Privacy Policy

RR Store is an e-commerce platform specialised in the intermediation and sale of digital products and services for video games, such as virtual currency top-ups, gift cards, vouchers, redemption codes and internal platform credits (RR Coins).

This Privacy Policy explains, transparently, which personal data we process, why we process it, with whom we share it, how long we keep it and what your rights as a data subject are.

This Policy applies to everyone who accesses, browses, registers, places orders, takes part in promotions or interacts with RR Store's support channels, including customers, visitors, partners, affiliates and resellers.

This Policy complements the platform's Terms of Use, Refund Policy and Code of Conduct. In the event of a conflict between these documents solely regarding the processing of personal data, this Policy shall prevail.

By using the platform, the User declares that they have read, understood and are aware of the conditions described in this document. If you do not agree with any provision, you must stop using the services and may request the deletion of your account.

For the correct interpretation of this Policy, the terms below have the following meaning, in both singular and plural:

• Platform: the website https://rrstore.pro, its subdomains, pages, logged-in areas, applications and official support channels operated by RR Store.
• User or Data Subject: the natural person to whom the processed personal data refers, including visitors, registered customers, partners, affiliates and resellers.
• Controller: RR Store, the legal entity responsible for decisions regarding the processing of personal data carried out on the platform (art. 5, VI, of the LGPD).
• Processor: a third party that processes personal data on behalf of and under the instructions of the Controller, such as hosting, payment and e-mail providers (art. 5, VII, of the LGPD).
• Data Protection Officer (DPO): the person appointed by the Controller to act as the communication channel between RR Store, data subjects and the National Data Protection Authority (art. 5, VIII, of the LGPD).
• Personal Data: any information relating to an identified or identifiable natural person, including digital identifiers such as IP address, game account identifier and cryptocurrency wallet address when they can be associated with a person.
• Sensitive Personal Data: data on racial or ethnic origin, religious belief, political opinion, union membership or membership of a religious, philosophical or political organisation, data concerning health or sex life, and genetic or biometric data (art. 5, II, of the LGPD). RR Store does not collect or request sensitive data.
• Processing: any operation carried out with personal data, such as collection, production, receipt, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, deletion, evaluation, modification, communication, transfer, dissemination or extraction.
• Anonymisation: the process by which data loses the possibility of association, whether direct or indirect, with an individual, and therefore ceases to be personal data.
• Account: the User's personal and non-transferable registration on the platform, protected by access credentials and, optionally, by two-factor authentication (2FA).
• Top-up: the service of crediting coins, diamonds, passes, subscriptions or virtual items directly to a game account or third-party platform, according to the product purchased.
• UID (Unique Player Identifier): a numeric or alphanumeric code that identifies the User's account within a game, usually accompanied by the server, region or character name. In this method, delivery is made without any access to the game account.
• ID-PASS: a delivery method used only for games that do not offer top-up by UID or Weblink, in which the User voluntarily chooses to provide the game account login and password so that the top-up can be carried out manually. See Section 7 of this Policy.
• Weblink: a method in which the top-up is completed by the User themselves, through an official link, code or redemption page of the game, without RR Store accessing the account.
• Gift Card, Voucher or Redemption Code: a digital product delivered to the User as an alphanumeric code, to be redeemed by them on the corresponding official platform.
• Cashback: a percentage of the value of a completed order that is returned to the User as credit in the platform's internal wallet. The percentage is defined per product or per game and, where applicable, by promotional coupon.
• RR Coins and Internal Wallet: a credit balance held in the User's account, usable as a discount on future purchases within the platform. RR Coins are not sold or traded by RR Store: they are obtained exclusively as cashback, bonuses, promotional prizes or order refunds. They have no legal tender status and do not constitute currency, a financial asset, a security, a payment arrangement or a crypto-asset, and cannot be converted into cash or transferred between accounts.
• Loyalty and Referral Programmes: relationship mechanisms that record accumulated points, benefit tiers and the link between the referrer and the referred user, in order to grant advantages and commissions.
• Game Account: the account held by the User with the game's publisher, developer or distribution platform, governed by that company's terms and privacy policy, and not by RR Store.
• Publisher or Game Platform: the company responsible for operating, distributing or publishing the game or digital service subject to the top-up. RR Store is not affiliated with, a representative of, sponsored by or endorsed by these companies.
• Authorised Distribution Partner: a supplier or distributor with which RR Store maintains a commercial relationship in order to enable the technical execution of certain top-ups and the issuance of digital codes.
• Payment Provider: the institution or third-party company responsible for processing financial transactions, including PIX and cryptocurrency solutions.
• Cookies and Similar Technologies: small files and identifiers stored on the User's device — including cookies as such and the browser's local storage — that allow sessions to be maintained, preferences to be remembered and security to be reinforced.
• LGPD: Law No. 13,709/2018 (Brazilian General Data Protection Law). CDC: Law No. 8,078/1990 (Consumer Protection Code). Internet Framework: Law No. 12,965/2014. ANPD: the Brazilian National Data Protection Authority.

