Last updated: 17 September 2026
Who we are
AdaptaPlay Inc. runs this website and the shop at adaptaplay.org, and decides how the personal data described below is used. Under the EU General Data Protection Regulation we are the data controller.
AdaptaPlay Inc.
171 5th St NW, Atlanta, GA 30332
United States
[email protected]
Write to that address about anything in this policy, including the requests listed under Your rights.
What we collect, and why
Orders
When you buy something we collect your name, email address, billing and delivery address, what you ordered, and whether the payment went through. We need all of it to take the order, deliver it, invoice it, and handle returns or warranty claims. The legal basis is performance of our contract with you. Invoices and order records are then kept for as long as tax and accounting law requires, which for sales into Hungary is eight years.
We never see your full card number. Card details go straight to our payment processor.
Your account
If you create an account we store your email address, a hashed password, your saved addresses and your order history, so you can sign in and look up past orders. The legal basis is performance of our contract with you. We keep this until you delete the account. Deleting an account does not delete invoices we are required by law to keep.
Product update emails
If you sign up for product updates we store your email address, your first name if you give one, your answer to “what brings you here?”, and the date you agreed. The legal basis is your consent. You can withdraw it at any time by replying to any email we send or by writing to [email protected], and we will take you off the list. Withdrawing consent does not affect emails already sent.
Messages you send us
The contact form collects your name, email address, subject and message, and we use them to answer you. The legal basis is our legitimate interest in replying to people who get in touch, or taking steps at your request before entering into a contract. We keep correspondence for two years.
Keeping the site working and secure
Our host, our security plugin and our anti-spam tools process your IP address, your browser user agent and details of the requests you make, in order to block attacks and filter spam. The legal basis is our legitimate interest in keeping the site available and free of abuse. Security logs are kept for up to twelve months.
Analytics
We use Google Analytics to see how the site is used and which pages lead to orders. It stores identifiers in your browser and sends Google your IP address, the pages you look at, and shop events such as adding an item to the cart. The legal basis is your consent, which you give or refuse in the cookie banner and can change at any time. If you do not consent, analytics does not run.
Cookies
- Strictly necessary. Keeping your cart and your login working, and remembering your cookie choice. These run without consent because the shop cannot work without them.
- Analytics. Google Analytics, as described above. These run only if you consent.
You can also clear or block cookies in your browser settings. Blocking the necessary ones will break the cart and checkout.
Who we share data with
We do not sell personal data, and we do not share it for anyone else’s marketing.
These service providers handle data on our instructions:
| Provider | What they do | What they receive |
|---|---|---|
| Automattic | WooCommerce Payments, shipping rates and labels, spam filtering | Order, payment and delivery details |
| Stripe | Processes card payments behind WooCommerce Payments | Card and payment details |
| Analytics | Usage data, IP address, browser data | |
| Cloudflare | Content delivery, and the Turnstile anti-spam check on our forms | IP address, request data |
| Namecheap | Website and database hosting | Everything the site stores |
| Amazon Web Services, Resend | Sends order and account emails | Your email address and the message |
| Zoho | Our own mailboxes | Anything you email us |
| Defiant | Wordfence site security | IP address, browser data, request data |
Delivery carriers receive your name and delivery address so they can bring you your parcel.
We will also hand over data where the law requires it, or where we need to establish or defend a legal claim.
Where your data goes
AdaptaPlay Inc. is in the United States, and every provider listed above processes data in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, that means your data leaves your country. Where a provider is certified under the EU-US Data Privacy Framework we rely on the European Commission’s adequacy decision for it. Otherwise we rely on standard contractual clauses.
Write to [email protected] if you want to know which safeguard covers a particular provider.
How long we keep things
| Data | Kept for |
|---|---|
| Invoices and order records | Eight years, as tax and accounting law requires |
| Account details | Until you delete the account |
| Product update list | Until you unsubscribe |
| Contact form messages | Two years |
| Security and spam logs | Up to twelve months |
| Analytics | Fourteen months |
Your rights
If the GDPR applies to you, you have the right to:
- ask for a copy of the personal data we hold about you
- have inaccurate data corrected
- have data erased, where we have no continuing reason to keep it
- ask us to restrict what we do with it
- receive the data you gave us in a portable format, or have it sent on to another provider
- object to processing we base on our legitimate interests
- withdraw your consent at any time, where we rely on consent
- not be subject to decisions made purely by automated means. We do not make any.
Write to [email protected]. We answer within one month, and we do not charge for it unless a request is clearly unfounded or excessive.
If you think we have handled your data badly, you can complain to the supervisory authority where you live. In Hungary that is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa utca 9-11, [email protected].
Children
The shop is meant for adults, and we do not knowingly collect personal data from children under 16. If you believe a child has given us personal data, write to [email protected] and we will delete it.
Changes to this policy
If we change this policy we will update the date at the top. Where a change materially affects you, we will say so on the site.