Politica sulla privacy
Last updated: 3 October 2026
Your privacy matters to us. This Privacy Policy explains what personal data we collect when you use www.2play.com (the "Website"), why we collect it, who we share it with, how long we keep it and what your rights are. It is written for the European Union's General Data Protection Regulation (GDPR) and Irish data protection law.
1. Who is responsible for your data
The controller of your personal data is 2play, a company incorporated under the laws of Ireland, with its registered office at Pembroke House, 28–32 Pembroke Street Upper, Dublin D02 EK84, Republic of Ireland ("2play", "we", "us").
For any question about your personal data or to exercise your rights, email us at support@2play.com with "Privacy" in the subject line.
2. The personal data we collect
- Account data: your email address, and your name if you add it. You sign in with a one-time code sent to your email address.
- Order data: the products you buy, prices, VAT, order number and date, your billing details as entered at checkout, the country detected from your connection when you order, and the keys we deliver to you.
- Payment data: payments are handled by our payment provider, Stripe. We never see or store your full card number. We receive the payment status, the card type, the last four digits, the expiry date and the card's country, together with Stripe's fraud risk assessment.
- Communications: the messages you send to our support team and our replies.
- Technical and usage data: your IP address, the country it indicates, your browser and device type, your language, the pages you visit and the contents of your cart. We collect this through cookies and similar technologies, as explained in our Cookie Policy.
- Marketing preferences: whether you have agreed to receive emails about offers and new releases.
We do not ask for special categories of data, such as health data, and we ask you not to send us any.
3. Why we use your data and our legal basis
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Create and manage your account | Account data | Performance of our contract with you |
| Process your orders, deliver your keys and provide customer support | Account, order, payment and communications data | Performance of our contract with you |
| Determine your country to show the right products, prices and VAT | Technical data (IP address) | Legal obligation (VAT rules on proof of the customer's location) and our legitimate interest in only selling keys that work in your country |
| Check orders for fraud before delivering them | Order, payment and technical data | Our legitimate interest in preventing fraud and protecting our customers |
| Keep accounting, tax and VAT records | Order and payment data | Legal obligation |
| Run the Website securely and remember your cart and language | Technical data (strictly necessary cookies) | Our legitimate interest in providing a working, secure website |
| Understand how the Website is used and improve it | Usage data (analytics cookies) | Your consent, where the law requires it |
| Send you emails about offers and new releases | Email address and marketing preferences | Your consent. You can unsubscribe at any time with the link in each email. |
| Handle complaints, chargebacks and legal claims | Order, payment and communications data | Our legitimate interest in defending our rights |
If you do not give us the data we need to process an order, such as a valid email address, we cannot complete it.
4. Automated checks
Payments are screened automatically by Stripe's fraud prevention tools, and we compare the country of your billing details with the country of your connection. An order that is flagged is held and reviewed by a member of our team before any decision to cancel it. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing.
5. Who we share your data with
We share your data only when needed for the purposes above:
- Shopify (Shopify International Limited, Ireland), the e-commerce platform that hosts the Website, the checkout, customer accounts and order emails. Shopify processes data on our behalf.
- Stripe (Stripe Payments Europe, Limited, Ireland), which processes payments and screens them for fraud. For some purposes, such as fraud prevention and its legal obligations, Stripe acts as an independent controller under its own privacy policy.
- Publishers and authorised distributors of the products we sell, limited to what they need to supply, verify, replace or cancel a key, such as the order reference and country.
- Content and font providers. When you open a page, your browser loads some files directly from other providers: fonts from Google Fonts (Google), some scripts from the jsDelivr and Google Hosted Libraries networks, and game images and videos from Steam's servers (Valve). These providers receive your IP address and browser information as part of the request.
- Professional advisers, such as accountants, auditors and lawyers, under a duty of confidentiality.
- Public authorities, such as tax authorities, regulators, courts or the police, when the law requires it.
- A buyer or successor of our business, if it is sold or restructured, under the same protections.
We do not sell your personal data.
6. International transfers
Some of our providers, or their sub-processors, process data outside the European Economic Area, for example in Canada or the United States. In that case we rely on the safeguards provided by the GDPR: an adequacy decision of the European Commission (such as for Canada, or for companies certified under the EU-U.S. Data Privacy Framework) or the European Commission's Standard Contractual Clauses.
7. How long we keep your data
- Account data: as long as your account is open. When you close it, we delete it, except the order records we must keep (below).
- Order, payment and VAT records: 6 years after the end of the financial year of the order, as required by Irish tax law.
- Support messages: 2 years after the conversation ends, unless they relate to a dispute that is still open.
- Marketing preferences: until you unsubscribe or close your account.
- Cookies: for the periods listed in our Cookie Policy.
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected;
- have your data deleted, when we no longer need it or have no legal reason to keep it;
- restrict how we use your data in certain cases;
- receive the data you gave us in a structured, machine-readable format (portability);
- object to our use of your data based on our legitimate interests, and to direct marketing at any time; and
- withdraw your consent at any time, without affecting what we did before you withdrew it.
To exercise these rights, email support@2play.com. We may ask you to confirm your identity, and we reply within one month. It is free of charge.
You also have the right to complain to a data protection authority. In Ireland this is the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28 (www.dataprotection.ie). You can also contact the authority of the EU country where you live or work. We would appreciate the chance to address your concern first.
9. Visitors from the United States
Some U.S. state laws give residents the right to opt out of the "sale" or "sharing" of personal information or of targeted advertising. We do not sell your personal data. You can find more information and make your choices on our Your Privacy Choices page. If your browser sends a Global Privacy Control signal, we treat it as an opt-out request.
10. Children
The Website is not intended for children under 16, and we do not knowingly collect their personal data. Under-18s may only buy with the permission of a parent or guardian. If you believe a child has given us personal data, please contact us and we will delete it.
11. Security
The Website and checkout are served over encrypted connections (HTTPS). Shopify and Stripe are certified to the Payment Card Industry Data Security Standard (PCI DSS). Access to customer data within 2play is limited to the people who need it for their work.
12. Changes to this policy
We may update this Privacy Policy, for example when we add a new service or provider. The date at the top shows when it last changed. If the changes are significant, we will tell you by email or with a notice on the Website.