Privacy Policy

1. Who is responsible

Intergalactic Travel Adventures UG (haftungsbeschränkt)
Parkallee 117
28209 Bremen, Germany
Represented by managing director Kilian Kunst

Email: team@ageofchains.com
Telephone: +49 170 7906029

We are the controller for the processing described in this notice, except where another provider processes information for its own purposes as explained below. Please use these contact details for privacy enquiries and requests.

2. Website and security

Our website and some of its media are hosted using Bluehost, part of Newfold Digital. Loading pages and media makes technical connection information available to the hosting infrastructure. This includes your IP address, requested resources, date and time, browser and operating-system information, referring page where transmitted, and technical response or error information.

We use this information to deliver the website, maintain its availability, investigate faults and protect it against abuse. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in operating a functioning and secure website. Technical records needed to investigate a particular incident may be retained while that incident and related claims are addressed; retention otherwise follows the purpose-specific criteria in section 11.

Bluehost and its service providers can process data outside the European Economic Area, including in the United States. The Newfold data processing terms incorporate EU standard contractual clauses for relevant transfers. Further information is available in Newfold’s privacy notice.

3. Contact and email

When you send a message or use our contact form, we process the information you provide, including your name, email address, subject, message and any attachments. Technical information associated with a form submission or email may also be processed to deliver the message and prevent misuse.

For requests concerning an existing or proposed purchase, the legal basis is Article 6(1)(b) GDPR. Other correspondence is handled under Article 6(1)(f) GDPR, based on our legitimate interest in responding to enquiries and managing project communications. Please provide only information relevant to your request.

We use Google Workspace for email, including messages sent by the website. Google processes message contents, addresses, attachments and associated technical information to provide the service. Processing can involve Google affiliates and service providers outside the EEA, including in the United States. Google’s data processing terms describe processing locations, subprocessors and the applicable transfer arrangements, including European transfer safeguards.

4. Orders and delivery

We use WooCommerce to manage the shop. Depending on your purchase, we process:

• Your name, contact details, billing and delivery addresses.
• Items ordered, prices, order status, payment references and correspondence.
• Delivery, return and refund information.
• A public wallet address and transaction identifiers where needed for digital delivery.
• Access codes and their redemption status where a product requires an access code.

This processing is necessary to take steps you request before a purchase and to perform the purchase contract under Article 6(1)(b) GDPR. Information required for an order is identified in the relevant form. Without the necessary details, we cannot fulfil the purchase. Tax and accounting records are processed under Article 6(1)(c) GDPR. Processing necessary to establish, exercise or defend legal claims is based on Article 6(1)(f) GDPR and our interest in protecting our rights.

Guest checkout is available. Where records of an existing customer account are held, we process account and order information to administer that relationship and meet applicable retention requirements. A purchase does not itself subscribe you to our newsletter.

Purchase limits and review of suspected circumvention

For offers with a per-buyer limit, we compare quantities in current and earlier orders using the billing email address and, where available, the existing customer account. We record the relevant quantities, open-order reservations and documented cancellation, replacement or correction adjustments. The numerical check can prevent a further checkout when the disclosed allowance is exhausted. No new customer account or identity document is routinely required for this check.

Processing necessary to handle orders within the agreed purchase limits is based on Article 6(1)(b) GDPR. Reviewing concrete indications of deliberate circumvention is based on Article 6(1)(f) GDPR and our legitimate interest in fair access to limited editions and preventing abuse. We do not use shared IP addresses, postal addresses or wallet addresses alone to identify purchasers as the same person, and suspected circumvention does not trigger an automated cancellation.

You can ask a person to review a blocked order, explain your circumstances and challenge an incorrect match or count by contacting team@ageofchains.com. Necessary allowance records are used only while the applicable restriction remains relevant to an offer and for resolving related claims; records retained solely for statutory duties are restricted to that purpose. The retention criteria in section 11 and the right to object in section 12 apply.

Physical delivery through DHL

We hand physical shipments to DHL. The relevant postal operator, such as DHL Paket GmbH or Deutsche Post AG depending on the service, receives the recipient’s name, delivery address and shipment details needed for transport. Contact information is provided where necessary for the requested delivery service or on the basis of an applicable consent.

