Privacy

Privacy Policy

Last updated: 26 May 2026

This Privacy Policy explains how Forza Horizon 6 Accounts Shop collects, uses, stores, and protects personal information. It is written for users in the United Kingdom and is intended to meet UK GDPR transparency requirements.

1. Who we are

Forza Horizon 6 Accounts Shop is the controller for personal information collected through this website. For privacy questions or requests, contact support through your client dashboard.

2. Information we collect

We may collect account and service information including:

  • email address, display name, and username;
  • date of birth;
  • password hash;
  • Discord ID and avatar where you use Discord login;
  • uploaded avatar;
  • order details, package selections, order notes, and support messages;
  • email verification status and mailing preference;
  • ban status and account restriction information;
  • affiliate/referral information; and
  • account settings.

We also collect technical and security information including:

  • IP address or hashed IP;
  • browser/user-agent or hash;
  • device cookie hash;
  • login/session data;
  • request logs;
  • fraud-prevention signals; and
  • payment references.

3. Why we use your information

We use your information to:

  • create and manage your account;
  • verify your age and email address;
  • process orders and take payment;
  • provide support and order updates;
  • prevent duplicate accounts, abuse, fraud, and ban evasion;
  • run referrals and affiliates;
  • send service emails;
  • send marketing emails where you remain opted in;
  • keep records; and
  • comply with legal obligations.

4. Lawful bases

We process personal information where:

  1. it is needed to perform a contract with you;
  2. we have a legitimate interest in operating and protecting the website;
  3. we need to comply with legal obligations; or
  4. you have given consent, such as optional marketing emails where applicable.

5. Age checks

  • We collect date of birth to enforce the 13+ registration rule.
  • Date of birth is stored so we do not need to ask repeatedly.
  • Date of birth is locked so users cannot bypass age checks by changing it later.

6. Anti-abuse, duplicate accounts, and bans

To protect the website, customers, and payments, we may use privacy-preserving hashes of IP addresses, browser/user-agent data, and persistent device cookies. These help us detect:

  • duplicate accounts;
  • banned users;
  • suspicious registrations;
  • payment abuse; and
  • attempts to bypass restrictions.

We do not intentionally collect console or PC hardware identifiers from your device through the website. However, third-party platforms may use their own hardware or device identifiers for enforcement, including hardware ID bans, under their own systems and policies.

7. Cookies

We use cookies and local storage for:

  • essential website functions;
  • login sessions;
  • CSRF/security protection;
  • cookie notice preference;
  • device/duplicate-account checks; and
  • referral tracking.

Blocking essential cookies may stop the website working properly.

For more detail about cookies, local storage, payment security, captcha, referral, and anti-abuse technologies, read our Cookie Policy.

8. Payments

  • Payments are processed by Stripe.
  • We store order totals, payment status, Stripe session IDs, payment references, and related confirmation data.
  • We do not store full card numbers.
  • Stripe processes payment data under its own privacy terms.

9. Emails and mailing list

We send essential service emails, including:

  • account verification emails;
  • order updates;
  • support notifications;
  • ban/unban notices;
  • security messages; and
  • payment-related emails.

Users are opted in to mailing-list messages by default. You can unsubscribe using the unsubscribe link in those emails or by changing your preference in account settings. Unsubscribing from marketing does not stop essential service emails.

10. Who we share data with

We do not sell personal information. We may share information with:

  • payment processors;
  • email delivery providers;
  • hosting providers;
  • analytics/security tools;
  • Discord where you use Discord features;
  • professional/legal advisers where needed; and
  • authorities or relevant parties where required by law, court order, fraud prevention, or payment dispute handling.

11. International transfers

Some providers may process data outside the UK. Where this happens, we rely on appropriate safeguards used by those providers, such as UK-approved contractual protections or adequacy arrangements where applicable.

12. How long we keep information

We keep account and order records for as long as needed to:

  • provide services;
  • handle refunds and disputes;
  • prevent fraud and ban evasion;
  • meet tax/accounting requirements; and
  • enforce our Terms.

Security and anti-abuse records may be kept where reasonably needed to protect the website. Marketing unsubscribe records may be kept so we can respect your preference.

13. Your rights

Under UK data protection law, you may have rights to:

  • access your personal information;
  • correct inaccurate information;
  • delete information in certain cases;
  • restrict processing;
  • object to processing; or
  • receive a copy of your personal information.

These rights are not absolute and may depend on the reason we process the data. To make a request, contact support through your client dashboard.

You also have the right to complain to the UK Information Commissioner’s Office if you are unhappy with how your personal information is handled.

14. Security

  • We use reasonable technical and organisational measures to protect personal information.
  • No online service is completely secure.
  • You should use a strong password, keep your email account secure, and tell us quickly if you suspect unauthorised access.

15. Changes to this policy

We may update this Privacy Policy from time to time. The latest version will be shown on this page.