Privacy policy
Version: 10.1
Effective date: 18 August 2026
Previous website version: 9.0
This version applies from the effective date above. It does not retrospectively alter an existing contract or accrued right.
This Policy explains how Redkey USB Ltd uses personal data when you visit our website, buy or register a product, use activation or update services, request support or otherwise deal with us. It is a privacy notice, not a request for consent.
We process personal data under applicable UK data-protection law, including the UK GDPR and the Data Protection Act 2018 as amended.
1. Who we are
Redkey USB Ltd is the controller of the personal data covered by this Policy unless another organisation is identified as a separate controller.
Company number: 11257207 (England and Wales)
Registered office: 128 City Road, London, EC1V 2NX, United Kingdom
Email: contact@redkeyusb.com
Website: https://redkeyusb.com
2. Personal data we collect
Depending on how you deal with us, we may collect:
- identity and contact information, such as your name, organisation, billing and delivery addresses, email address and telephone number;
- order and transaction information, including products purchased, order history, invoice and purchase-order information, tax information, delivery status, returns and refund records;
- payment-related information, such as payment status, transaction references and limited information returned by a payment provider. Card details are handled by payment providers and are not stored by Redkey USB Ltd;
- manual-payment information, including an invoice reference, payer name, bank or Wise transaction reference, payment correspondence and, where applicable, a record that cash was received and verified;
- account information, such as account preferences and order history. Login credentials are handled by Shopify or the relevant account provider. We do not have access to plain-text passwords;
- product, licence and service information, such as a Redkey serial number, licence or activation status, software version, update request, timestamps, IP address and device, hardware or diagnostic information reasonably generated or supplied to authenticate a genuine product, operate activation or updates, prevent misuse or troubleshoot a service;
- warranty-transfer information, including the registered owner, proposed new owner, proof of purchase or authority where needed, and the outcome of the request;
- communications, including emails, contact-form messages, support tickets, reviews, survey responses and other information you choose to send;
- marketing preferences, including subscriptions, consent, opt-out and suppression records; and
- website and security information, such as IP address, browser or device type, pages requested, referral information, cookie choices, timestamps, interaction information and security logs generated by Shopify, our website or service providers.
We do not normally need special-category personal data, such as health, biometric, political, religious or trade-union information. Please do not send it unless genuinely necessary. If you include such information in a support message, we will minimise it, delete it where it is not needed, and process it only where both an Article 6 lawful basis and an applicable Article 9 condition are available, such as explicit consent or the establishment, exercise or defence of legal claims.
We may use properly anonymised or aggregated information that no longer identifies an individual. Information that can still be linked back to a person remains personal data and is treated accordingly.
3. Redkey and the contents of a target disk
Redkey works on whole disks selected by the user. It does not read, interpret, upload or extract the contents of files from a target disk for Redkey USB Ltd.
Erasure reports are created for the user and can be saved to storage chosen by the user. Redkey USB Ltd does not automatically receive those reports or their contents. A report, screenshot, log, diagnostic file or other device information leaves the user’s environment only if the user chooses to send it to us.
If you send us a report or screenshot for support, it may contain names, serial numbers, device identifiers or other personal data. Please remove information that is not needed before sending it. Do not send the contents of a target disk.
4. How we obtain personal data
We obtain personal data:
- directly from you when you order, pay, register, activate, update, request a transfer, contact us, submit a review or subscribe;
- automatically from the website, activation or update service and related security systems, subject to applicable law and your cookie choices;
- from Shopify, payment providers, carriers, customs providers, fraud-prevention services and other providers involved in a transaction; and
- from an organisation, reseller or registered owner acting on your behalf, for example during procurement, account administration or a warranty transfer.
If you provide another person’s data, you must have authority to do so and should make this Policy available to them.
Information needed to provide a product or service
Some identity, contact, payment, delivery, serial-number and activation information is needed to enter into or perform a contract, comply with law, prevent fraud or provide a requested service. If required information is not provided, we may be unable to accept or deliver an order, activate or update a product, verify a transfer, process a return or provide the requested support. Optional fields are identified by context and need not be supplied.
