Keystone data breach: access and erasure request letter
Keystone announced on 24 October 2026 that someone had gained unauthorised access to its online shop. Ask Yanssie HK Limited, the company behind Keystone, which of your data it holds and who received it, and ask it to erase what it no longer needs.
After Keystone's 24 October 2026 announcement of unauthorised access to its online shop, this letter asks Yanssie HK Limited to say which of your data it holds, since when, and who received it, and to erase what it no longer needs. It rests on Articles 15 and 17 GDPR and applies to buyers who were in the EU or EEA when they ordered, and under the UK GDPR to buyers in the United Kingdom.
Sample letter
Access and erasure request under Articles 15 and 17 GDPR after the Keystone shop incident: riley.patel@example.com
Yanssie HK Limited Keystone Data protection and privacy requests 19H Maxgrand Plaza No. 3 Tai Yau Street San Po Kong, Kowloon Hong Kong Access and erasure request after the Keystone online shop incident Dear Keystone team, On 24 October 2026, Keystone announced that it had detected unauthorised access to its online shop on 20 October 2026 and had confirmed on 23 October 2026 that a third party obtained customer shipping data. The reported data includes names, contact details, shipping addresses and order details with items and prices. Keystone said that card and bank data, recovery phrases, private keys and wallet passwords were not affected. I ordered from your online shop around March 2026, and I was in Germany when I placed the order. The order used the e-mail address riley.patel@example.com. Order number: 1042 Your shop offered and delivered goods to me while I was in that country. Article 3(2)(a) of Regulation (EU) 2016/679 (GDPR) therefore applies to your processing of my personal data. If I was in the United Kingdom, the same provision of the UK GDPR applies. Your privacy policy also states that EEA residents may access their personal information and ask for it to be erased. Under Article 15 GDPR, please confirm whether you process personal data about me, send me a copy of that data, and give me the information listed in Article 15(1). Please tell me in particular: 1. Which of my personal data were stored in the shop system that the third party accessed, and since when you held each category. 2. Which recipients received my personal data, including Shopify and any other processor or service provider, and whether any of them are outside the EEA. 3. Where you did not collect any of my data from me, its source. 4. The purposes of the processing, the retention period or the criteria for it, and my right to lodge a complaint with a supervisory authority. Under Article 17 GDPR, I ask you to erase my personal data where a ground in Article 17(1) applies and no exception in Article 17(3) applies. This covers my shipping address, contact details and order history in the shop system once you no longer need them to handle my order. I am not asking you to erase records that a legal obligation requires you to keep, or data you need for the establishment, exercise or defence of legal claims. If you keep any of my data, please tell me for each category what you keep, why, and for how long. If you have designated a representative in the Union under Article 27 GDPR, please give me their name and address. Article 12(3) GDPR requires you to act on this request without undue delay and within one month of receipt. You may extend that period by two further months where necessary, but only if you tell me within the first month and give the reasons. In the United Kingdom, Article 12A UK GDPR sets the same one-month period. Please send your answer to riley.patel@example.com and confirm that you received this request. If you receive a copy of this text by e-mail, please treat it as the same request, not a second one. Yours faithfully,
Download the files
Download the sample letter as a Word file or PDF and adapt it yourself.
What to keep in mind
Keystone has said that names, contact details, shipping addresses and order details were exposed, and that card data, bank data, recovery phrases, private keys and wallet passwords were not. It has not said how many buyers are affected. For a wallet owner the shipping address is the sensitive part. It links your name to an address and to a device that suggests you own crypto. The letter asks Keystone what it holds on you and who has seen it.
- 01
On 24 October 2026, Keystone, the hardware wallet maker, announced on X that it had detected unauthorised access to its online shop on 20 October 2026 and confirmed on 23 October 2026, after checking API activity with Shopify, that a third party had obtained customer shipping data. Keystone lists names, contact details, shipping addresses and order details with items and prices as exposed. It says card and bank data, recovery phrases, private keys and wallet passwords were not affected. It has not published how many customers are involved. It said a detailed report would follow.
- 02
The letter works for people who were in the EU or EEA when they ordered. Article 3(2)(a) GDPR covers a company outside the Union that offers goods to people in the Union. Keystone's shipping page says it offers worldwide delivery to all countries, and its privacy policy gives EEA residents a right to access, port, correct or erase their data. Enter the country you were in when you bought.
- 03
Buyers in the United Kingdom can use the same letter. Article 3(2) of the UK GDPR has the same test for people in the United Kingdom. Buyers elsewhere are outside both laws. Keystone's privacy policy still invites anyone to write to support@keyst.one about their data, but it promises no answer period outside the EEA.
- 04
The recipient is prefilled as Yanssie HK Limited, 19H Maxgrand Plaza, No. 3 Tai Yau Street, San Po Kong, Kowloon, Hong Kong. Keystone's about page lists this as the registered address of the company behind the brand, and its privacy policy names Yanssie HK Limited as the operator.
- 05
Mail to Hong Kong goes by international standard post. At the time of writing, the checkout offers no registered or tracked option for this destination, and delivery takes about 6 to 14 working days. FrankKi cannot give you proof of delivery. To document the date of your request, also send the same text to support@keyst.one from the e-mail address you used for the order.
- 06
The one-month answer period starts when Keystone receives the request, not when you post it. Article 12(3) GDPR allows two further months for complex or numerous requests, but Keystone must tell you within the first month and give reasons.