RR Store is the controller of the personal data processed through its platform, pursuant to the LGPD:

• Company name: RR STORE SERVICOS DIGITAIS LTDA
• Company registration (CNPJ): 44.015.912/0001-02
• Official website: https://rrstore.pro
• Nature of operations: an exclusively digital company, with no physical premises open to the public, providing support through online channels.
• Contact e-mail: rrstore@rrstore.pro
• Data Protection Officer (DPO): rrstore@rrstore.pro

In certain operations, RR Store acts as a processor of third-party data — for example, when transmitting to an Authorised Distribution Partner only the data strictly necessary to carry out a top-up ordered by the User.

Our principle is simple: the less data stored, the lower the risk for you and for us. We work with the minimum necessary and delete what is no longer needed. Accordingly, we expressly record that:

• We do not store sensitive payment data. The details required to complete the transaction are entered and processed directly in the payment provider's environment. We receive only the authorisation result and minimal reconciliation data.
• We have no access to your RR Store password. It is stored only as a salted cryptographic hash, a format that cannot be reversed or read by our team.
• We do not keep your game account credentials after delivery. In the ID-PASS method, the login, password, access method, character name and notes are automatically erased from the order as soon as it is completed, and the access information is removed from the corresponding chat.
• We do not keep the support chat history attached to an order. The chat is closed and deleted from the platform a few minutes after the service is completed.
• We do not collect sensitive personal data, customer identity documents, biometric data or precise geolocation.
• We do not use advertising trackers, social network pixels or third-party behavioural analytics tools. We do not build an advertising profile about you.
• We do not sell, rent or transfer personal data to third parties for commercial or marketing purposes.

What we do keep exists for three reasons, and only those: to fulfil the order you placed, to comply with legal obligations (mainly tax and record-keeping duties) and to protect the store, you and other customers against fraud, misuse of payment methods and unauthorised access.

Even in our security records we apply minimisation: in our audit log, the e-mail is written as a SHA-256 hash (irreversible) and the IP address is stored masked, without its final blocks.

We collect only the personal data that is necessary and adequate for the purposes stated in this Policy, observing the principles of necessity and data minimisation (art. 6 of the LGPD). The data actually collected varies according to how the platform is used:

• Registration data: name or username, e-mail address, password (stored exclusively as a cryptographic hash), profile picture (avatar) and, where provided by the User, a phone number. We also record the IP address and the date of registration.
• Third-party authentication data: if the User chooses to sign in with Discord, we receive from that platform the account identifier, username, profile image and associated e-mail, according to the permissions you grant at the time of authorisation.
• Account security data: the IP address of registration and of the last login, login records, browser and device identification, temporary e-mail verification and password reset tokens and, when enabled by the User, the two-factor authentication (2FA) configuration.
• Order data: order number, products and quantities purchased, amounts, currency, coupons and promotions applied, chosen payment method, payment status, fulfilment status, date and transaction history.
• Data required to carry out the top-up: player UID or identifier, server, region, platform and character name; where applicable, the additional data requested in the product form; and, exclusively in the ID-PASS method, the game account login and password voluntarily provided by the User, as detailed in Section 6.
• Payment data: transaction identifier, amount, currency, status and the information passed on by the payment provider for reconciliation, such as payer name, e-mail and tax number (in full or in part). RR Store does not collect or store sensitive payment credentials — that data goes directly to the payment provider. For cryptocurrency payments, we may record the wallet address, the network used and the transaction identifier (hash).
• Partner, affiliate and reseller data: full name or company name, tax number (stored in encrypted form), the data required to pay out commissions, and the record of contractual acceptance with date, time and IP address.
• Communication data: messages exchanged in the platform's support chat, e-mails, contacts via WhatsApp or Discord, receipts, screenshots and other files voluntarily sent by the User.
• Technical and browsing data: IP address, device type, operating system, browser, language, pages visited, access source, date and time, session identifiers and cookies.
• Wallet and cashback data: balance, statement of movements, amount and origin of each credit or debit, and the reference order.
• Relationship data: loyalty points and tier, accumulated purchase value, referral code, link to the referrer, participation in raffles and missions, and published reviews and comments.

