What we know about you, and what we do not.

What you buy here says something private about you, so the honest thing is to collect as little as possible and say exactly what happens to it. We run no analytics, no advertising pixels, no profiling and no cross-site tracking of any kind. This policy explains the rest.

Version 2 · last updated 20 September 2026

1. Who is responsible

The data controller for personal data collected through onyxbunny.com is:

Controller: Vakaris Pupkus, trading as Onyx Bunny
Registration number: Not issued yet. It will be published here as soon as the registration is complete.
Registered address: Bajorų 1, Verdulių kaimas, LT-77155 Šiauliai, Lithuania
Privacy contact: [email protected]

We are not required to appoint a Data Protection Officer, and we have not. Privacy requests go to the address above and are handled by the owner.

Our lead supervisory authority is the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt). You may also complain to the authority in your own country.

2. What we collect, why, and on what legal basis

Data	Why	Legal basis (GDPR Art. 6)	Kept for
Name, delivery address, email, phone if you give it	To take, price, fulfil and deliver your order, and to contact you about it	6(1)(b) — performance of a contract	Duration of the order, then retained only as accounting records require
Order contents, totals, VAT, country	To fulfil the order and to meet tax and accounting obligations	6(1)(b) and 6(1)(c) — legal obligation	10 years from the end of the financial year, as Lithuanian accounting law requires
Correspondence you send us	To answer you, and to keep a record of complaints and returns	6(1)(b), and 6(1)(f) — our legitimate interest in defending claims	3 years from the last message, or longer if it relates to a live dispute
Confirmation that you are 18+, accepted the terms, and were shown the hygiene-seal notice	Evidence of pre-contract information, required by consumer law	6(1)(c)	With the order record
Payment status and processor reference	To reconcile payments and process refunds	6(1)(b) and 6(1)(c)	With the order record
Newsletter, if you sign up: your email, language, where you signed up, and when you signed up and confirmed	To send occasional emails about new products, guides and the couples game, only after you confirm by clicking the link we email you	6(1)(a) — consent; withdraw any time with the unsubscribe link in every email	Until you unsubscribe; unconfirmed sign-ups are deleted after 30 days
Welcome code: the code, its value, expiry and the order it was used on, plus a one-way code made from your email so each address gets only one welcome code	To honour the €10 welcome code once per person	6(1)(b) — the offer you accepted	Code record: 2 years; the one-way email code: kept so the offer is not claimed twice
Order reward code: the code, its value, expiry, the order that earned it and the order it was used on	To give the €15 credit for orders over €100 and let it be used once	6(1)(b) — the offer you accepted	Code record: 2 years
Game pass: your email, the pass you bought, its code, and a random device number for each phone the code is used on (no name, no address)	To sell and deliver the pass, send the receipt, and limit one code to two devices	6(1)(b) — performance of a contract; 6(1)(c) for accounting records	Code and device numbers until the pass ends plus 1 year; payment records as accounting law requires
A product review, if you write one: star rating, text, the name you choose to show (or “Anonymous”), and any photos	To publish it on the product page after we have read it. Photos are re-encoded in your browser before upload, which removes hidden data such as location	6(1)(a) — consent, given when you submit; ask us and we delete it	Until you ask us to remove it, or we remove the product
Order number and email typed into the review form (optional)	Only to check once that the order was paid and included the product, for the verified-purchase badge. Not stored; only the order number is kept with a verified review, visible to the owner	6(1)(a)	Not kept (order number: with the review)
A one-way code made from your IP address when you send a review	To stop review spam (at most 5 reviews per connection per day)	6(1)(f) — legitimate interest in preventing abuse	Deleted automatically after about 26 hours
Email address, if you ask for product or safety notices	To send them	6(1)(a) — consent, withdrawable at any time	Until you unsubscribe

We never collect card numbers, expiry dates or security codes. Card details are entered only on the payment provider's own hosted page. They never reach this site, are never logged, and we never see them.

We do not ask for, and do not want, any information about your health, sexuality or relationships. Your order contents are of course revealing, so we treat every order record as confidential, restrict access to the owner and the fulfilment partner, and never use it for anything except fulfilling and supporting that order.

3. What stays in your browser and never reaches us

Several things are stored in your own browser's local storage and are never transmitted to us:

Your 18+ confirmation.
Your basket contents, currency and language preference.
Whether you dismissed the storage notice, and your yes/no choice about anonymous measurement.
Recently viewed products.
If you create an optional account: your saved address, wishlist and order history, stored encrypted in your browser.

