Privacy Policy

This policy explains how we handle your personal data when you visit gamerbulk.com, shop with us, create an account or contact us: what we collect and why, who receives it, how long we keep it and what your rights are. Questions are welcome at shop@gamerbulk.com.

Who is responsible

Undefined Stories AB (company registration number 5590709803) is the controller of your personal data.

Undefined Stories AB
Orrekulla Industrigata 55B
425 36 Göteborg, Sweden
shop@gamerbulk.com

What we collect, why, and on what legal basis

When you place an order

Your name, e-mail address, delivery address, phone number (optional), a separate billing address if you give one, what you buy and what you pay. We need it to deliver the order, send the receipt and tracking, handle returns and refunds and answer your questions (performance of the contract), and to keep our accounts (legal obligation). Your e-mail address is saved on your cart as soon as you have typed it in the checkout, before you pay, so the order can be completed and, if you have an account, we can remind you of a cart you did not finish (legitimate interest; you can ask us to stop at any time). If you check out as a guest you do not get such reminders.

Payment details (card numbers and the like) are entered directly with our payment provider Stripe and never reach our servers.

When you create an account

Your name, e-mail address and password (stored only in encrypted, hashed form), and the addresses and phone number you choose to save. We send a link to confirm that the e-mail address is yours before the account can be used. When you confirm it, orders you placed earlier as a guest with the same address are added to your account. Basis: performance of the contract (the account) and our legitimate interest in keeping accounts secure.

Bulkcoins, our loyalty program

For account holders we keep your Bulkcoin balance, how you earned and spent them, the rewards and coupon codes you redeemed and the badges you received. Bulkcoins for an order are reserved when you buy and added when the order ships. Basis: performance of the contract (the loyalty program).

Newsletter and back-in-stock notices

If you subscribe to our newsletter we store your e-mail address, where you signed up, and the time and IP address of your consent. You confirm the subscription with a link we e-mail you. If you ask to be told when a product is back in stock, we store your e-mail address and the product and send you one e-mail. Basis: your consent, which you can withdraw at any time with the unsubscribe link in every newsletter or by contacting us.

Reviews

A few days after your order has shipped we may e-mail you to ask for a review (legitimate interest). If you write one, we store the rating and text with your order so we can mark it as a verified purchase. Your name is not shown with it.

When you contact us

Through the contact form, by e-mail or by replying to one of our e-mails: your name, e-mail address, the message and, if you give it, the order number, so we can help you and follow up (legitimate interest, and performance of the contract when it concerns an order). If you use the “Report a bug” button, we store your description, any screenshots you add, the page you were on and your browser and screen size; your name and e-mail address only if you choose to give them.

When you browse the site

We keep our own statistics of how the site is used, on our own server: the pages viewed, searches, clicks, items added to the cart and checkout steps, together with the type of device, the screen size, the language and the site that referred you. Your IP address is used only to filter out bots and to limit abuse, and is not stored. When the site is served through Cloudflare (below), Cloudflare tells us which country your connection comes from; we use that only to ask whether you want prices in your country’s currency, and do not store it. Without your consent nothing is stored on your device for this and one page view cannot be linked to the next. With your consent a random visitor id is kept in your browser for up to 12 months so that visits can be told apart. Basis: our legitimate interest in running and improving the shop, and your consent for the visitor id. Marketing tools from Google, Meta and TikTok are described under “Cookies and browser storage”.

Security and abuse prevention

Our servers log requests (including IP addresses) to keep the shop secure and working, and we limit how often forms can be sent. When something goes wrong on the site, a technical error report is sent to Sentry so that we can fix it: what failed, the address of the page without anything you entered, and the type of browser. E-mail addresses, links that carry a code and similar details are removed before a report is sent, and IP addresses are not stored. Basis: legitimate interest.

Who receives your data

We do not sell your personal data. We share it only with the companies that help us run the shop, under agreements that limit their use of it, and with authorities when the law requires it:

Stripe processes all payments, including Klarna, PayPal and the other payment methods offered in the checkout. Stripe receives your name, e-mail address, phone number, billing address and the amount, and uses them also for its own fraud prevention and legal duties. The address search in the checkout is provided by Stripe with Google.
Brevo (France) sends our e-mails: order and shipping e-mails, account and password e-mails, reminders, review requests and the newsletter. Replies to our e-mails also pass through Brevo.
Hetzner hosts our servers and database, in a data centre in Helsinki, Finland.
Cloudflare provides our domain names and can carry the traffic to our website through its network, to deliver it quickly and protect it against attacks. When it does, Cloudflare processes your IP address and the technical details of your requests.
Ongoing, our warehouse system, and the warehouse that packs your order receive your name, delivery address, e-mail address, phone number and the order lines. The carrier that delivers it (for example PostNord or DHL) receives what it needs to deliver and notify you.
Fortnox (Sweden), our accounting system, receives your name, billing and delivery address, e-mail address and the order, to book the sale and any refund.
Google Workspace hosts our customer service mailbox, so e-mail you send us is stored there.
Backblaze keeps our backup copies in a data centre in Amsterdam, the Netherlands. The copies are encrypted before they leave our server and only we hold the key, so Backblaze cannot read them.
Sentry receives the technical error reports described under “Security and abuse prevention”, stored in Frankfurt, Germany.
Google, Meta and TikTok receive information about your visit only as described under “Cookies and browser storage”.