We ask Users not to send our support team any documents, images or information that has not been expressly requested and that is not necessary for the service.

• Directly from the User: when creating an account, filling in order forms, applying coupons, taking part in promotions, publishing reviews or contacting support.
• Automatically: through cookies, server logs, session identifiers and security mechanisms triggered during browsing.
• From payment providers: payment confirmations, reconciliation data and communications regarding disputes and chargebacks.
• From authentication platforms: when the User chooses to access the platform with a third-party account, such as Discord.
• From Authorised Distribution Partners: technical confirmations of top-up execution, generated codes and records of delivery errors or failures.
• From internal fraud prevention sources: block and allow lists, order history and records of previous incidents kept by RR Store itself.

This section specifically describes the processing of game account access credentials, as this is the most sensitive category of data from an operational standpoint in a top-up store.

• Used only when necessary: the ID-PASS method is offered only for games or products that do not provide top-up by UID, Weblink or redemption code. Whenever an alternative that avoids account access is available, it will be prioritised and recommended.
• Voluntary provision: providing credentials is an exclusively voluntary act by the User, made by their free choice in the order form, based on consent and on the performance of the contract.
• User declaration: by providing credentials, the User declares that they are the legitimate holder of the game account or have the express authorisation of the holder, and declares awareness that sharing credentials may conflict with the game publisher's terms of use, this decision being their sole responsibility.
• Strictly limited purpose: credentials are used solely and exclusively to carry out the purchased top-up. They are not used to move items or virtual goods, change profile data, make unpurchased transactions, access private communications or for any other purpose.
• Restricted and traceable access: access to credentials is limited to the personnel designated to fulfil the order, bound by a duty of confidentiality, with access logging and application of the principle of least privilege.
• Automatic deletion on completion: when an order is marked as completed, the system automatically erases the login, password, access method, character name and free-text notes from the order record, and removes the access information from the linked chat. This is not a future promise: it is a routine the platform itself runs at the moment of completion.
• Deletion when the chat closes as well: the support chat linked to the order is deleted from the platform a few minutes after it is closed, taking the message content with it.
• Security recommendation: we strongly recommend that the User change the game account password immediately after delivery is confirmed and re-enable any two-factor authentication mechanisms of the game.
• Official channels: RR Store requests credentials exclusively through the order form on the platform. We never request e-mail passwords, banking passwords, authentication codes sent by SMS for transactions unrelated to the order, or payments through unofficial channels. Be wary of any contact outside the channels listed in Section 26.

If the User does not wish to provide credentials, they may choose products available under the UID, Weblink or redemption code methods, where these exist for the intended game. The absence of credentials for products that depend exclusively on this method makes the top-up impossible and results in cancellation of the order with a refund, under the terms of the Refund Policy.

It is common for top-ups to be purchased as a gift for someone else. In such cases, the User may provide third-party data such as UID, server, character name, delivery e-mail or, in the ID-PASS method, another person's game account credentials.

• By providing third-party data, the User declares that they have valid authorisation from the data subject for this purpose and assumes responsibility for that declaration.
• The User undertakes to inform the data subject of the existence and content of this Privacy Policy.
• RR Store processes such data only to fulfil the order, provide support and comply with legal obligations, and deletes it within the same periods that apply to the User's own data.
• Where there is any indication of unauthorised use of third-party data or accounts, RR Store may request additional evidence, suspend fulfilment of the order and, if necessary, cancel it with a refund, under the terms of the Refund Policy.

