Privacy policy

Last updated: 8 October 2026

This policy explains how we use your personal data when you visit eu.gpen.com, buy from us, contact us or sign up for our emails. It applies under the EU General Data Protection Regulation (GDPR) and, for customers in the United Kingdom, the UK GDPR. If anything is unclear, please ask us.

1. Who is responsible for your data

The controller of your personal data is:

For any question about your data or your rights, email us at help@gpen.com. We have not appointed a data protection officer because we are not required to.

We are based in the United States and our team accesses your data from there. The servers of this website are in Frankfurt am Main, Germany.

2. What data we collect and where it comes from

Data you give us

• Contact and order data: name, email address, phone number if you give it, delivery and billing address, the products you order and your messages to us.
• Account data, if you create an account: login email, password (stored encrypted), saved addresses and order history.
• Age check data: your name, date of birth and address and, where needed, a photo of an ID document, which goes directly to our age check provider.
• Warranty and support data: product registration, serial number, photos or videos of a fault, and your conversations with us.
• Withdrawal data: what you send us through the online withdrawal function or by email.
• Newsletter data, if you sign up: your email address, when and how you signed up, and your preferences.

Data we collect automatically

• Technical data: IP address, browser and device type, pages visited, date and time, and the page you came from. We need some of this to run and protect the website.
• Cookies and similar technologies: only strictly necessary ones unless you agree to more. See our Cookie policy.

Data from others

• Our payment provider tells us whether your payment succeeded, the payment method and the last digits of your card. We never see your full card details.
• Our age check provider tells us whether your age was confirmed.
• Our warehouse and the carriers tell us the shipping and delivery status of your parcel.

3. Why we use your data and our legal basis

Purpose	Legal basis (GDPR)
Take, process and deliver your order, take payment, and send order and shipping emails	Article 6(1)(b): performance of our contract with you
Create and run your customer account	Article 6(1)(b): contract
Check that you are 18 or over before you pay	Article 6(1)(c): legal obligation, where the law of the delivery country requires an age check; otherwise Article 6(1)(f): our legitimate interest in selling only to adults and protecting minors
Handle withdrawals, returns, refunds, legal guarantee and warranty claims	Article 6(1)(b) and (c): contract and our legal obligations under consumer law
Register your product for the manufacturer’s warranty	Article 6(1)(b): contract
Answer your questions and complaints	Article 6(1)(b) where it concerns an order; otherwise Article 6(1)(f): our legitimate interest in answering you
Keep invoices and accounting records and meet our tax duties	Article 6(1)(c): legal obligation
Contact you about product safety warnings or recalls	Article 6(1)(c): legal obligation under the General Product Safety Regulation; Article 6(1)(f): our legitimate interest in your safety
Send our newsletter and offers by email	Article 6(1)(a): your consent, confirmed by double opt-in
Keep the website secure and prevent fraud and misuse	Article 6(1)(f): our legitimate interest in security and preventing fraud
Measure how the website is used (statistics) and show and measure advertising	Article 6(1)(a): your consent through the cookie banner, as required by the national laws on cookies
Translate the website into other languages	No personal data is used: only website texts are translated
Answer wholesale and business enquiries	Article 6(1)(b): steps before a contract; Article 6(1)(f): our legitimate interest
Establish, exercise or defend legal claims	Article 6(1)(f): our legitimate interest

Our legitimate interests are: running a safe online store that works, preventing fraud, selling only to adults, answering customers and defending our legal rights. You can object to processing based on legitimate interests at any time (see section 9).

To buy from us, you have to give us your name, email address, delivery address and date of birth, and pass the age check. Without them we cannot accept your order. Everything else is optional.

4. Age checks

Before you pay, we check that you are 18 or over. Our provider AgeChecker.Net, based in the United States, runs the check for us. Customers outside the United States usually upload a photo of an ID document, which a person at AgeChecker reviews. AgeChecker deletes ID images after the check, normally within 30 minutes. It keeps your name, date of birth and address under its retention rules, so that you do not have to repeat the check next time and to prevent fraud. We keep only the result of the check (passed or not, date and method) with your order.

The decision is not made solely by a computer. If your check fails and you think this is wrong, contact us and we will look at it with you.

Age policy

5. Who receives your data

We share your data only when we need to. Our service providers (processors) may use it only on our instructions and under a data processing agreement.

