What we know about you, and what we do not.

What you buy here says something private about you, so the honest thing is to collect as little as possible and say exactly what happens to it. Optional browsing analytics and Meta advertising run only after their respective affirmative choices. A limited server counter records anonymous daily page-load totals; it does not follow individual visitors. This policy explains the distinction and your controls.

Version 2 · last updated 20 September 2026

1. Who is responsible

The data controller for personal data collected through onyxbunny.com is:

Controller: Vakaris Pupkus, trading as Onyx Bunny
Registration number: Not issued yet. It will be published here as soon as the registration is complete.
Registered address: Bajorų 1, Verdulių kaimas, LT-77155 Šiauliai, Lithuania
Privacy contact: hello@onyxbunny.com

We are not required to appoint a Data Protection Officer, and we have not. Privacy requests go to the address above and are handled by the owner.

Our lead supervisory authority is the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt). You may also complain to the authority in your own country.

2. What we collect, why, and on what legal basis

Data	Why	Legal basis (GDPR Art. 6)	Kept for
Name, delivery address, email, phone if you give it	To take, price, fulfil and deliver your order, and to contact you about it	6(1)(b) — performance of a contract	Duration of the order, then retained only as accounting records require
Order contents, totals, VAT, country	To fulfil the order and to meet tax and accounting obligations	6(1)(b) and 6(1)(c) — legal obligation	10 years from the end of the financial year, as Lithuanian accounting law requires
Correspondence you send us	To answer you, and to keep a record of complaints and returns	6(1)(b), and 6(1)(f) — our legitimate interest in defending claims	3 years from the last message, or longer if it relates to a live dispute
Confirmation that you are 18+, accepted the terms, and were shown the hygiene-seal notice	Evidence of pre-contract information, required by consumer law	6(1)(c)	With the order record
Payment status and processor reference	To reconcile payments and process refunds	6(1)(b) and 6(1)(c)	With the order record
Newsletter, if you sign up: your email, language, where you signed up, and when you signed up and confirmed	To send occasional emails about new products, guides and the couples game, only after you confirm by clicking the link we email you	6(1)(a) — consent; withdraw any time with the unsubscribe link in every email	Until you unsubscribe; unconfirmed sign-ups are deleted after 30 days
Welcome code: the code, its value, expiry and the order it was used on, plus a one-way code made from your email so each address gets only one welcome code	To honour the €10 welcome code once per person	6(1)(b) — the offer you accepted	Code record: 2 years; the one-way email code: kept so the offer is not claimed twice
Order reward code: the code, its value, expiry, the order that earned it and the order it was used on	To give the €15 credit for orders over €100 and let it be used once	6(1)(b) — the offer you accepted	Code record: 2 years
Game pass: your email, the pass you bought, its code, and a random device number for each phone the code is used on (no name, no address)	To sell and deliver the pass, send the receipt, and limit one code to two devices	6(1)(b) — performance of a contract; 6(1)(c) for accounting records	Code and device numbers until the pass ends plus 1 year; payment records as accounting law requires
A product review, if you write one: star rating, text, the name you choose to show (or “Anonymous”), and any photos	To publish it on the product page after we have read it. Photos are re-encoded in your browser before upload, which removes hidden data such as location	6(1)(a) — consent, given when you submit; ask us and we delete it	Until you ask us to remove it, or we remove the product
Order number and email typed into the review form (optional), or a private signed review invitation	Only to check once that the order was paid and included the product, for the verified-purchase badge. Not stored; only the order number is kept with a verified review, visible to the owner	6(1)(a)	Typed email: not kept (order number: with the review). For an invitation we keep its random identifier, order reference, expiry, send status and whether it was used. The link expires after 30 days and can be used once. The owner sends it manually only after a paid order is marked delivered; there are no automatic reminders.
A one-way code made from your IP address when you send a review	To stop review spam (at most 5 reviews per connection per day)	6(1)(f) — legitimate interest in preventing abuse	Deleted automatically after about 26 hours
Email address, if you ask for product or safety notices	To send them	6(1)(a) — consent, withdrawable at any time	Until you unsubscribe

We never collect card numbers, expiry dates or security codes. Card details are entered only on the payment provider's own hosted page. They never reach this site, are never logged, and we never see them.

We do not ask for, and do not want, any information about your health, sexuality or relationships. Your order contents are of course revealing, so we treat every order record as confidential, restrict access to the owner and the fulfilment partner, and never use it for anything except fulfilling and supporting that order.

3. Browser preferences and optional measurement

The site uses browser storage for the functions and preferences below. Some values, such as bag contents, are transmitted when needed to provide the service:

Your 18+ confirmation.
Your basket contents, currency and language preference.
Whether you dismissed the storage notice, and your yes/no choice about optional browsing analytics.
Recently viewed products.
If you create an optional account: your saved address, wishlist and order history, stored encrypted in your browser.

