Privacy Policy
Last updated: 25 October 2026
This Privacy Policy explains how BLOCKY STUDIOS S.R.L. ("Blocky Studios", "we", "us", "our") collects and uses personal data when you visit or buy from the OriginSMP store at https://store.originsmp.net (the "Store"), and what rights you have. It applies to every store operated by Blocky Studios on the Blocky Stores platform.
1. Who is responsible for your data
The controller of your personal data is BLOCKY STUDIOS S.R.L., a limited liability company registered in Romania with Trade Register number J2025024853005 and tax identification number (CUI) 51585490, with its registered office at București-Tîrgoviște 35A, Sat Mogoșoaia, Comuna Mogoșoaia, Ilfov County, Romania.
For any question about this policy, or to exercise your rights, contact us at [email protected]. We will answer within one month.
You also have the right to complain to the Romanian data protection authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro), or to the authority of the EU country where you live. We would appreciate the chance to solve your concern first, so please contact us before you do.
2. The data we collect
We collect only what we need to run the Store, deliver your purchases and protect against fraud. We do not ask for your real name or postal address, and we never receive or store your card details.
- Game account data: the Minecraft name you enter and its UUID. For premium names we ask Mojang whether the name exists and which UUID it has. If you confirm your account in game, we also keep the time of the confirmation and the one-time code used (stored only as a hash).
- Order data: the Products you bought, prices, discounts, coupons, gift cards and referral codes used, the gift recipient if you bought a gift, the order status, delivery records and subscription status.
- Payment data: the payment provider you chose, the provider's references for the payment, subscription and customer, the payment status, refunds and chargebacks. For card payments, the provider may share the country of the card and an anonymous card identifier, which we use only for fraud prevention.
- Contact data: your email address, only if you enter one to receive a receipt.
- Technical data: your IP address and the country it belongs to, recorded with each order and with account confirmations, plus standard web server logs (IP address, time, requested page, browser type).
- Support data: messages you send us and our notes about your case.
- Creator codes and offers: the creator code you used on an order, and the offers you took after a payment.
- Creators: if you are a creator with a code on our stores, your name, email address, password (stored only as a hash), payout details (PayPal email or bank account, stored encrypted), your earnings and the payouts we made to you. We use them to run your wallet and pay you (contract), and keep payout records as Romanian accounting law requires.
The Store is not intended for children under 16 and we do not knowingly collect their data.
3. How we use your data and why
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Knowing who to deliver to, confirming your account in game and showing your basket and orders | Game account, technical | Contract (Art. 6(1)(b)) |
| Processing payments and delivering Products in game | Game account, order, payment | Contract (Art. 6(1)(b)) |
| Sending a receipt, when you ask for one | Contact, order | Contract (Art. 6(1)(b)) |
| Managing subscriptions, refunds and chargebacks | Order, payment | Contract (Art. 6(1)(b)) and legitimate interest in defending legal claims (Art. 6(1)(f)) |
| Preventing fraud and abuse, including manual review of risky orders and blocking abusive accounts | Game account, order, payment, technical | Legitimate interest in protecting our business and our players (Art. 6(1)(f)) |
| Keeping accounting and tax records | Order, payment | Legal obligation (Art. 6(1)(c)) |
| Showing community features such as top supporters, recent purchases, purchase announcements and community goals | Minecraft username, Products bought | Legitimate interest in running the community of the network (Art. 6(1)(f)) |
| Keeping the Store secure and working | Technical | Legitimate interest (Art. 6(1)(f)) |
| Answering your requests | Support, contact | Contract or legitimate interest (Art. 6(1)(b) or (f)) |
Fraud checks. Our systems check orders automatically, for example the order amount, the number of orders in a short time and whether the country of payment matches your location. These checks can place an order in manual review. A member of our team makes the final decision, so no decision with legal effect is taken about you solely by automated means.
Public community features. Some stores show the usernames of recent buyers or top supporters on the Store, in game or on the network's Discord server. Only the Minecraft username, the Product and, for leaderboards, the amount are shown. If you do not want your username shown, contact us and we will hide it.
We do not sell your personal data and we do not use it for advertising profiles.