International deliveries can involve postal operators, delivery partners and customs authorities in transit and destination countries. Shipment and customs information can include the recipient, contents and declared value. Sharing necessary delivery information is based on Article 6(1)(b) GDPR; legally required customs disclosures are based on Article 6(1)(c) GDPR. The carrier also processes data under its own legal responsibilities. Its recipients and international processing are described in the DHL and Deutsche Post privacy notice.

5. Payments

The payment methods available for a particular order are shown at checkout. Our shop uses Stripe and PayPal and offers payment by invoice. We process the information needed to initiate, confirm and reconcile payments under Article 6(1)(b) GDPR, and statutory payment records under Article 6(1)(c) GDPR.

When payment functions load or you use them, the relevant provider can receive technical device and connection data. When you proceed with payment, it also processes payment, billing, contact and transaction information. Authentication and fraud-prevention checks help protect payments and the shop; our processing necessary for that protection is based on Article 6(1)(f) GDPR. Consent is required for any additional device access or processing that is not covered by an applicable exception or other legal basis.

Stripe and PayPal act partly as processors and partly as independent controllers, including for their own legal, security and fraud-prevention purposes. Their notices explain the relevant entities, international transfers, retention and any automated risk assessments: Stripe Privacy Policy and PayPal Privacy Statement. A provider’s assessment may affect whether a payment is accepted. Contact us if a declined payment prevents your purchase; questions about a provider’s own assessment can also be directed to that provider.

For invoice payments, we use the transaction details supplied through the banking system to match your payment to the order.

6. Newsletter

If you subscribe, we use your email address to send card-release announcements, new artwork and project updates. The legal basis is your consent under Article 6(1)(a) GDPR. Subscription is voluntary and is not required for a purchase.

New subscriptions through our website’s Mailchimp form use double opt-in: you receive an email asking you to confirm your subscription. Subscription and confirmation records, including timestamps and technical information supplied by the service, help document consent and protect against misuse. The legal basis for keeping necessary consent evidence is Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR; necessary records for defending claims may also be retained under Article 6(1)(f) GDPR.

You can withdraw consent at any time through the unsubscribe link in a newsletter or by contacting team@ageofchains.com. Withdrawal does not affect the lawfulness of processing before withdrawal. Unsubscribing stops newsletter delivery; limited consent and suppression records may remain where needed to document the request and prevent further sends.

Mailchimp and email measurement

Our newsletter service is Mailchimp, operated by The Rocket Science Group LLC in the United States. It processes subscriber details, subscription status, consent records and delivery information. Its data processing terms provide for the EU–US Data Privacy Framework for covered transfers and EU standard contractual clauses where required. Mailchimp’s own processing is described in the Intuit Global Privacy Statement.

Open tracking uses an embedded image to record that an email was loaded; click tracking uses individual links to record interactions. Such information can be associated with a subscriber and include the time and technical connection information. Earlier newsletters used open and click measurement. This notice does not retrospectively create consent to that processing.

For new newsletters, our policy is to use individual open or click measurement only with separate, informed consent. Newsletter subscription alone is not consent to that measurement. Without such consent, campaign measurement must remain disabled. You can withdraw measurement consent or object to related direct-marketing profiling using the contact details above. Mailchimp can still process delivery, security and anti-abuse information for its own purposes; disabling campaign reporting does not necessarily disable its security-related link redirects.

7. Cookies and measurement

Cookies and similar technologies store information on your device or access information already stored there. The shop uses technical functions to remember a basket, maintain a requested session and support checkout. Authentication or access-protection functions can also use necessary storage. Your browser allows you to remove stored information or restrict its use; blocking necessary storage can prevent parts of the shop from working.

Device access strictly necessary to provide a service you expressly request is governed by § 25(2) TDDDG. Personal data used to fulfil your request is processed under Article 6(1)(b) GDPR; processing needed to maintain security and functionality is based on Article 6(1)(f) GDPR. These exceptions do not provide blanket permission for advertising or optional analytics.

WooCommerce’s optional order-attribution tracking is currently disabled. Google Analytics is not part of the measurement setup described in this notice. If optional analytics or marketing technologies are introduced, the specific service, purposes and retention must be disclosed and any required prior consent obtained before activation. Continued browsing is not consent. Ordinary order records and store reports used to administer sales are distinct from optional tracking of browsing behaviour.

Elementor’s Google Fonts are configured to be served locally through our hosting infrastructure.

8. Digital collectibles and IPFS

Our digital collectibles use Counterparty on Bitcoin. Issuance and transfers can create publicly accessible records of addresses, asset identifiers, quantities and transaction identifiers. Public addresses can become associated with an individual through order information or other sources; they are not necessarily anonymous.

