Sandbox environment: test data only. Codes, balances and orders here have no value.
Topupa Sandbox
Log inSign up

Privacy Policy

This policy explains what Topupa Sandbox collects about you, why, how long we keep it, who processes it for us and the choices you have.

Last updated · Topupa Sandbox is operated by DDT FZCO.

On this page
  1. Who is responsible
  2. What we collect
  3. Why we use it
  4. How codes are protected
  5. Who we share it with
  6. How long we keep it
  7. Your rights
  8. Security
  9. Children
  10. Changes
  11. Contact

Who is responsible

DDT FZCO, 101, A2 Building, Dubai Digital Park, Silicon Oasis, Dubai, AE, is the data controller for Topupa Sandbox. Privacy questions go to support@topupa.com.

What we collect

  • Account details: name, email address, password (stored hashed), country and preferred currency.
  • Orders and wallet: what you bought, when, the price and tax, wallet holds, charges, releases and top-ups, and the delivery email you chose for an order.
  • Reveal records: the time, IP address and browser used each time a code is revealed, so we can investigate a disputed code.
  • Support: the tickets and messages you send us, and any screenshots you attach.
  • Technical: IP address, device and browser information and server logs used for security and to keep the site working.
  • Payment: when you top up by card, our payment provider collects the card details directly. We never see or store your full card number.

Why we use it

  • To run your account, fulfil orders, deliver codes and keep your wallet balance correct (performance of our contract with you).
  • To detect and prevent fraud, abuse and unauthorised access, and to investigate disputed codes (our legitimate interest and legal duties).
  • To calculate tax, keep accounting records and respond to lawful requests (legal obligation).
  • To answer your support requests and tell you about your orders by email (contract). We do not send marketing email unless you opt in, and you can opt out at any time.

How codes are protected

Gift card codes, PINs and voucher links are encrypted before they are stored and are decrypted only when you choose to reveal them. Support staff see a masked reference, not the code. We never ask you for a full code by email, chat or phone, and we never include codes in emails: delivery emails contain a signed link that reveals the code only after you click it.

Who we share it with

We share only what each party needs:

  • Gift card issuer (Bamboo Card Portal): the product, value and quantity you ordered and an order reference, so the code can be issued. The issuer does not receive your name or email.
  • Payment provider (Stripe): your email, the top-up amount and currency, so the card payment can be processed and linked to your wallet.
  • Email delivery: your email address and the content of transactional emails.
  • Hosting and infrastructure: providers that store and process data on our behalf under contract.
  • Authorities and advisers: when the law requires it, to establish or defend legal claims, or to prevent fraud.

We do not sell personal data. Where a processor is outside your country, we rely on contractual safeguards.

How long we keep it

  • Account details: while your account is open, then up to 12 months in case you come back or a dispute arises.
  • Orders, wallet movements, invoices and reveal records: for the period required by tax and accounting law (typically 5 to 10 years), because they are financial records.
  • Support tickets and attachments: 24 months after the ticket is closed.
  • Server and security logs: up to 12 months.

Your rights

Depending on where you live you may have the right to access, correct, delete or export your data, to object to or restrict certain processing, and to complain to a supervisory authority. Email support@topupa.com from your account email and we will respond within the time the law allows. We may need to keep financial records even after you ask us to delete your account.

Security

Data is encrypted in transit; codes are encrypted at rest with a key separate from the database; access to the admin is limited to staff who need it and every sensitive action is audited. No system is perfectly secure, so please use a unique password and tell us at once if you think your account has been accessed by someone else.

Children

Topupa Sandbox is for adults aged 18 and over. We do not knowingly collect data from children; if you believe a child has created an account, contact us and we will remove it.

Changes

We may update this policy. The date above is the current version; material changes are announced on the site.

Contact

support@topupa.com · DDT FZCO, 101, A2 Building, Dubai Digital Park, Silicon Oasis, Dubai, AE.