Recipient	What they do	Where
Cloudways, LLC and DigitalOcean, LLC (processors)	Hosting of this website and its database	Servers in Frankfurt am Main, Germany; support access from other countries possible
Costplus OÜ (Cost+), Estonia, with the card schemes and banks involved (independent controllers)	Payment processing and fraud prevention	EU
AgeChecker.Net (processor)	Age verification	United States
Retail North LTD, Northern Ireland (processor), using the Mintsoft warehouse system	Warehouse, packing, shipping and returns	United Kingdom
Cin7 (processor)	Inventory and order management	Cloud servers outside the EU
Carriers such as DHL, GLS, Royal Mail, DPD, An Post and UPS (independent controllers)	Delivering your parcel and sending delivery updates	Country of dispatch, transit and delivery
Google Ireland Limited and Google LLC (processors; for advertising, independent controllers)	Sending and receiving our emails (Google Workspace); with your consent only: statistics (Google Analytics), advertising (Google Ads), Google Tag Manager and YouTube videos	EU and United States
Klaviyo, Inc. (processor)	Newsletter and marketing emails, only if you sign up	United States
Cozmoslabs SRL, Romania (TranslatePress)	Machine translation of website texts. No personal data is sent.	EU
Stockist (processor)	Store locator, only when you search for a store	Outside the EU
Accountants, tax advisers and lawyers (independent controllers bound by professional secrecy)	Accounting, tax and legal advice	EU, United Kingdom and United States
Authorities and courts (independent controllers)	Only where the law requires it	Where the authority is

We do not sell your personal data.

6. Transfers outside the EU

Some recipients are outside the European Economic Area, and we ourselves are in the United States. We transfer data only when it is protected:

• United Kingdom: the European Commission has decided that the United Kingdom protects personal data adequately (decisions renewed in December 2025).
• United States: we use recipients certified under the EU-US Data Privacy Framework where they are certified. Otherwise, and as a backup, our contracts include the EU Standard Contractual Clauses.
• Other countries: an adequacy decision of the European Commission where one exists, otherwise the EU Standard Contractual Clauses.

You can ask us for a copy of the safeguards at help@gpen.com.

7. How long we keep your data

We keep your data only as long as we need it, and then delete or anonymise it.

Data	How long
Orders, invoices, accounting and VAT records	10 years from the end of the year of the order
Withdrawals, acknowledgements, legal guarantee and warranty claims	Until the guarantee and the legal limitation period have ended, usually 3 years after the end of the guarantee period
Customer account	Until you delete it. We may delete accounts with no login or order for 3 years, after telling you.
Customer service conversations	3 years after the conversation ends
Age check result	With your order record
Newsletter data	Until you unsubscribe; we keep proof of your consent for 3 years after that
Server logs	Up to 30 days, longer only if we need them to investigate an attack
Statistics data	14 months
Cookies	See our Cookie policy

8. How we protect your data

The whole website uses encrypted connections (HTTPS), payments run on our payment provider’s secure page, only people who need customer data can access it, and we keep our systems up to date.

9. Your rights

You have the right to:

• access your data and get a copy of it
• have wrong data corrected
• have your data deleted, unless we must keep it (for example invoices for tax law)
• restrict how we use your data in certain cases
• receive the data you gave us in a common, machine-readable format, or have it sent to someone else (data portability)
• withdraw your consent at any time, for example with the unsubscribe link in every email or in your cookie settings, without affecting what we did before

Right to object: you can object at any time, for reasons relating to your particular situation, to our use of your data based on legitimate interests. You can object to direct marketing at any time without giving a reason, and we will stop.

To use your rights, email help@gpen.com or write to us at the address in section 1. We reply within one month. We may ask you to confirm your identity.

10. Complaints

If you are unhappy with how we handle your data, please tell us first at help@gpen.com. We confirm receipt within 30 days and answer as quickly as we can.

You also have the right to complain to a data protection supervisory authority, in particular in the EU or EEA country where you live or work, or where you think the problem happened. You find the list of authorities here:

European Data Protection Board: members

In the United Kingdom, you can complain to the Information Commissioner’s Office (ICO):

ico.org.uk

11. Automated decisions

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Our payment provider and the banks use automated fraud checks. If a payment is refused and you think this is wrong, contact us and we will help.

12. Newsletter

We send our newsletter only if you sign up and confirm your email address by clicking the link in our confirmation email (double opt-in). Every email has an unsubscribe link. We may measure whether our emails are opened and which links are clicked, to improve them.

13. Under 18s

Our store is only for adults aged 18 or over. We do not knowingly collect data from anyone under 18. If we learn that we have, we delete it.

14. Changes to this policy

We update this policy when our services or the law change. The date at the top shows the current version. If a change is important, we will tell you by email or on the website.