Where blockchain processing is necessary to deliver a digital collectible you purchase, our processing for that delivery is based on Article 6(1)(b) GDPR. Public network participants can be located worldwide. Confirmed transaction records are replicated independently of us, and we cannot erase or change those network records. This does not remove your rights concerning personal data in systems we control.

Artwork and token metadata can be stored or linked through IPFS. Opening an IPFS resource through a gateway discloses connection information, such as your IP address and the requested resource, to the gateway. Direct use of an IPFS client has different network-visibility implications. A public content identifier is not a confidentiality safeguard. Further information is available in the IPFS privacy documentation.

Please do not send private keys or recovery phrases in a support request, or place names, contact information or delivery details in public token metadata.

9. External websites

Links to social networks, community services, explorers and other websites take you to services operated by others. When you open them, those providers receive connection information and process data under their own notices. A link is distinct from an embedded service that loads automatically. Any additional embedded service requiring consent must remain inactive until that consent has been obtained.

10. Recipients and international processing

Data is available to personnel and service providers who need it for the purposes described above. Recipients can include hosting and IT support, email and newsletter providers, payment providers, delivery and customs partners, and professional advisers where needed for accounting or legal matters. Authorities receive information where a legal obligation requires disclosure.

Processing is not restricted to the EEA. The hosting, email, newsletter and payment services described above can involve processing in the United States and other countries where their affiliates and service providers operate. International delivery involves the relevant transit and destination countries. Public blockchain records are distributed globally.

The provider terms linked in the relevant sections explain their transfer arrangements. These include adequacy decisions for covered recipients and transfers, and EU standard contractual clauses for transfers requiring appropriate safeguards. DHL describes group rules, standard contractual clauses and applicable statutory exceptions for international shipments. These mechanisms are specific to the recipient and transfer; they do not mean that every country has the same data-protection rules as the EEA. You can contact us for further information or a copy of applicable safeguards, subject to necessary protection of confidential information.

11. Retention

Retention is determined by the purpose and type of information, applicable statutory duties and unresolved claims. The relevant criteria are:

• Orders and business records: for fulfilment, returns, payment reconciliation and applicable retention duties. Under German commercial law, accounting vouchers generally require eight years, commercial correspondence six years, and books and annual financial statements ten years. The periods generally start at the end of the relevant calendar year; other duties or ongoing proceedings can require longer retention.
• Enquiries: for answering and following up the request; correspondence relating to a transaction or claim is subject to the corresponding business-record or claims requirements.
• Technical and security records: for operating and troubleshooting the service and investigating specific incidents. Data needed for an unresolved security event or claim is distinguished from routine connection records.
• Newsletter data: for the subscription and until withdrawal for sending purposes. Necessary consent evidence and a limited suppression record may remain for accountability, legal claims and preventing renewed contact.
• Backup copies: according to the applicable backup and recovery cycle, rather than as an additional source for marketing use. A request concerning data in backups is assessed together with recovery needs and any legal retention requirements.
• Public blockchain records: outside our power to delete, as explained in section 8.

These criteria do not justify keeping every record for the longest statutory period. Data no longer needed for a lawful purpose is subject to deletion or anonymisation; information retained solely because of a legal duty or claim must be restricted to that purpose. Independent providers may have their own retention obligations, as described in their notices.

12. Your rights

Subject to the applicable legal conditions, you have the right to:

• Obtain access to your personal data and information about its processing.
• Have inaccurate data corrected and incomplete data completed.
• Request erasure or restriction of processing.
• Receive data in a portable format where the statutory conditions apply.
• Withdraw consent at any time, with effect for the future.
• Lodge a complaint with a supervisory authority.

Contact us at team@ageofchains.com. Where reasonably necessary, we may request proportionate information to verify your identity.

Your right to object: You may object, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR. You may object at any time to processing for direct marketing, including profiling connected with that marketing.

You may complain to the supervisory authority in the country of your habitual residence, workplace or the alleged infringement. Our regional authority is Der Landesbeauftragte für Datenschutz und Informationsfreiheit der Freien Hansestadt Bremen. You do not have to contact us before making a complaint.

13. Changes to this notice

We update this notice when relevant processing or legal requirements change. The date above identifies this version. Publishing an updated notice does not replace consent or any other legal requirement that applies to new processing.