1. Controller and contact
MM2Mart determines the purposes and means of processing data collected directly through this store. Privacy enquiries and data-rights requests can be sent to support@mm2mart.com.
2. Data we process
- Order number, products, quantities, prices, discounts, status and timestamps.
- PayPal order and capture identifiers and payment status. Raw card data is not received by MM2Mart.
- Roblox username, user ID, display name and public avatar headshot used for delivery confirmation.
- Names, email addresses, ratings, message content, publication consent and optional order references submitted through contact or feedback forms.
- Checkout consent version and acceptance time.
- Technical request data such as IP address, browser information and server error logs where produced by hosting infrastructure.
- Local browser storage containing cart, coupon and active order references.
3. Purposes and legal bases
Data is processed to form and perform purchase contracts, verify payments, deliver items, answer messages, evaluate feedback, prevent fraud, provide support and comply with accounting or legal duties. Depending on the context, the legal bases are contract performance, steps requested before a contract, compliance with legal obligations and legitimate interests in secure operation, service improvement, fraud prevention and resolving disputes.
4. PayPal
PayPal processes payment-account, card and transaction information under its own privacy terms. MM2Mart receives transaction identifiers, payer/order status and captured amount needed to verify the order. Payment credentials are entered in PayPal-hosted interfaces and are not stored in this shop.
5. Roblox lookup and delivery
The supplied username is sent through the MM2Mart server to Roblox's public user and thumbnail APIs to confirm the intended account. Confirmed public profile information is stored with the order and used by the delivery team. MM2Mart never requires a Roblox password, cookie or authentication code.
6. Service providers
Order and catalog records use Google Firebase. Payments use PayPal. Public Roblox account data is retrieved from Roblox. Product media may be hosted by Cloudinary. Fonts and interface assets may be delivered by Google Fonts and cdnjs, which can receive normal web-request metadata such as IP address and browser headers.
7. International transfers
Some providers may process data outside the EU/EEA. Where required, transfers must rely on an adequacy decision, approved contractual safeguards or another lawful transfer mechanism provided by the relevant service provider.
8. Retention
Order and payment-reference data is retained while needed for delivery, support, fraud prevention, disputes and mandatory tax or commercial recordkeeping. Contact messages and feedback are retained while needed to answer the request, improve the service, document the outcome or handle related disputes, then deleted or anonymized when no longer necessary. Roblox delivery data is removed or anonymized when no longer needed for those purposes, subject to legal retention obligations. Browser cart data remains until checkout, manual removal or browser-storage clearing.
9. Sharing and public feedback
Data is shared only with providers and personnel reasonably necessary for payment, hosting, delivery, security and legal compliance. Feedback is displayed publicly only when the submitter selected the public-display option and an administrator publishes it. Public entries may include the rating, feedback text, topic, date, first name or an anonymous label, and an MM2Mart reply. Email addresses and order numbers are never included in the public feedback feed. MM2Mart does not sell personal data. Data may be disclosed where required by law or necessary to establish, exercise or defend legal claims.
10. Your rights
Depending on applicable law, you may request access, correction, deletion, restriction, portability or objection, and may complain to a competent data-protection authority. Rights can be limited where processing or retention is legally required. Requests should identify the relevant order without including passwords or full payment credentials.
11. Children
Payment contracts must be authorized by a person legally capable of making the purchase. MM2Mart does not knowingly request private information from children. Only the public Roblox information necessary to identify the delivery account should be supplied.
12. Security and changes
MM2Mart uses server-side PayPal capture verification and limits payment data received by the store. No internet service is completely secure. Material policy changes will be published with a new effective date and will not retroactively remove existing legal rights.