Essential/requested preferences support the functions you use. Optional browsing analytics uses pseudonymous browser and tab codes only after “Allow analytics”, on the basis of your consent, Art. 6(1)(a) GDPR and applicable device-storage rules. Advertising requires its separate choice. It can share visits and shopping events with Meta Platforms Ireland Ltd and can be turned off later. See analytics choices and advertising choices.

A limited server impression counter adds to approved daily page groups (and a daily total of loads opened inside the Instagram or Facebook app) without retaining visitor IDs, IP addresses, precise timestamps, raw referrers, queries or browsing histories. It uses the ordinary page-delivery request, without a tracking script or additional device access. Incidental request processing is assessed under website-improvement legitimate interest, Art. 6(1)(f) GDPR, with immediate aggregation, no profiling or order matching, and a simple objection route. The new totals are retained for at most 365 days with cleanup during subsequent traffic. Hosting/security request processing remains separate. Details and counting opt-out.

Account security. Passwords are never stored anywhere. Sign-in verification uses a PBKDF2-SHA-256 hash with 210,000 iterations and a unique random salt. A separate password-derived key encrypts your local account data with AES-GCM using a fresh initialisation vector for every write. The decryption key lives in session storage, so a copy of your local storage alone does not reveal the contents. Signing out removes that key. We cannot recover your password, and clearing your browser data deletes the account record permanently.

4. Who else sees your data

The parties below receive information for the stated services. Optional Meta advertising also involves Meta's own processing under its policies, described in our cookie notice.

Recipient	What they receive	Where
Cloudflare — hosting, order storage and first-party analytics	Service/order data and ordinary hosting/security requests; anonymous daily document/experiment totals; and, only with analytics consent, pseudonymous page and interaction events. Raw detailed events are deleted after 90 days during routine cleanup. The new document counter keeps only approved day/group totals for at most 365 days. Analytics consent: Art. 6(1)(a) GDPR; limited incidental counting request processing: Art. 6(1)(f). Order/service processing has the bases described above. Choices and limits.	EU/global hosting network; processor and transfer arrangements apply to the relevant service.
Resend — transactional email	Your email address, name and order details (or game pass and code), to send the confirmation, game code and tracking	United States (Resend, Inc.). Resend’s data processing agreement applies; transfers rely on the EU–US Data Privacy Framework and the EU Standard Contractual Clauses.
Fulfilment partner	Your name, delivery address and the items to pack	China. See transfers below. We sign a written data processing agreement with the fulfilment partner before it handles any order.
Carrier	Your name, delivery address, phone if required for delivery, and the customs declaration	Destination country
Payment processor	Your payment details, which you enter directly with them; we receive only a status and a reference	Stripe Payments Europe, Ltd. (Ireland), with onward transfers within the Stripe group. Card details are entered on Stripe's own hosted page and never reach this site.
Accountant, and authorities where legally required	Transaction records	Lithuania

We do not sell personal data. We do not share it with advertisers, data brokers or social platforms. We have no advertising relationships at all.

5. Transfers outside the EEA

Fulfilling your order requires sending your name and delivery address to our fulfilment partner in China, and to the carrier. China has no EU adequacy decision, so this transfer is made under Article 49(1)(b) GDPR — it is necessary for the performance of the contract you entered with us — and is supported by standard contractual clauses with the partner. Only the data needed to address and post the parcel is sent: your name, address, phone where the carrier requires it, and the items. Your email address, payment information and order history are not sent.

If you are not willing for your address to be transferred for this purpose, we cannot fulfil an order, because there is no other way to get the parcel to you. Please do not order.

6. Your rights

Under the GDPR you may:

Access the personal data we hold about you, and get a copy.
Rectify anything inaccurate — an address typo, for example.
Erase your data, where we are not required to keep it. Accounting records must be kept for 10 years, so an order record cannot be deleted on request within that period; everything outside it can.
Restrict or object to processing based on our legitimate interests.
Port your data to another controller in a machine-readable format.
Withdraw consent at any time where consent is the basis, without affecting what was done before.
Complain to a supervisory authority — see section 1.

Email hello@onyxbunny.com. We respond within one month, and we will tell you if we need the two-month extension the GDPR allows for complex requests. There is no charge. We may ask you to confirm the email address the order was placed with, so we do not disclose someone's purchase history to the wrong person.

There is no automated decision-making and no profiling on this site.

7. Security

The site is served over HTTPS only, with HSTS, a strict content security policy that permits no third-party scripts except Meta's pixel script (which runs only with your consent), clickjacking protection, a same-origin opener policy, restrictive browser permissions and strict referrer handling. Order records are stored on Cloudflare infrastructure, access is limited to the owner, and API credentials are held as platform secrets and never in the codebase.

If a breach occurs that is likely to risk your rights and freedoms, we will notify the supervisory authority within 72 hours and tell you directly without undue delay.

8. Children

This site is for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has given us personal data, email us and we will delete it.

9. Changes to this policy

If we change this policy we update the version and date at the top. If a change materially affects how we use data you have already given us, we will email you before it takes effect.