are blocked from public output.

7. Security, abuse prevention and dispute evidence

We process security data to operate the website, prevent abuse, limit spam, protect tickets and defend against fraud or payment disputes. This can include IP address, user agent, request and device signals, rate-limit status, upload metadata, duplicate-message checks, failed verification attempts, payment mismatch indicators, provider references and support correspondence.

Security and abuse-prevention records may be stored in raw or pseudonymized form where appropriate and are limited to what is necessary for security, fraud prevention, dispute handling and legal defence. If Cloudflare Turnstile or similar security checks are enabled, challenge tokens and the IP address may be sent to Cloudflare for verification.

8. Cookies, local storage and similar technologies

We use necessary storage for checkout, ticket access, security and consent. This includes session storage for the shop checkout email, the alv_verified_ticket cookie for verified ticket access, WordPress/session cookies where applicable, security/rate-limit state and local storage for the consent state used by tracking scripts.

Advertising attribution values such as gclid, gbraid, wbraid and utm_* parameters are first held in session storage and are only persisted into ALVIRAN attribution cookies/local storage when tracking consent is present. These attribution values are normally kept for up to 90 days.

Under Sec. 25 TDDDG, storage or access that is not strictly necessary requires consent. Essential storage is used to provide the requested website, ticket, checkout and security functions.

9. Analytics and advertising measurement

Where enabled and where tracking consent is present, we use Google Ads/GA4 conversion measurement. Events can include purchase, qualified lead, view item, select item and begin checkout. Event data can include order reference or transaction ID, value, currency, product/listing data, payment method, hashed email for enhanced conversions, click IDs, UTM parameters, landing URL and referrer. Google may also be configured in consent mode so non-essential advertising storage remains denied until consent is granted.

Where enabled and where tracking consent is present, Meta Pixel and TikTok Pixel may process events such as PageView, ViewContent, InitiateCheckout, Lead and Purchase/CompletePayment with product ID, content name, value and currency. Server-side TikTok Events API events, where enabled, are only used for paid shop events when a valid tracking-consent marker is available or where a lawful site configuration explicitly permits it.

You can withdraw or change tracking consent through the website’s consent controls where available. If consent is withdrawn, future tracking tags should stop using non-essential tracking storage, but previously lawfully processed data may remain with providers according to their retention rules.

10. Recipients and service providers

Recipients can include our hosting provider, database/backup providers, payment providers such as Stripe and PayPal, configured mail delivery providers, Google, Meta, TikTok, Cloudflare where security services are enabled, professional advisors, payment dispute processors and competent authorities where required.

We only share data to the extent needed for the stated purposes, for example payment processing, email delivery, account handover, security, fraud prevention, analytics with consent, dispute handling or legal obligations.

11. International transfers

Some providers may process data outside the European Economic Area. Where this happens, we rely on appropriate safeguards such as adequacy decisions, Standard Contractual Clauses or other mechanisms permitted by GDPR.

12. Retention periods

  • Invoices, accounting and tax-relevant records: generally up to 10 years according to German commercial and tax law.
  • Ticket, order, message and delivery records: normally up to 12 months after closure, unless longer retention is required for legal claims, payment disputes, fraud prevention or statutory obligations.
  • Consent logs and checkout acceptance records: retained as long as needed to prove the legal acceptance and defend claims.
  • Access, security and rate-limit logs: normally 30 to 90 days, unless an incident, abuse case or dispute requires longer retention.
  • Dispute and chargeback evidence: retained for the duration of the dispute and for a reasonable period afterwards where needed to assert or defend claims.
  • Abuse-prevention records: reviewed periodically and normally limited to what is necessary for fraud prevention.
  • Restock alerts: pending entries are deleted after a short period if not confirmed; confirmed one-shot alerts are deleted after the notification is sent or when you unsubscribe.

13. Legal bases

We process contract and pre-contract data under Art. 6(1)(b) GDPR. Legal/tax records are processed under Art. 6(1)(c) GDPR. Security, fraud prevention, support quality, dispute evidence, internal administration and necessary service operation are based on legitimate interests under Art. 6(1)(f) GDPR. Optional marketing, restock alerts, analytics and advertising measurement are based on consent where required under Art. 6(1)(a) GDPR and Sec. 25 TDDDG.

14. Your rights

You have the rights of access, rectification, erasure, restriction of processing, data portability and objection under Art. 15 to 21 GDPR. Where processing is based on consent, you can withdraw consent at any time with effect for the future.

To exercise your rights, contact [email protected]. You may also lodge a complaint with a data protection authority, in particular the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW).

15. Required data and automated decisions

Providing certain data, especially email address, ticket/order information and payment data, is required to create a ticket, process a purchase and deliver account access. Without this data we cannot provide the requested service.

ALVIRAN does not use automated decision-making within the meaning of Art. 22 GDPR for customers. Payment providers may run their own fraud, risk and compliance checks under their responsibility.

16. Contact and changes

If we materially change the ticket system, shop, delivery flow, tracking setup or service providers, this Privacy Policy may be updated. The current version is shown on this page.

Contact: [email protected]

Need help choosing?

Open chat →
ALVIRAN AI
Online now
Support
AI can make mistakes. Consider verifying important information.