Most of these providers are in the EU/EEA. Where data is transferred outside it (for example to Stripe, Cloudflare, Google, Meta or TikTok in the United States, or to Backblaze and Sentry, which are US companies even though our data is stored in the EU), the transfer is covered by the EU–US Data Privacy Framework or by the European Commission’s standard contractual clauses.

How long we keep it

Orders, invoices and refunds: seven years after the end of the year of the purchase, as the Swedish Bookkeeping Act requires.
Your account, saved addresses and Bulkcoins: until you ask us to delete the account.
Newsletter: while you are subscribed. An unconfirmed sign-up is deleted after 30 days, and the record of an unsubscription 30 days after it.
Back-in-stock notices: deleted 30 days after the notice has been sent, or after 180 days if the product never came back.
Site statistics: 180 days.
Our log of e-mails sent to you: 90 days.
Server access logs: up to 14 days.
Backups of our database: 30 days on our own server and, encrypted, up to 38 days in our off-site copy, so deleted data disappears from every copy within 38 days.
Messages to customer service: deleted 24 months after the last message or change in the conversation.
Unfinished carts: a cart with your e-mail address or account that has not been paid for or changed in 90 days has the e-mail address, the link to your account and the addresses removed. Carts without an e-mail address are cleared after 45 days.
An account whose e-mail address was never confirmed: deleted 30 days after it was opened, unless the address has an order, Bulkcoins, a message to customer service or a review.
E-mails that bounce or are reported as spam: our e-mail provider tells us, and we keep the address, the reason and the date for 12 months. In that time we send you no optional e-mail, such as reminders or newsletters, and if an e-mail about an order did not reach you we may contact you another way.
Reviews: for as long as they are needed, or until you ask us to delete them.
Bug reports: your name and e-mail address, the page and browser details and any screenshots are deleted 12 months after the report. The description of the bug is kept for as long as it is needed, or until you ask us to delete it.

Customers of our previous store

If you had Bulkcoins on our previous store, we keep your email address and your Bulkcoin balance so the points can be moved to you when you create an account here with the same address. We then email you a link, and the points move once you click it. Nothing else from your old account is moved. We do this on the basis of our legitimate interest. If the balance has not been taken over, both are deleted at the latest 24 months after the move to the new store.

Orders and customer accounts from our previous store are kept in a password-protected archive at old.gamerbulk.com, hosted by Servebolt, until refunds and payment disputes for those orders are settled. After that the site is closed and the archive is kept only as an encrypted offline copy. The archive is used only to handle refunds and for accounting, and is kept for 7 years as Swedish accounting law requires, then deleted.

Cookies and browser storage

Our own site sets no cookies. To work, it keeps a few things in your browser’s local storage: your cart, your sign-in, your cookie choice, light or dark mode, your own colors if you use them, your answer when we ask whether you want prices in your country’s currency, and what you have typed in the checkout (until the order is placed or the tab is closed). On the checkout page, Stripe sets its own cookies to prevent fraud. When the site is served through Cloudflare’s network, Cloudflare may set its own cookies to protect it against bots and attacks.

Marketing cookies are used only if you accept them in the cookie banner. They come from Google Ads conversion measurement and, where enabled, the Meta (Facebook) and TikTok pixels, which report the pages you view, items added to your cart, checkout starts and completed orders (with order value and currency) to Google, Meta and TikTok to measure and target our ads. They never receive your name, address or e-mail address from us. Until you accept, the Meta and TikTok scripts are not loaded at all, and the Google tag runs in Google’s consent mode: it sets no cookies and sends Google only limited, cookieless signals. Product videos come from YouTube and TikTok, so those services are contacted when a product’s videos are shown.

You can change your choice at any time with “Change cookie settings” at the bottom of every page; withdrawing removes the marketing cookies. You can also block or delete cookies and stored data in your browser settings, but the cart and sign-in will not work without local storage. To limit ads from these services in general, see Google’s ad settings, Facebook’s ad preferences and the ad settings in your TikTok account. More in our cookie policy.

How we protect your data

All traffic to the site is encrypted (HTTPS). Passwords are stored only as hashes, card details are handled by Stripe and never reach us, access to customer data is limited to the people who need it for their work, and our database is backed up and the backups are tested every week.

Your rights

Under the GDPR you have the right to:

get a copy of the personal data we hold about you (access);
have incorrect data corrected (rectification);
have your data deleted (erasure), except what we must keep by law, such as orders and invoices;
have the use of your data restricted;
receive the data you gave us in a machine-readable form (portability);
object to processing based on our legitimate interest, and always to direct marketing;
withdraw a consent at any time, without affecting what was done before.

Write to shop@gamerbulk.com and we will answer within one month. If you are not satisfied with how we handle your data, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se) or the data protection authority where you live.

We do not make decisions about you based solely on automated processing.

Changes to this policy

We update this policy when the way we handle personal data changes. The date below shows the latest version; for significant changes that affect you we will also tell you by e-mail if we can.

Last updated: 2026-10-18