Privacy Notice
Key Interactive Store — store.keyinteractive.it Notice pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) Last updated: 6 November 2026
1. Data controller
The controller is Key Interactive, Via Aldo Moro 45, 30020 Quarto d'Altino (VE), Italy, VAT number (partita IVA) 04987210277. Privacy contact: store@keyinteractive.it.
No data protection officer (DPO) has been appointed, as this is not mandatory.
Key Interactive is also the controller of Key Interactive Accounts (users.keyinteractive.it, tenant.keyinteractive.it), the system you use to sign in to the Store, and of the website keyinteractive.it. This notice concerns the Store; for your account, see the Key Interactive Accounts privacy notice.
2. What data we process and where it comes from
Account data (from Key Interactive Accounts). When you sign in to the Store with your Key Interactive Account we receive: user identifier, first name, last name and email address. We do not receive your password. If you purchase on behalf of a business we also receive the list of businesses of which you are a member, with your role and the business name, and, for administrators, the business's tax data registered on Key Interactive Accounts.
Order data (provided by you). Items, quantities, amounts, date, language, the "purchase for myself / for the business" choice, the declarations confirmed at checkout (for example consent to immediate delivery).
Billing data (provided by you to Stripe). Name or company name, billing address, country and, where applicable, VAT number, tax code (codice fiscale), SDI recipient code or PEC certified email address. Stripe transmits them to us after payment and we store them together with the order.
Payment data. Processed by Stripe. We receive only: payment outcome, transaction identifier, amount, currency, last digits and type of the payment method. We never receive the full card number.
Licences and entitlements. The text of each software licence contains the name of the licensee (you or the business) and the buyer's email address, digitally signed; the status of subscriptions and passes; download links and dates.
Online licence check (from the program). When a program with a lifetime licence (for example KeyOnAir) has internet access, it contacts our licensing service from time to time to check that the licence is used correctly. We receive: the licence text, an anonymous fingerprint of the computer (a code calculated so that the operating system's own identifier cannot be recovered from it), the program version, the date of the check and, if the program sends it, the computer name that the user sees in the program. We do not store the IP address of these requests (we only use it, in memory, to limit repeated requests). Without internet the program works anyway.
Technical data. IP address, browser, operating system, date and time of requests, pages visited, in the server logs and the hosting provider's logs; email delivery outcomes.
Communications. The emails you send us for support, refunds or withdrawal.
We do not process special categories of data (Article 9 GDPR) and we do not request data from minors: the Store is restricted to adults.
3. Why we process it and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Letting you sign in to the Store and recognising you | account data, technical cookies | performance of the contract (Article 6(1)(b)) |
| Managing the cart, order, payment, delivery of licences and entitlements, support | order, billing and payment data, licences | performance of the contract (Article 6(1)(b)) |
| Purchases on behalf of a business: verifying that you are a member and an administrator | memberships and role from Key Interactive Accounts | performance of the contract (Article 6(1)(b)) |
| Issuing and keeping tax and accounting documents | order and billing data | legal obligation (Article 6(1)(c)) |
| Handling withdrawal, refunds, complaints, disputes | order, payment, communications | performance of the contract and legal obligation (Article 6(1)(b), (c)) |
| Preventing fraud and abuse, protecting the Store | technical, order and payment data | legitimate interest (Article 6(1)(f)) |
| Operating and protecting the website, security logs | technical data | legitimate interest (Article 6(1)(f)) |
| Sending you service communications (confirmations, licences, renewals, price changes, discontinuations) | email, order | performance of the contract (Article 6(1)(b)) |
| Showing your purchases in the "Purchases" section of your Key Interactive Account | order number, description, amount, status | performance of the contract (Article 6(1)(b)) |
| Activating entitlements in the linked products (for example the app of a subscription service) | user or business identifier, product, status and validity of the entitlement | performance of the contract (Article 6(1)(b)) |
| Defending a legal claim in court | all relevant data | legitimate interest (Article 6(1)(f)) |
| Checking online that the licence is used correctly (number of computers) and cancelling it after a refund | licence text, anonymous computer fingerprint, version, computer name, dates | performance of the contract and legitimate interests (Article 6(1)(b), (f)) |
We do not carry out marketing, newsletters, profiling or automated decision-making with legal effects. We do not use third-party traffic analytics tools or advertising.