- 07
Erasure has a cost. If Keystone deletes your order history, it may no longer be able to check your purchase for warranty or support. The letter asks for erasure only where no legal reason to keep the data applies, and it asks Keystone to say what it keeps.
- 08
Scammers use leaked shipping details to send fake delivery notices, refund offers and replacement-device offers. Never type your recovery phrase into a website, app or device because a message asks you to, whoever it says it comes from. Keystone's own warning is never to share your recovery phrase or private keys.
- 09
The send rail has no attachment or signature step. The letter asks for no ID copy and needs no signature. If Keystone later asks for proof of identity, ask which data it needs and why before you send anything.
Send the letter with FrankKi
Check the prefilled Keystone recipient, fill in the order e-mail, your country at the time of the order and the approximate order date, then choose to send the letter with FrankKi. The checkout shows the postal methods open for Hong Kong. The recipient and sender address blocks stay editable.
Who the law covers
Keystone's company is in Hong Kong, so the first question is whether the GDPR reaches it at all. Article 3(2)(a) says the Regulation applies to processing of personal data of people who are in the Union by a controller not established in the Union, where the processing relates to offering goods to those people. Keystone's shipping page offers worldwide delivery to all countries, and its privacy policy has a section for EEA residents. That points to an offer to buyers in the Union. Recital 23 says mere accessibility of a website is not enough, so a dispute about this is possible. The letter states the facts and leaves Keystone to answer.
The test looks at where you were when you bought, so enter that country. If you were in the United Kingdom, Article 3(2) of the UK GDPR has the same wording for people in the United Kingdom. If you were elsewhere, neither law gives you a right here, and Keystone's own policy does not set an answer period.
What the letter asks
The letter repeats only what Keystone's announcement says and does not claim your own data was taken. It asks Keystone to confirm what it holds on you, which of that data sat in the accessed shop system, since when, and which recipients received it.
- A copy of your data and the Article 15(1) information.
- The recipients, including Shopify and any other processor.
- The source of any data Keystone did not collect from you.
- Erasure where no reason to keep the data applies, and a reason for anything it keeps.
- The name of an EU representative, if Keystone has designated one.
Mail to Hong Kong and the date of your request
FrankKi sends mail to Hong Kong as international standard post, about 6 to 14 working days at the time of writing. There is no registered or tracked option and no proof of delivery. The answer period runs from receipt, so a copy sent to support@keyst.one on the day you post the letter gives you a dated record.
Protect yourself from phishing
A leaked shipping address lets scammers write to you as if they knew your order. Expect fake delivery problems, refund offers and replacement-device offers. Open Keystone's website by typing the address yourself, and never enter a recovery phrase anywhere except on a device you trust.
Frequently asked questions
What did Keystone say about the incident?
Keystone said in a post on X on 24 October 2026 that it detected unauthorised access to its online shop on 20 October and confirmed on 23 October that a third party had obtained customer shipping data. It lists names, contact details, shipping addresses and order details as exposed, and says card and bank data, recovery phrases, private keys and wallet passwords were not affected. It has not published a count and said a detailed report would follow.
Does the GDPR apply to a company in Hong Kong?
It can. Article 3(2)(a) GDPR applies to a company outside the Union when it processes the data of people who are in the Union and the processing relates to offering them goods. Keystone's shipping page offers worldwide delivery and its privacy policy gives EEA residents access and erasure rights. Whether Article 3(2)(a) fits is a question of fact that Keystone can dispute, so the letter sets out the facts and asks for an answer.
I bought in the United Kingdom. Can I use this letter?
Yes. Article 3(2) of the UK GDPR applies to a controller outside the United Kingdom that offers goods to people in the United Kingdom, in the same words as the EU text. The letter says so, and the one-month answer period matches Article 12A UK GDPR. Enter the United Kingdom as your country at purchase.
I bought from outside Europe. What happens?
Neither the GDPR nor the UK GDPR gives you a right in that case. Keystone's privacy policy still asks anyone who wants to access or delete their data to write to support@keyst.one, but it sets no answer period outside the EEA. You can send the letter as a request. Keystone does not have to answer it.
How long does Keystone have to answer?
Article 12(3) GDPR gives one month from receipt of the request. Keystone may extend that by two further months where necessary, but it must tell you within the first month and give reasons. Mail to Hong Kong takes about 6 to 14 working days, so the clock starts only when the letter arrives. A copy sent by e-mail to support@keyst.one documents the date earlier.
Will FrankKi give me proof that Keystone received the letter?
No. The checkout offers international standard post for Hong Kong with no registered or tracked option. The letter asks Keystone to confirm receipt. Sending the same text to support@keyst.one also gives you a dated e-mail.
Do I have to send an ID copy or sign the letter?
No. The letter asks for no ID copy and needs no signature, and the send rail has no attachment or signature step. If Keystone later asks for proof of identity, ask which data it needs and why, and choose a secure route.
Sources
These official sources show what the template is based on.
- Keystone announcement of the shop incident, 24 October 2026Keystone on X
- Regulation (EU) 2016/679, Articles 3, 12, 15, 17 and 27EUR-Lex, Official Journal of the European Union
- UK GDPR Article 3, territorial scopelegislation.gov.uk
- UK GDPR Article 12A, the applicable time periodlegislation.gov.uk
- Keystone privacy policy, updated 7 July 2026Keystone
- Keystone shipping regionsKeystone
- About KeystoneKeystone
How to Send a Letter Online (No Printer, No Post Office)
Last reviewed 10/28/2026.