We process personal data exclusively for legitimate, specific and disclosed purposes, with no possibility of further processing in a manner incompatible with those purposes:

• Performance of the contract: processing orders, carrying out top-ups, delivering codes and vouchers, crediting cashback and managing the User's internal wallet.
• Account management: creating, authenticating, maintaining and administering the User's account, including e-mail verification, password reset and two-factor authentication.
• Customer service: answering questions, requests, complaints and refund requests and providing technical support, keeping a record of the service history.
• Payment processing: intermediating, confirming, reconciling and, where applicable, reversing financial transactions with payment providers.
• Store security and fraud prevention: protecting the platform, Users and third parties against fraud, misuse of payment methods, improper disputes, unauthorised access, abusive automation and cyberattacks.
• Compliance with legal and regulatory obligations: meeting tax, accounting and consumer law requirements, the retention of access logs and requests from competent authorities.
• Transactional communications: sending order confirmations, status updates, security alerts, notices of changes to the terms and essential information about the service.
• Promotional communications: sending offers, coupons and news, only where there is consent or another appropriate legal basis, with an opt-out option in every message.
• Relationship programmes: running cashback, the internal wallet, the loyalty tier programme, missions, raffles, product reviews and partner, affiliate and reseller programmes.
• Continuous improvement: identifying technical errors, fixing failures and improving the user experience, based on technical records rather than behavioural profiling.
• Regular exercise of rights: bringing, defending or exercising rights in judicial, administrative or arbitration proceedings.

Each processing operation is based on at least one of the legal grounds set out in art. 7 of the LGPD:

• Performance of a contract or preliminary procedures (art. 7, V): registration, processing and delivery of orders, purchase-related support, management of the internal wallet and of the partner programme.
• Compliance with a legal or regulatory obligation (art. 7, II): issuing tax documents, retaining internet application access logs for the period set out in art. 15 of the Internet Framework, responding to requests from authorities and complying with consumer law obligations.
• Legitimate interests (art. 7, IX): fraud prevention, information security, defence against improper chargebacks, measuring platform performance and improving services, always preceded by an assessment of proportionality and of the impact on the data subject's rights.
• Consent (art. 7, I): provision of credentials under the ID-PASS method, use of the AI support assistant, non-essential cookies and promotional communications. Consent is free, informed and may be withdrawn at any time, without prejudice to the lawfulness of prior processing.
• Regular exercise of rights in proceedings (art. 7, VI): producing and preserving evidence for defence in judicial, administrative or arbitration proceedings.
• Credit protection (art. 7, X): checks intended to prevent default and the fraudulent use of payment methods.

Where processing is based on legitimate interests, the User may request information about the assessment carried out and submit a reasoned objection, pursuant to art. 18, § 2, of the LGPD.

RR Store is not a financial institution, a payment institution or a payment scheme operator. We act as a merchant that uses duly authorised payment providers to process transactions.

• PIX: we receive from the provider the data required for reconciliation, such as the payer's name, tax number (in full or in part), amount, date and transaction identifier. This data is used to confirm the payment, prevent fraud and enable any refund.
• Cryptocurrencies: where available, payment with cryptocurrencies involves recording the wallet address, the network used and the transaction identifier (hash). Records written to public blockchain networks are, by their technical nature, public, immutable and irreversible, and RR Store cannot change or delete them.
• Internal wallet balance: when an order is paid in full or in part with the accumulated balance, we record the amount debited and the corresponding order, for accounting and audit purposes.
• Mismatched holder details: where the payer's data does not match the User's registration data, we may request additional verification before releasing the order, as a fraud prevention measure.
• Refunds and reversals: to process refunds, we may process bank details or a PIX key provided by the User, used exclusively for that purpose.

RR Store does not sell RR Coins. The internal wallet balance is obtained exclusively as cashback on purchases, bonuses, prizes from promotions and raffles, or order refunds, and works only as a discount on future purchases within the platform itself.

• How cashback is calculated: the percentage is set per product or per game and may be topped up by a promotional coupon. The corresponding amount is attached to the order at the time of purchase.
• When cashback is credited: the credit occurs only when the order is actually completed and delivered. Cancelled, undelivered or refunded orders generate no cashback.
• What data this generates: we keep the current balance, the statement of credits and debits, the amount of each movement, the balance before and after, and the reference to the order that originated it. This record is necessary for accounting audits, resolving discrepancies and preventing abuse.
• Nature of the balance: RR Coins do not constitute currency, a financial asset, a security, a payment arrangement or a crypto-asset. They cannot be converted into cash, transferred between accounts or redeemed outside the platform.
• Account closure: when an account is deleted, any remaining balance is extinguished, and the statement is kept only to the extent required by tax and accounting obligations.
• Misuse: balances generated through fraud, exploitation of a system flaw, duplicate accounts or breach of the Code of Conduct may be reversed, and the account may be suspended.