4. Who we share your data with
We share personal data only with providers that help us run the Store, and only as much as they need:
- Payment providers, which process your payment as independent controllers under their own privacy policies: Stripe Payments Europe Ltd. (Ireland), PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg), Skrill Limited and Paysafe Prepaid Services Limited (Paysafecard).
- Hosting: our servers are hosted by Hetzner Online GmbH in Germany.
- Network security and delivery: Cloudflare, Inc. protects the Store against attacks and delivers its pages.
- Player avatars: the Store shows player head images loaded from crafthead.net, which receives your IP address when your browser loads them.
- Email delivery: if you ask for a receipt, it is sent through the email service the store uses.
- Discord: if the store announces purchases on its Discord server, the username and the Products bought are sent to Discord, Inc.
- Mojang (Microsoft), which receives the Minecraft name you enter, to tell us whether it is a premium account and its UUID.
- The OriginSMP game servers, which receive your username, UUID and the Products to deliver.
- Authorities, courts and professional advisers, when the law requires it or to establish, exercise or defend legal claims.
If Blocky Studios is reorganised or sold, the new owner may continue to use your data under this policy.
Partner offers. Some stores show partner offers after a payment. If you click one, your browser goes to the partner's website; we only count the click and send the partner no information about you.
5. Transfers outside the European Economic Area
Some providers, such as Cloudflare, Stripe, PayPal and Discord, may process data in the United States or other countries outside the EEA. When they do, the transfer is protected by an adequacy decision of the European Commission (including the EU-U.S. Data Privacy Framework for certified companies) or by Standard Contractual Clauses approved by the European Commission. Contact us for more information about these safeguards.
6. How long we keep your data
- Order and payment records are kept for as long as Romanian accounting and tax law requires, which is up to 10 years from the end of the financial year of the transaction.
- Game account data is kept while you have orders or active Products on the Store, and then for as long as the related order records are kept.
- Unused account confirmation codes expire after a few minutes. Abandoned baskets and unpaid orders expire automatically.
- Web server logs are kept for up to 90 days, unless we need them to investigate an incident.
- Records of blocked accounts and chargebacks are kept for as long as needed to prevent repeated fraud.
When data is no longer needed, we delete or anonymise it.
7. Cookies
The Store itself sets only cookies that are strictly necessary for it to work, so they do not need your consent:
| Cookie | What it does | How long |
|---|---|---|
| blockystores-session | Keeps your basket and your linked account while you shop (encrypted) | 2 hours after your last visit |
| XSRF-TOKEN | Protects forms against cross-site request forgery | 2 hours |
| bs_basket | A random token that brings back your basket and linked account when you return on the same browser | 30 days |
We do not use advertising cookies, and we do not track you across other websites. Cloudflare, which protects the Store against attacks, may set a strictly necessary security cookie (such as __cf_bm or cf_clearance) when it checks for bots. Payment providers set their own cookies on their payment pages, under their own policies.
If the Store shows content from other services (for example a YouTube video or a Discord widget), those services may set their own cookies, under their own policies.
8. Security
We protect your data with encrypted connections (HTTPS), encryption of sensitive settings, access limited to staff who need it, two-factor authentication for administrators and an audit log of administrative actions. Payments are handled entirely by the payment providers, so card details never reach our servers. If a personal data breach puts your rights at risk, we will inform you and the authority as the law requires.
We will never ask for your password or card details by email or in game.
9. Your rights
Under the General Data Protection Regulation (EU) 2016/679 you have the right to:
- access the personal data we hold about you and receive a copy;
- rectify inaccurate data;
- erase your data, when we no longer need it or have no legal basis to keep it (records we must keep by law are kept until the legal period ends);
- restrict processing in certain cases;
- object to processing based on our legitimate interests, including the display of your username in community features;
- data portability, to receive the data you gave us in a common machine-readable format;
- withdraw consent at any time, where processing is based on consent.
To exercise these rights, contact us at [email protected]. We may ask you to confirm that the Minecraft account is yours before we act, for example by joining the server, so that we never disclose data to the wrong person. Exercising your rights is free, unless a request is clearly unfounded or excessive.
10. Changes to this policy
We may update this policy when the Store or the law changes. The date at the top shows the latest version. If a change significantly affects how we use your data, we will announce it on the Store.
