Last updated 31 July 2026.
This policy explains what we do with your personal data when you use this site. The controller is ENIGMA, a company registered in the State of Oklahoma, United States, under EIN 42-3515478, contactable at hello@enigmascult.com. We are based in the United States and sell to customers in Europe, so where you are in the EU, the EEA or the UK we process your data under the EU General Data Protection Regulation (2016/679) and the UK GDPR as well as applicable United States law.
What we collect
- Account — name, email address, password (stored only as a hash), and your order and bidding history.
- Orders — billing and delivery address, phone number where you give one, and what you bought.
- Payments — we do not receive or store your full card number. Stripe or PayPal processes the payment; Stripe returns a token plus the last four digits and card brand, which is what we show you.
- Auctions — the bids you place, with their time and amount, and your watchlist.
- Forms — what you enter into our contact, hunt request, story submission and quiz forms. Our forms plugin also records partially completed entries, so an abandoned form may leave what you had typed before you left.
- Sign-in with Google or Discord — if you use one, we receive your name, email address and account identifier from that provider. We never receive your password.
- Technical — IP address, browser and pages visited, in server logs kept for security and troubleshooting.
We do not run advertising or analytics trackers on this site, and we do not build marketing profiles.
Why we use it, and on what basis
| Purpose | Legal basis |
|---|---|
| Taking and delivering your order; running auctions and charging a winning bid | Performance of a contract |
| Account creation and sign-in | Performance of a contract |
| Replying to a message, hunt request or story submission | Performance of a contract, or legitimate interests |
| Fraud prevention and keeping the site secure | Legitimate interests |
| Tax, accounting and consumer-law records | Legal obligation |
| Marketing email, where you have asked for it | Consent — withdrawable at any time |
| Publishing a story or pair you submitted to Reborn | Consent — we ask before publishing |
Who else sees it
We share data only with organisations that help us run the shop, and only as far as they need it:
- Stripe — card payments, saved cards and fraud checks.
- PayPal — where you choose to pay with PayPal.
- Google and Discord — only if you choose to sign in with them.
- Couriers — the name, address and phone number needed to deliver your parcel.
- Our hosting provider — stores the site and its database on our behalf.
- Email delivery — sends order, auction and account emails.
- [[TO CONFIRM: any accountant, bookkeeper, ERP, marketing or analytics service that also receives customer data]]
We do not sell your personal data. We are established in the United States, so if you are in the EU, the EEA or the UK your data is transferred outside your own country to us and to some of our providers. Those transfers rely on an adequacy decision where one covers the recipient — including the EU–US Data Privacy Framework where the recipient is certified — and otherwise on the European Commission’s standard contractual clauses, or the UK equivalent, together with the safeguards those require.
How long we keep it
- Order and invoice records — as long as tax and accounting law requires, currently seven years.
- Account and bidding history — while your account is open, then deleted or anonymised on request.
- Form submissions — 24 months after we have dealt with them.
- Server logs — a short rolling window for security purposes.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another provider. Where we rely on consent you can withdraw it at any time. Email hello@enigmascult.com and we will reply within one month.
Some data we must keep even if you ask us to delete it — an invoice for a completed order, for example. We will tell you if that applies.
If you think we have handled your data badly, please tell us first. If you are in the EU or the EEA you can also complain to the data protection authority in the country where you live; in the UK, to the Information Commissioner’s Office (ico.org.uk).
Children
This shop is for adults. We do not knowingly collect data from anyone under 18; if you believe a child has given us data, email us and we will remove it.
Changes
If we change this policy we will update the date at the top, and tell you directly if the change materially affects you.