Providing account, order and billing data is necessary to purchase: without it, we cannot conclude the contract.
4. Cookies
The Store uses only technical cookies, which are necessary for it to work and for which no consent is required:
| Cookie | Purpose | Duration |
|---|---|---|
ki_store_auth |
keeps you signed in after you log in | 14 days, renewed on each visit |
ki_store_login |
protects the sign-in handover to Key Interactive Accounts | 10 minutes |
ki_store_cart |
keeps your cart, even before you sign in | 30 days |
ki_store_ctx |
remembers whether you are acting for yourself or for a business | 30 days |
| antiforgery cookie | protects forms against fraudulent submissions | session |
The contents of the cookies are encrypted and cannot be read by third parties. We do not use profiling, analytics or third-party cookies. The language is in the page address, not in a cookie.
During payment you are on Stripe's page (checkout.stripe.com), which uses its own cookies in accordance with Stripe's privacy notice.
5. Who we share the data with
- Stripe Payments Europe, Ltd. (Ireland): handling of payments, refunds, collection of billing data and fraud prevention. Stripe processes the data as an independent controller for its own obligations (anti-money laundering, payment security) and may transfer it to the United States and other countries, with the safeguards provided by the GDPR (standard contractual clauses and, where applicable, the EU-US Data Privacy Framework). Notice: stripe.com/privacy.
- Hosting provider, with servers in the European Union (Germany): storage of data and logs, as a processor.
- Email provider: sending of service emails (confirmations, licences), as a processor.
- Key Interactive Accounts (same controller): receives the summary of your purchases to show it in your personal area and provides us with account and business data.
- Linked Key Interactive products and services (same controller): receive the identifier and status of entitlements in order to activate them.
- Tax and legal advisers, public authorities, where required by law or to defend a legal claim.
We do not sell or transfer the data to third parties for their own purposes.
6. Transfers outside the European Union
The data is stored in the European Union. The only transfer outside the EU may take place through Stripe, with the safeguards described above. If you use the Store from a non-EU country, the data you send us travels to the European Union.
7. How long we keep it
| Data | Retention |
|---|---|
| Orders, billing data, payments, refunds | 10 years from the end of the year of the transaction (tax and civil-law obligations) |
| Perpetual licences and their text | for the whole duration of the licence; the text of a refunded licence is hidden immediately and deleted together with the order |
| Computers using a licence (anonymous fingerprint, computer name, dates) | for the whole life of the licence; you can free them in “My products”; deleted together with the licence |
| Subscriptions and passes | until expiry, then as order data |
| Account data received from Key Interactive Accounts | as long as the account exists; when the account is deleted, only the order data remains for the tax retention period, no longer linked to an active account |
| Cart | 30 days in the cookie; no copy on the server |
| Technical logs | up to 12 months |
| Support communications | 24 months from the closure of the request |
| Data needed for a dispute | until the dispute is settled |
The text of a licence is digitally signed and cannot be modified: a request to rectify the name entails the issuance of a new licence.
8. Your rights
At any time, by writing to store@keyinteractive.it, you may request:
- access to your data and a copy of it (Article 15);
- rectification of inaccurate data (Article 16);
- erasure (Article 17), within the limits of tax retention obligations;
- restriction of processing (Article 18);
- portability of the data you have provided to us, in a readable format (Article 20);
- to object to processing based on legitimate interest (Article 21).
We reply within one month. To verify your identity we may ask you to write from the email address of your Key Interactive Account.
You also have the right to lodge a complaint with the Garante per la protezione dei dati personali (Italian Data Protection Authority) (www.garanteprivacy.it) or with the authority of the country in which you reside.
To delete your Key Interactive Account, use the Key Interactive Accounts features: deleting the account does not delete orders subject to tax retention.
9. Security
We use encrypted connections (HTTPS), encrypted and protected cookies, signing keys stored separately, system access restricted to the controller, regular backups and updates. No system is 100% secure: in the event of a breach that poses a risk to you, we will inform you as provided for by Article 34 GDPR.
10. Changes
We may update this notice, for example when we add products or providers. The version in force is the one published on the Store with the date at the top; in the case of substantial changes we will notify you by email.