Privacy Policy

This Policy applies to all personal data processed by Gamix in connection with the use of the gamixshop.com platform — from account registration through order fulfillment and subsequent support.

Data processing is carried out in accordance with the personal data legislation of the Republic of Azerbaijan.

The controller of personal data is the individual entrepreneur (fərdi sahibkar) operating the Gamix platform. Operator details: Tax ID (VÖEN) 1204069632, registered address: Bakı şəhəri, Xəzər rayonu.

For questions regarding the processing of personal data, contact admin@gamixshop.com.

Data you provide directly: name, email, phone number, password (stored as a hash), delivery address — for orders that include physical products.

Order and activity data: purchase history, cart and wishlist contents, order status and contents, interaction with the loyalty program (XP, level, savings goals, coupons, referrals), reviews.

Technical data: IP address, user-agent data (browser/device), session and authorization token information, cookies and similar technologies — see the "Cookies" section for details.

Payment data entered at checkout is processed directly by the payment provider — see "Payment data" below.

For Steam top-ups we process the Steam account login, the account region, the amount and the top-up status, as well as the payment data needed to confirm payment and issue refunds. For Steam game purchases we process the Steam nickname, links to the selected games, a contact phone number and the request status.

This data is used to perform the order, record operations, refund payments in case of failures, prevent fraud and for tax accounting. The Steam login is passed to the partners who carry out the top-up, and payment data to the payment provider, to the extent necessary to perform the order.

Gamix does not ask for or store your Steam account password or Steam Guard codes. Never give them to anyone, including Gamix staff.

Data is collected during account registration, order placement, when filling out forms on the platform (including support forms), and automatically while using the platform, through cookies and technical means.

To protect against automated (bot) traffic, forms include hidden technical fields (honeypots); data entered into such fields is used solely to detect automated requests and is not treated as a user's ordinary personal data.

Data is processed for the following purposes: entering into and performing the sales contract (placing and delivering orders, providing access to digital keys); enabling account functionality and authorization; preventing fraud and securing the platform; complying with legal requirements (including tax record-keeping); communicating about orders and support; and, with your consent, sending marketing communications.

Processing of technical data for security purposes (including anti-bot mechanisms) is based on Gamix's legitimate interest in protecting the platform, its users, and preventing fraud.

Gamix uses cookies and similar technologies to support account functionality (sessions, authorization tokens), retain cart contents, and — where applicable — analyze platform usage.

You can manage cookies through your browser settings; disabling certain cookies may limit the platform's functionality (for example, requiring you to log in again).

With your consent (the "Accept / Decline" banner on your first visit) we use the Amplitude web analytics service, including recording of on-site actions (clicks, scrolling, page-to-page navigation), to understand how the platform is used and to improve it. Analytics is not loaded until you accept. You can withdraw consent at any time via the "Cookie settings" link at the bottom of the page. Data is sent to Amplitude, whose servers may be located outside Azerbaijan. Essential cookies (account login, language choice) work without consent. An anonymous visitor identifier (the gamix_vid cookie) is also used for internal traffic statistics. The full list of cookies and their retention periods is set out in the Cookie Policy.

Bank card details and other payment credentials are entered directly with the payment provider and are not stored on Gamix's servers. Gamix receives from the payment provider only the information necessary to confirm payment status (e.g., transaction status and the card's last digits).

Payment data is processed in accordance with the security standards applied by the payment provider.

The platform's media files (product images, files uploaded by users — e.g. review images or avatars) are hosted on Cloudflare R2 object storage infrastructure, used by Gamix as a technical hosting provider.

This storage is used purely as hosting infrastructure for files and does not involve independent use of your data by a third party for its own purposes.

To fulfill orders and operate the platform, Gamix may share the minimum necessary data with the following categories of recipients: the game key supplier — to the extent necessary to fulfill a digital order (B2B interaction); the delivery service (including CDEK and Wolt Drive) — contact details and delivery address for physical orders; the payment provider — to process payment; the transactional email provider — to send order, key delivery, and account notification emails; and, where applicable, analytics and anti-fraud service providers.

Gamix does not sell personal data to third parties and does not share it for purposes unrelated to order fulfillment, platform security, or legal requirements, except where you have given separate consent.

We may disclose data to state authorities, courts and law-enforcement bodies on their lawful request; to organisations that help detect and prevent fraud and resolve security problems, to the extent necessary; and to a successor on a reorganisation or sale of the Gamix business, who must comply with this Policy.

Part of Gamix's server infrastructure (including hosting for the frontend and backend applications) may be located outside the Republic of Azerbaijan. As a result, your data may be processed and stored on servers located in other countries.

Gamix takes reasonable measures to ensure data protection during such transfers in accordance with applicable law.

Account data is retained for the period of active use and for an additional period after account deletion necessary to comply with legal requirements (including tax record-keeping for orders) and to resolve potential disputes.

Technical logs containing IP address and user-agent data are retained for a limited period necessary for security purposes.

The IP address is used to limit request rates (protection against password guessing and mass sign-ups) and to prevent fraud, for example by limiting the number of accounts registered from one address. The Gamix database does not store the IP address in plain form: only a hashed value is kept, from which the address itself cannot be read directly (at registration and in the record of viewing a game key). The IP address may also be temporarily recorded in the technical logs of the hosting infrastructure.

Data on orders, payments and Steam top-ups is kept for the periods set by the tax and other applicable legislation of the Republic of Azerbaijan.

Gamix applies technical and organizational data protection measures, including password hashing, token-based authorization (JWT) with separate refresh tokens, role-based access restrictions for staff, and mechanisms to protect against automated attacks.

Despite the measures taken, no system can guarantee absolute protection against unauthorized access; in the event of an incident affecting your data, Gamix will take reasonable steps to address it and will notify you where required by law.

With respect to your personal data, you have the right to: request access to the data Gamix processes about you; request correction of inaccurate data; request deletion of your account and related data (subject to retention periods required by law); and withdraw your consent to receive marketing communications at any time.

To exercise these rights, use the relevant functions in the "Settings" section of your account or contact support at admin@gamixshop.com.

We respond to requests to exercise your rights within a reasonable time, as a rule within 30 days. Withdrawing consent does not affect the lawfulness of processing before withdrawal and does not prevent us from keeping data we are required by law to keep. If you believe your rights have been violated, you may apply to the competent state authority of the Republic of Azerbaijan or to a court.

Transactional emails (order confirmation, key delivery, security notifications) are sent regardless of marketing consent, as they are necessary to fulfill your order.

Emails about promotions, personalized offers, and platform news are sent only with your consent and can be turned off at any time via account settings or the unsubscribe link in the email.

The platform is not intended for individuals under the age of 18, except where used with the consent and under the supervision of a parent or legal guardian. Gamix does not knowingly collect personal data from children below that age; if you become aware of such data on the platform, please notify us at admin@gamixshop.com so it can be removed.

Gamix may update this Policy from time to time. The current version is always available on the platform, showing the date of its last update; we will notify you of material changes by email or via your account.

This Policy is governed by and construed in accordance with the legislation of the Republic of Azerbaijan. Disputes related to the processing of personal data shall be resolved in the courts of the Republic of Azerbaijan, unless applicable law provides otherwise.

For any questions related to this Policy and the processing of your data, please contact: admin@gamixshop.com.