5. Why we use personal data and our lawful bases
We use personal data only for a specified purpose and where we have a lawful basis.
| Purpose | Personal data commonly involved | Usual lawful basis |
|---|---|---|
| Taking and fulfilling orders, invoicing, payment, delivery and returns | Identity, contact, order, payment and delivery data | Contract; steps requested before a contract |
| Product registration, activation, updates and technical support | Identity, contact, serial, licence, activation, version, device and support data | Contract; legitimate interests in operating and securing genuine products and services |
| Warranty administration and ownership transfers | Identity, contact, order, serial, ownership and transfer data | Contract; legitimate interests in accurate and secure product records |
| Tax, accounting, sanctions, customs, product-safety and other legal records | Identity, transaction, payment, delivery and product data | Legal obligation; legitimate interests where appropriate |
| Preventing fraud, misuse and unauthorised activation; protecting systems and users | Transaction, payment, account, network, serial, device and security data | Legitimate interests; legal obligation where applicable |
| Responding to enquiries, complaints and disputes | Contact, order, product, support and communications data | Contract; legitimate interests in customer service and resolving or defending claims |
| Improving our website, instructions and services using proportionate analytics | Website, device, interaction and preference data | Consent for non-essential cookies or similar technologies; legitimate interests where processing is permitted without consent |
| Sending marketing to people who ask for it | Contact and marketing-preference data | Consent |
| Sending relevant marketing to an existing customer where the legal soft-opt-in applies | Contact, purchase and suppression data | Legitimate interests, subject to applicable direct-marketing law and an opt-out in every message |
| Sending necessary order, licence, security, product-safety or service communications | Contact, order, product and licence data | Contract; legal obligation; legitimate interests, depending on the message |
| AI-assisted drafting, organisation or support preparation | The minimum content needed for the underlying task | The same lawful basis as the underlying purpose; we do not treat AI as a separate purpose |
Where we rely on legitimate interests, our interests include operating and securing the business and products, preventing fraud, keeping accurate records, supporting customers, improving proportionately and resolving disputes. We consider necessity, the effect on individuals and whether a less intrusive method is available.
If we want to use personal data for a materially different purpose, we will assess compatibility and provide further privacy information before the new use where required.
Your right to object: You have an absolute right to object at any time to use of your personal data for direct marketing. You may also object to processing based on our legitimate interests. We will stop direct marketing when you object; for other legitimate-interest processing, we will consider the objection and stop unless the law permits compelling grounds to continue. You can object by emailing contact@redkeyusb.com.
6. Payments
Card and electronic payments are handled by payment providers made available at checkout. Those providers may process data as separate controllers under their own privacy notices.
Where we agree a manual bank transfer or Wise payment, we use the information needed to identify, reconcile, refund and account for the payment. If we agree to accept cash, we keep only the records reasonably needed to verify the payment, fulfil the order, prevent fraud and comply with accounting or legal duties.
Do not send payment-card details by email or support form.
7. Cookies, email measurement and similar technologies
Essential cookies and local-storage technologies are used to operate the store, cart, checkout, security and privacy choices. Where required, non-essential analytics, preference, advertising or marketing technologies are used only after valid consent.
Our cookie banner or privacy-preference tool provides the current categories, providers, purposes, durations and available choices. You can withdraw consent there at any time. You can also control cookies in your browser, although blocking essential cookies may prevent parts of the site from working.
Shopify and providers enabled for checkout, payments or site functions may set their own technologies. The current tools can change, so the live preference tool is the most accurate cookie inventory. We do not treat acceptance of this Policy as consent to non-essential cookies.
Where an email service measures delivery, opening or link interaction, we use that information only as disclosed in the message or preference information and in accordance with applicable consent and direct-marketing rules. If you object to direct marketing or unsubscribe, we stop marketing measurement associated with future marketing messages except for the minimal suppression and delivery records needed to respect your choice and protect the service.
8. Artificial intelligence and automated processing
We may use AI-assisted tools to help draft public content, organise internal work or prepare a suggested response to a customer enquiry. A person remains responsible for material published by us and for customer communications sent in our name.
We limit personal data supplied to an AI provider to what is reasonably necessary for the task and apply appropriate contractual, access and retention safeguards. We do not intentionally submit the contents of a target disk to an AI service.
Shopify, payment providers or security providers may use automated systems to detect suspected fraud or abuse. We do not make decisions based solely on automated processing that have legal or similarly significant effects on an individual. If a transaction is declined or restricted and you believe this is wrong, contact us so it can be reviewed or explained where appropriate.
If our automated-decision practices materially change, we will update this notice and provide the information and safeguards required by law before that processing begins.
9. Who receives personal data
We may disclose relevant personal data to:
- Shopify, which provides our ecommerce platform;
- payment, banking, invoicing and fraud-prevention providers;
- postal, courier, fulfilment and customs providers;
- hosting, email, security, support, analytics, advertising and other technology providers enabled for our services;
- professional advisers, insurers, auditors and accountants;
- a reseller, procurement organisation, registered owner or proposed new owner where needed for an authorised transfer or transaction;
- regulators, courts, law-enforcement bodies or other authorities where disclosure is required or permitted by law; and
- a buyer, investor or adviser involved in a genuine business reorganisation, subject to appropriate confidentiality and data-protection arrangements.
