Last updated: 1 September 2026
Controller and contact
The controller for RPCrate is KOIL CONTENT CREATION PTY LTD, Australian Company Number 634054309, registered in Docklands VIC 3008, Australia. Our operating address is Welfenstraße 1, 76137 Karlsruhe, Germany. Privacy and customer requests can be sent to [email protected]. Further company information is available in our imprint.
Data we process
Depending on how you use RPCrate, we process account and contact details, billing and order details, purchased products and download entitlements, support messages, review or comment content, consent choices, currency and language preferences, and technical data such as IP address, browser information, request time, security events and diagnostic logs. We do not receive or store full payment-card numbers.
Why we process data
- Orders, accounts and downloads: to conclude and perform the purchase contract, provide account access, deliver files, maintain download entitlements and answer product support requests.
- Payments and fraud prevention: to initiate and confirm payments, prevent abuse, investigate failed or disputed transactions and protect customers and the shop.
- Legal records: to keep invoices, transaction records and evidence required by tax, accounting, consumer-protection and legal-claims obligations.
- Service security and reliability: to protect the site, rate-limit abuse, diagnose failures, maintain backups and restore service after an incident.
- Analytics: to understand aggregate storefront use and improve the site. Consent-requiring Google Analytics measurement remains disabled until the visitor consents.
- Communications: to send order, account, download and support messages. We do not use transactional contact details for unrelated marketing without a valid legal basis.
The corresponding legal bases are performance of a contract, compliance with legal obligations, our legitimate interests in operating and protecting the service, and consent where the law requires it. Consent can be withdrawn for future processing at any time.
Recipients and services
Personal data is disclosed only where needed for the purposes above. RPCrate uses WooCommerce and WordPress for accounts, orders and downloads; Stripe for payment processing and payment-risk checks; Cloudflare for DNS, content delivery, security filtering and off-site storage; Amazon Simple Email Service for transactional email; self-hosted Plausible for aggregate website analytics; and Google Analytics only after the required consent. Embedded media providers such as YouTube may receive technical request data when their content is loaded. These providers process data under their own terms and, where applicable, data-processing agreements.
Cookies and local storage
Strictly necessary cookies and browser storage keep the cart, checkout, account session, security state, language, currency and consent choice working. Optional analytics storage is used only after the applicable consent. Rejecting optional analytics does not prevent a purchase.
International transfers
The operator and some service providers are located outside the European Economic Area. Where European data-protection law applies, transfers are based on an applicable adequacy decision, standard contractual clauses or another legally recognised safeguard. You may contact us for information about the safeguard relevant to a particular transfer.
Retention
Order, invoice and payment evidence is retained for the period required by applicable tax, accounting and consumer law. Account and download-entitlement data is retained while the account or continuing purchase access is needed, subject to mandatory records. Support and dispute records are kept while the issue is active and for the period needed to establish, exercise or defend legal claims. Security logs and backups are retained only for their operational security and recovery cycles. Data is deleted or anonymised when its purpose and any mandatory retention period end.
Your rights
Where the GDPR or equivalent law applies, you may request access, correction, deletion, restriction, portability or objection, and you may withdraw consent for future processing. You also have the right to complain to a competent data-protection authority. For the German operating location, this includes the Baden-Württemberg data-protection authority. Send a request to [email protected]; we may need to verify your identity before disclosing account or order data.
Automated risk signals
Payment and security providers may use automated signals to detect fraud or abuse. If a legitimate order or account action is blocked, contact support so that the case can be reviewed.
Changes to this policy
We update this notice when the storefront, providers or legal requirements materially change. The current version and update date are published on this page.