The trade in instantly delivered digital products is a frequent target of payment fraud. To protect legitimate Users and our own operations, we adopt verification measures that may include automated analysis.

• Criteria used: frequency and value of orders, recurrence of e-mail, IP, device or document, comparison between payer data and registration data, dispute history and presence on internal block or allow lists.
• Possible consequences: a requirement for additional verification, delayed release, refusal or cancellation of the order with a refund, restriction of payment methods and precautionary suspension of the account in cases of well-founded suspicion.
• Right to review (art. 20 of the LGPD): the User may request a review, by a natural person, of decisions taken solely on the basis of automated processing that affect their interests, as well as information about the criteria used, subject to trade and industrial secrecy and to the effectiveness of the anti-fraud measures themselves.
• Incident records: information about confirmed fraud, improper disputes and breaches of the Code of Conduct may be retained for the period necessary to prevent recurrence and to defend our rights.
• Disputes and chargebacks: in the event of a dispute with the payment provider, we may share with those companies the data and records needed to prove the legitimacy of the transaction and the actual delivery of the digital product, including access logs, order data and proof of fulfilment.

Part of the platform's first-line support may be handled by an automated assistant based on a language model, which answers general questions and escalates the case to a human agent when necessary.

• What is sent: only the content of the messages you write to the assistant and the topic you select. The assistant has no access to the order database, to your account, to your purchase history or to credentials.
• Where it goes: messages are processed by an artificial intelligence provider contracted by RR Store, with servers abroad, under a contractual obligation of confidentiality and of not using the content to train models.
• How to avoid it: using the assistant is optional. At any time you may ask to speak to a human agent or use the channels listed in Section 26 directly.
• Recommendation: do not write passwords, game credentials, full payment details or documents in the chat. None of that is needed for first-line support.
• Decisions: the assistant does not make decisions about orders, payments, refunds or account blocks. Those decisions are human or follow the rules in Section 13.

We share personal data only where necessary for the purposes described in this Policy, always limited to the minimum required and subject to confidentiality and security obligations:

• Payment providers: for processing, confirming, reconciling, reversing and defending disputes over financial transactions.
• Authorised Distribution Partners: for the technical execution of the top-up, receiving only the indispensable data, such as player identifier, server and purchased product, or, in the ID-PASS method, the credentials strictly necessary for execution.
• Infrastructure and technology providers: hosting, database, storage, security, monitoring and attack prevention.
• Communication providers: the transactional e-mail service and the messaging platforms used in support, such as WhatsApp and Discord, when the User chooses those channels.
• Internal support channel: when a ticket is closed, the conversation history and any attachments may be forwarded to our internal support channel, hosted on a third-party platform, for service records and quality control, with access restricted to our team.
• Artificial intelligence provider: as described in Section 14, only the content of the messages sent to the assistant.
• Professional advisers: accountants, auditors and lawyers, where necessary to comply with legal obligations or to defend our rights, subject to professional secrecy.
• Public authorities: where required by law, court order or request from a competent authority, within the limits of applicable legislation.
• Corporate reorganisation: in the event of a merger, acquisition or sale of assets, data may be transferred to the successor, maintaining the purposes and level of protection of this Policy, with prior notice to Users where required by law.

RR Store does NOT sell, rent, assign or trade Users' personal data. We do not share data with data brokers or with advertisers for advertising profiling purposes.

The game top-up market is global. For this reason, some personal data may be transferred, stored or processed outside Brazil, particularly in the following situations:

• Execution of top-ups by Authorised Distribution Partners and by game publishers based in other countries, notably in Asia, Europe and North America.
• Processing of international payments and crypto-asset transactions.
• Use of the artificial intelligence assistant described in Section 14.
• Use of messaging platforms and of our internal support channel, operated by foreign companies.
• Infrastructure, e-mail and security services with servers located abroad.

In these cases, we observe arts. 33 to 36 of the LGPD and adopt appropriate safeguards, such as specific contractual clauses, confidentiality undertakings, verification of the level of protection in the destination country and limitation of the transferred data to the minimum necessary to perform the contracted service.