Providers act under contracts and data-protection terms appropriate to their role. Some providers, including Shopify and payment providers, may also act as separate controllers for parts of their service.
We do not sell personal data.
10. International transfers
Some providers process personal data outside the United Kingdom, including in the European Economic Area, Canada and the United States.
Where UK data-protection law requires a safeguard, we use an applicable UK adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or another lawful transfer mechanism. We may also use supplementary technical and organisational measures where appropriate.
Contact us if you would like more information about, or a copy of, the safeguard used for a particular category of transfer. We may redact confidential commercial information while providing the information required by law.
11. Security and personal-data breaches
We use technical and organisational measures appropriate to the nature of the data and the risks involved. These include access controls, secure connections, account protection, provider due diligence, backup or recovery arrangements where appropriate, staff or contractor confidentiality measures, and procedures for handling suspected incidents.
No online service can guarantee absolute security. You should protect account credentials and contact us promptly if you believe an account, licence or communication has been compromised.
We assess and record personal-data breaches as required. If a breach is reportable, we notify the Information Commissioner’s Office without undue delay and, where feasible, within 72 hours of becoming aware of it. We notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
12. Retention
We keep personal data only for as long as reasonably needed for the purpose collected, legal and accounting obligations, product support, security, dispute resolution and legal claims.
Our usual approach is:
| Category | Usual retention approach |
|---|---|
| Transaction, invoice and tax records | Normally six years after the relevant accounting period, or longer where law requires |
| Account data | While the account is active and afterwards only as needed for orders, legal duties, security or claims |
| Support correspondence | Normally up to three years after the matter closes, unless linked to an active warranty, safety matter, dispute or legal requirement |
| Product registration, licence, activation, update and transfer records | While ownership, licence, warranty, lifetime-update or support rights remain relevant, followed by an appropriate period for security, fraud prevention and legal claims |
| Marketing records | Until you opt out, plus a minimal suppression record so we can respect the opt-out |
| Website and security logs | For a limited operational or security period set according to the system and risk |
Data may remain for a limited period in protected backups before being overwritten. When no longer needed, data is deleted, anonymised or securely disposed of.
13. Your rights
Subject to the conditions and exceptions in data-protection law, you may ask us to:
- provide access to your personal data;
- correct inaccurate or incomplete data;
- erase data;
- restrict processing;
- provide portable data where the right applies;
- stop direct marketing;
- consider an objection to processing based on legitimate interests; or
- record the withdrawal of consent.
Email contact@redkeyusb.com to exercise a right. You may make a request verbally or in writing, although written contact can help us identify what you need. We normally respond within one month. We may extend this by up to two further months for a complex request and will explain the extension within the first month.
We may ask for information reasonably needed to confirm identity and prevent unauthorised disclosure. We normally use account, order or contact information first. We request identity documents only where proportionate and do not retain them longer than needed for verification and any required audit record.
Rights are generally free of charge. We may charge a reasonable fee or refuse a manifestly unfounded or excessive request where the law permits, and will explain the decision and complaint rights.
Withdrawal of consent does not affect processing that was lawful before withdrawal. Erasure, objection and other rights are not absolute; for example, we may retain information needed for tax, safety, fraud-prevention or legal-claim purposes.
14. Marketing and service communications
You can unsubscribe from marketing at any time by using the link in an email or contacting us. We also record suppression information so we do not add you back inadvertently.
Opting out of marketing does not stop necessary order, licence, activation, update, security, product-safety, policy or service communications where we have another lawful basis to send them.
15. Children
Our products and services are not directed at children. A parent, guardian or authorised adult should place an order for a child. If you believe a child has supplied personal data to us without appropriate authority, contact us so we can investigate and take appropriate action.
16. External websites
Our website may link to another organisation’s website or service. That organisation is responsible for its own processing and privacy information. A link does not mean that we control or endorse its privacy practices.
17. Complaints
Please contact us first if you have a concern so we can try to resolve it.
You may also complain to the UK Information Commissioner’s Office:
Information Commissioner’s Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Website: https://ico.org.uk
Telephone: 0303 123 1113
You may also have a right to complain to the data-protection authority where you live or work.
18. Changes to this Policy
We may update this Policy to reflect changes in law, providers or our processing. The current version and effective date are published on our website. Where required by law or reasonably practicable, we will give additional notice of a material change before the new processing begins.
Continued website use is not treated as consent where the law requires a separate, freely given choice. We rely on an appropriate lawful basis and request consent separately where required.
19. Contact
For privacy questions, objections or rights requests:
Email: contact@redkeyusb.com
Contact page: https://redkeyusb.com/pages/contact
Postal address: Redkey USB Ltd, 128 City Road, London, EC1V 2NX, United Kingdom
Copyright © 2026 Redkey USB Ltd. All rights reserved.