Privacy Policy
This policy explains what Topupa collects about you, why, how long we keep it, who processes it for us and the choices you have.
Last updated · Topupa is operated by DDT FZCO.
On this page
Who is responsible
DDT FZCO, 101, A2 Building, Dubai Digital Park, Silicon Oasis, Dubai, AE, is the data controller for Topupa. Privacy questions go to support@topupa.com.
What we collect
- Account details: name, email address, password (stored hashed), country and preferred currency.
- Orders and wallet: what you bought, when, the price and tax, wallet holds, charges, releases and top-ups, and the delivery email you chose for an order.
- Reveal records: the time, IP address and browser used each time a code is revealed, so we can investigate a disputed code.
- Support: the tickets and messages you send us.
- Technical: IP address, device and browser information and server logs used for security and to keep the site working.
- Payment: when you top up by card, our payment provider collects the card details directly. We never see or store your full card number.
Why we use it
- To run your account, fulfil orders, deliver codes and keep your wallet balance correct (performance of our contract with you).
- To detect and prevent fraud, abuse and unauthorised access, and to investigate disputed codes (our legitimate interest and legal duties).
- To calculate tax, keep accounting records and respond to lawful requests (legal obligation).
- To answer your support requests and tell you about your orders by email (contract). We do not send marketing email unless you opt in, and you can opt out at any time.
How codes are protected
Gift card codes, PINs and voucher links are encrypted before they are stored and are decrypted only when you choose to reveal them. Support staff see a masked reference, not the code. We never ask you for a full code by email, chat or phone, and we never include codes in emails: delivery emails contain a signed link that reveals the code only after you click it.
Who we share it with
We share only what each party needs:
- Gift card issuer (Bamboo Card Portal): the product, value and quantity you ordered and an order reference, so the code can be issued. The issuer does not receive your name or email.
- Payment provider (Stripe): your email, the top-up amount and currency, so the card payment can be processed and linked to your wallet.
- Spam protection (Cloudflare Turnstile): when you use the contact, log in or forgotten password forms, your IP address and basic browser signals, so automated abuse can be told apart from real people.
- Email delivery: your email address and the content of transactional emails.
- Hosting and infrastructure: providers that store and process data on our behalf under contract.
- Authorities and advisers: when the law requires it, to establish or defend legal claims, or to prevent fraud.
We do not sell personal data. Where a processor is outside your country, we rely on contractual safeguards.
How long we keep it
- Account details: while your account is open, then up to 12 months in case you come back or a dispute arises.
- Orders, wallet movements, invoices and reveal records: for the period required by tax and accounting law (typically 5 to 10 years), because they are financial records.
- Support tickets, and any files sent with them in the past: 24 months after the ticket is closed.
- Server and security logs: up to 12 months.
Your rights
Depending on where you live you may have the right to access, correct, delete or export your data, to object to or restrict certain processing, and to complain to a supervisory authority. Email support@topupa.com from your account email and we will respond within the time the law allows. We may need to keep financial records even after you ask us to delete your account.
Security
Data is encrypted in transit; codes are encrypted at rest with a key separate from the database; access to the admin is limited to staff who need it and every sensitive action is audited. No system is perfectly secure, so please use a unique password and tell us at once if you think your account has been accessed by someone else.
Children
Topupa is for adults aged 18 and over. We do not knowingly collect data from children; if you believe a child has created an account, contact us and we will remove it.
Changes
We may update this policy. The date above is the current version; material changes are announced on the site.
Contact
support@topupa.com · DDT FZCO, 101, A2 Building, Dubai Digital Park, Silicon Oasis, Dubai, AE.