We adopt technical and administrative measures capable of protecting personal data from unauthorised access and from accidental or unlawful destruction, loss, alteration, communication or dissemination (art. 46 of the LGPD):

• Encryption of data in transit (TLS/SSL) and of operationally sensitive data at rest, including encrypted storage of documents such as partner and affiliate tax numbers.
• Passwords stored exclusively as a salted hash, which cannot be read by the RR Store team.
• Two-factor authentication (2FA) available for User accounts and mandatory for administrative access.
• Role-based access control, applying the principle of least privilege and reviewing permissions periodically.
• Audit records of critical account operations, with the e-mail written as a SHA-256 hash and the IP address masked.
• Rate limiting of access attempts and requests, protection against abusive automation and monitoring of suspicious activity.
• Regular backups with tested restoration procedures, and separation between production and development environments.
• Contractual confidentiality obligations binding our team and suppliers, together with internal data handling guidelines.

Despite all efforts, no system is entirely immune to incidents. Should a security incident occur that may result in relevant risk or damage to data subjects, RR Store will notify the National Data Protection Authority and the affected data subjects within a reasonable period, informing the nature of the data involved, the risks and the measures taken, pursuant to art. 48 of the LGPD.

The User is jointly responsible for the security of their account: they must keep their password confidential, not reuse it on other services, enable two-factor authentication and immediately report any suspicion of unauthorised access.

Security vulnerabilities identified on the platform may be responsibly disclosed to rrstore@rrstore.pro.

The platform shows a cookie notice on your first visit, where you can accept or reject non-essential cookies. Your choice is recorded in a dedicated cookie and lasts about six months; it can be changed at any time by clearing your browser cookies.

We use only the technologies needed for the site to work and to stay secure:

• Authentication cookie: keeps you signed in to your account across pages. Without it, logging in is not possible.
• Cross-site request forgery (CSRF) protection cookie: prevents another website from performing actions on your behalf inside the platform.
• Temporary social login cookie: used only during the Discord sign-in flow, to validate that the authentication callback is legitimate.
• Cookie preference cookie: stores your answer to the cookie notice so we do not ask again.
• Browser local storage: keeps cart items, the selected currency and dashboard display preferences on your own device. That data stays with you and can be cleared at any time through your browser.

We do not use Google Analytics, social network pixels, behavioural advertising cookies, heatmaps or any third-party profiling tool. Should this change in the future, this Policy will be updated, the change will appear in the change history, and consent will be requested in advance where required by law.

Disabling essential cookies in your browser prevents login and order completion.

Each category of data has its own retention period, determined by the purpose that justifies keeping it:

• Game account credentials (ID-PASS): automatically deleted from the order the moment it is completed, together with the removal of the access information from the linked chat.
• Order support chat: deleted from the platform a few minutes after the service is closed.
• Account data: while the account is active. After a deletion request, the account is deactivated immediately and the password, phone number, profile picture, Discord link, 2FA configuration and all access tokens are erased; only the name and e-mail attached to the order history remain, for the tax and legal-defence period stated below.
• Order and transaction data: for a minimum of 5 years, due to tax and accounting obligations and the limitation period in art. 27 of the Consumer Protection Code.
• Cashback and wallet statement: for the same period as the corresponding orders, as it forms part of the accounting records.
• Transactional e-mails and support records outside the chat: for up to 2 years after the last contact, for history and defence of rights.
• Internet application access logs: for 6 months, pursuant to art. 15 of the Internet Framework, and may be kept longer at the request of a competent authority.
• Audit and fraud-prevention records: for up to 5 years, already in minimised form (hashed e-mail and masked IP), to prevent recurrence and support any defence.
• Partner, affiliate and reseller data: for up to 5 years after the end of the commercial relationship, due to tax and contractual obligations.

Once the applicable periods have elapsed, data is securely deleted or anonymised, in which case it may be used for statistical purposes without any possibility of identifying the data subject.

Pursuant to arts. 17 to 22 of the LGPD, the User has the following rights, which may be exercised free of charge:

• Confirmation and access: confirm the existence of processing and obtain a copy of the personal data we hold about you.
• Correction: request the correction of incomplete, inaccurate or outdated data.
• Anonymisation, blocking or deletion: request action regarding unnecessary or excessive data, or data processed in breach of the LGPD.
• Portability: request the portability of your data to another service provider, upon express request and subject to trade and industrial secrecy.
• Deletion of data processed with consent: request deletion, except in the retention situations set out in art. 16 of the LGPD.
• Information about sharing: obtain information about the public and private entities with which we share data.
• Information about withholding consent: be informed of the possibility of not giving consent and of the consequences of refusal.
• Withdrawal of consent: withdraw consent at any time, without affecting the lawfulness of processing carried out previously.
• Objection: object to processing based on a legal ground that dispenses with consent, in the event of non-compliance with the LGPD.
• Review of automated decisions: request a review, by a natural person, of automated decisions affecting your interests, as described in Section 13.