These are strictly necessary for the functions you asked for, so under Article 5(3) of the ePrivacy Directive they do not require consent. The only optional storage is anonymous measurement, which runs only if you press "Help improve the shop" (see below and the cookie notice). By default we use no cookies for advertising, profiling or fingerprinting and no third-party scripts run. The one exception is the Meta advertising pixel, which loads only if you press "Accept all, incl. ads": it then shares your visit and shopping steps (not your name, email or address) with Meta Platforms Ireland Ltd, on the basis of your consent under Art. 6(1)(a) GDPR, and you can switch it off at any time on the cookie notice.

Account security. Passwords are never stored anywhere. Sign-in verification uses a PBKDF2-SHA-256 hash with 210,000 iterations and a unique random salt. A separate password-derived key encrypts your local account data with AES-GCM using a fresh initialisation vector for every write. The decryption key lives in session storage, so a copy of your local storage alone does not reveal the contents. Signing out removes that key. We cannot recover your password, and clearing your browser data deletes the account record permanently.

4. Who else sees your data

Only the parties below, only the data each one needs, and only for the purpose stated. None of them may use it for their own purposes.

Recipient	What they receive	Where
Cloudflare — website and order storage	Order records, site request logs, anonymous daily totals of which page version was shown and whether its main button was used (no identifier, nothing linked to a person), and — only if you consented — anonymous measurement events (random code, pages, versions shown, main-button clicks, seconds on page, scroll depth), stored in the EU and deleted after 90 days. Legal basis: your consent, Art. 6(1)(a) GDPR, which you can withdraw at any time on the cookie page.	EU/global network. Data processing agreement and standard contractual clauses in place.
Resend — transactional email	Your email address, name and order details (or game pass and code), to send the confirmation, game code and tracking	United States (Resend, Inc.). Resend’s data processing agreement applies; transfers rely on the EU–US Data Privacy Framework and the EU Standard Contractual Clauses.
Fulfilment partner	Your name, delivery address and the items to pack	China. See transfers below. We sign a written data processing agreement with the fulfilment partner before it handles any order.
Carrier	Your name, delivery address, phone if required for delivery, and the customs declaration	Destination country
Payment processor	Your payment details, which you enter directly with them; we receive only a status and a reference	Stripe Payments Europe, Ltd. (Ireland), with onward transfers within the Stripe group. Card details are entered on Stripe's own hosted page and never reach this site.
Accountant, and authorities where legally required	Transaction records	Lithuania

We do not sell personal data. We do not share it with advertisers, data brokers or social platforms. We have no advertising relationships at all.

5. Transfers outside the EEA

Fulfilling your order requires sending your name and delivery address to our fulfilment partner in China, and to the carrier. China has no EU adequacy decision, so this transfer is made under Article 49(1)(b) GDPR — it is necessary for the performance of the contract you entered with us — and is supported by standard contractual clauses with the partner. Only the data needed to address and post the parcel is sent: your name, address, phone where the carrier requires it, and the items. Your email address, payment information and order history are not sent.

If you are not willing for your address to be transferred for this purpose, we cannot fulfil an order, because there is no other way to get the parcel to you. Please do not order.

6. Your rights

Under the GDPR you may:

Access the personal data we hold about you, and get a copy.
Rectify anything inaccurate — an address typo, for example.
Erase your data, where we are not required to keep it. Accounting records must be kept for 10 years, so an order record cannot be deleted on request within that period; everything outside it can.
Restrict or object to processing based on our legitimate interests.
Port your data to another controller in a machine-readable format.
Withdraw consent at any time where consent is the basis, without affecting what was done before.
Complain to a supervisory authority — see section 1.

Email [email protected]. We respond within one month, and we will tell you if we need the two-month extension the GDPR allows for complex requests. There is no charge. We may ask you to confirm the email address the order was placed with, so we do not disclose someone's purchase history to the wrong person.

There is no automated decision-making and no profiling on this site.

7. Security

The site is served over HTTPS only, with HSTS, a strict content security policy that permits no third-party scripts except Meta's pixel script (which runs only with your consent), clickjacking protection, a same-origin opener policy, restrictive browser permissions and strict referrer handling. Order records are stored on Cloudflare infrastructure, access is limited to the owner, and API credentials are held as platform secrets and never in the codebase.

If a breach occurs that is likely to risk your rights and freedoms, we will notify the supervisory authority within 72 hours and tell you directly without undue delay.

8. Children

This site is for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has given us personal data, email us and we will delete it.

9. Changes to this policy

If we change this policy we update the version and date at the top. If a change materially affects how we use data you have already given us, we will email you before it takes effect.