To exercise any of these rights, contact us at rrstore@rrstore.pro or through the channels listed in Section 26. To protect the data subject against improper disclosure, we may request additional information confirming your identity and ownership of the account.

We respond to access requests in simplified format immediately and, where a full statement is required, within 15 days, pursuant to art. 19 of the LGPD. Manifestly unfounded, excessive or repetitive requests may be refused with reasons given.

Some rights may be limited where there is a legal obligation to retain data or a need to exercise rights regularly, in which case the refusal will be communicated and justified to the data subject.

The platform is intended exclusively for people aged 18 or over who are fully capable of performing civil acts. We do not intentionally collect personal data from children and adolescents.

Adolescents aged 16 or over may use the platform when assisted by their parents or legal guardians, who assume responsibility for the acts performed, including payments made. Access by those under 16 is not permitted.

If we identify, or are informed, that data of a child or adolescent has been collected without the specific and prominent consent of a parent or legal guardian (art. 14 of the LGPD), we will take steps to suspend the account and delete the information, except for what must be retained by legal obligation.

Parents and guardians who identify purchases made by minors under their responsibility may contact us through the channels in Section 26 to request the deletion of the data and to assess cancellation or refund of the order, under the Refund Policy and consumer legislation.

Some features make certain information visible to other Users, always with your privacy in mind:

• Product reviews: published with the name partially hidden, in a format that keeps only the first two letters and the last one (for example, Re****o). There is also an option to publish the review anonymously.
• Raffles and promotions: the result may display the winner's username, for the transparency of the draw.
• Official community channels: interactions on Discord servers or equivalent groups are visible to other participants and are also subject to those platforms' policies.
• Published reviews may also be reproduced on our official channels, keeping the same level of name masking.

Published content may be indexed by search engines. Users may request, at any time, the removal of reviews or comments they have authored.

RR Store is an independent store. We are not affiliated with, representatives of, sponsored by or endorsed by game publishers, developers or distribution platforms. Trademarks, logos and game names belong to their respective owners and are used only to identify the products offered.

The User's use of their game account is governed by the terms of use and privacy policy of the relevant publisher, over which RR Store has no control and for which it is not responsible.

The platform may contain links to third-party websites, applications or channels. By accessing them, the User becomes subject to those third parties' policies, and we recommend reading their documents beforehand.

This Privacy Policy may be updated periodically to reflect changes in our practices, in the technology used, in applicable legislation or in the services offered.

Every revision is recorded in the change history at the end of this page, with the date it took effect, the version number and an objective summary of what changed. The date of the version in force also appears at the top of the document.

In the event of material changes, we will notify Users by e-mail or through a prominent notice on the platform, with reasonable advance notice whenever possible. Where a change requires new consent, it will be requested in a specific and prominent manner.

Continued use of the platform after the changes take effect indicates awareness of the updated content.

This Policy is governed by the laws of the Federative Republic of Brazil, in particular Law No. 13,709/2018 (LGPD), Law No. 8,078/1990 (Consumer Protection Code), Law No. 12,965/2014 (Internet Civil Rights Framework) and the Civil Code.

We encourage the amicable resolution of disputes. The User may first contact our support channels and, if necessary, use consumer dispute resolution platforms such as consumidor.gov.br, or consumer protection bodies.

The courts of the consumer's domicile are elected to settle any disputes arising from this Policy, pursuant to art. 101, I, of the Consumer Protection Code, without prejudice to the User's right to file a complaint directly with the National Data Protection Authority.

The possible invalidity or unenforceability of any provision of this Policy shall not affect the remaining provisions, which shall remain in full force.

To exercise your rights, clarify questions about data processing, request the deletion of credentials or file complaints, use the official channels below:

• E-mail and Data Protection Officer (DPO): rrstore@rrstore.pro
• Support WhatsApp: +55 (11) 96304-1504
• Support chat: available in the logged-in area of the platform
• Contact page: https://rrstore.pro/contato

No other channel, profile or number should be considered official. RR Store is not responsible for contacts made outside the channels listed above.

If you believe that the processing of personal data carried out by RR Store breaches the law, you also have the right to file a complaint with the Brazilian National Data Protection Authority (ANPD) through its official channels.