Privacy Policy

Privacy Policy for Giftcardrefill Status: October 6, 2026 1. Controller and Contact Responsible for processing personal data when operating giftcardrefill.com is: AplasTech L.P Kosta Varnali 11 Trilofos 57500 Thermi Greece ELGEMI: 196570906000 Email: support@giftcardrefill.com Giftcardrefill is an online shop for digital gift cards, prepaid products, and voucher codes. This privacy policy explains the processing of your data when visiting our website, using a customer account, purchasing our products, and contacting us. 2. Website Visit and Technical Data When accessing the website, technical information is processed, in particular IP address, time and requested page, browser and device information, as well as technical error and security messages. This information is used to provide the website, analyze errors, and protect against misuse and unauthorized access. To select a suitable shop region, we may consider the country derived from the IP address and the language settings transmitted by the browser. You can change language, country, and currency yourself. Such country assignment is not an exact location determination. Processing for the secure provision of the website is based on our legitimate interest in a functioning and protected online shop pursuant to Art. 6 para. 1 lit. f GDPR. 3. Cookies and Local Storage We use cookies and comparable storage functions for login and session, shopping cart, security functions, as well as chosen language, country, currency, and display settings. Information may also be stored in your browser's local storage. Technically necessary storages serve to provide the functions you request. For access beyond this to your device, your prior consent is required if legally necessary. The legal bases for the subsequent processing of personal data depend on the purpose and are Art. 6 para. 1 lit. b, lit. f, or lit. a GDPR. You can delete or restrict cookies and local storages via your browser settings. This may affect login, shopping cart, and saved settings. 4. Customer Account and Login with Google When registering and using a customer account, we process in particular your email address, the profile and contact data you provide, login information, and orders associated with your account. Passwords are stored as non-directly readable password hashes. For email confirmation and password reset, we process the necessary confirmation data. To secure accounts, login attempts, session information, browser data, and pseudonymized IP identifiers may be processed. If you choose login with Google, we receive the information released for login, in particular a Google account identifier, your confirmed email address, and optionally your name. We do not receive your Google password. Google's own processing is governed by its privacy policy: https://policies.google.com/privacy?hl=de Provision of the customer account is pursuant to Art. 6 para. 1 lit. b GDPR. Security measures additionally rely on Art. 6 para. 1 lit. f GDPR. 5. Orders, Invoices, and Digital Delivery For purchase and delivery of digital products, we process in particular name, email address, billing address and country if applicable, ordered products, amounts and currency, order number, payment status, as well as delivery and invoice information. Depending on usage, discount codes, bonus, or cashback data are also processed. Digital codes are delivered to the email address provided for the order. We store code and delivery information required for order processing as well as shipping status, times, and where applicable, technical delivery proofs. These data also support repeat deliveries, complaint handling, and proof of contract fulfillment. To procure and provide digital products, we cooperate with product suppliers such as PrepaidForge and Relograde. Data are only passed to such partners as far as necessary for the respective processing. Processing for order fulfillment is based on Art. 6 para. 1 lit. b GDPR. Legally required invoice and accounting data are processed according to Art. 6 para. 1 lit. c GDPR. Securing delivery proofs and handling disputes may rely on Art. 6 para. 1 lit. f GDPR. 6. Payments Available payment methods are shown at checkout. If you choose PayPal or a card payment via PayPal, order and transaction data required for payment processing are exchanged with PayPal. Card data are processed within the secure input fields of the payment provider; we do not store complete card numbers or security codes. We receive payment status information and, depending on payment method, further payment, address, and security data such as transaction IDs, status of a 3-D-Secure check, or seller protection details. PayPal processes data also for own legal and security-related purposes. More information: https://www.paypal.com/de/legalhub/paypal/privacy-full When using other payment services offered at checkout, required data are transmitted to the selected provider. Their privacy notices must also be observed. Legal bases are Art. 6 para. 1 lit. b GDPR for payment processing, Art. 6 para. 1 lit. c GDPR for legal obligations, and Art. 6 para. 1 lit. f GDPR for abuse prevention and handling payment disputes. 7. Fraud Prevention and Identity Verification To protect against account takeovers, unauthorized payments, and misuse, we check security features. This may include order amount and frequency, previous payment attempts, account and device identifiers, IP-related indications, country or address discrepancies, and verification results transmitted by the payment provider. For detection of VPN, proxy, or similar connections, the IP address may be transmitted to vpnapi.io. Security rules can lead to risk classification, additional verification, or interruption of the order or payment process. In case of required identity verification, we process requested information and documents, e.g., ID proof, address, and possibly a selfie for assigning the proof. Prior verifications and their status can be considered in later orders. This processing serves our legitimate interest in protecting customers and the company from fraud and financial damage, pursuant to Art. 6 para. 1 lit. f GDPR. Where a specific legal identification obligation exists, corresponding processing is pursuant to Art. 6 para. 1 lit. c GDPR. If you have questions or objections regarding a security decision, contact us at support@giftcardrefill.com. To the extent the conditions of Art. 22 GDPR apply, statutory protections in solely automated decisions apply, including a human review, possibility to present your position, and contest the decision. 8. Support, Reviews, and Notifications If you contact us or create a support ticket, we process your contact details, messages, attachments if any, and related order information. Processing serves handling your request and is based depending on context on Art. 6 para. 1 lit. b or lit. f GDPR. For product reviews you submit, we process review text, star rating, time, and assignment to the relevant purchase. Approved reviews and the display name provided may be publicly visible. Your email address and confidential order data are excluded from the public review. Processing serves providing the review function you use under Art. 6 para. 1 lit. b GDPR; moderation and abuse checks are based on Art. 6 para. 1 lit. f GDPR. Necessary emails for registration, orders, delivery, or account security serve our service provision. If you enable web push, we process the technical push address and browser data required for delivery. Transmission occurs via your browser's push service and may concern completed orders or support messages. Voluntary push delivery is based on your consent under Art. 6 para. 1 lit. a GDPR. You may revoke authorization in your browser anytime. If an external Trustpilot widget is embedded and loaded on a page, technical data such as IP address and browser information may be transmitted to Trustpilot. Trustpilot's privacy policy applies: https://corporate.trustpilot.com/legal/for-businesses/privacy-policy/jan-2026. Mere linking loads the external offer only when you click the link. If consent is required for embedding, it must be obtained before loading. 9. Google and AI Tools in the Administration Area Authorized administrators may use Google Ads and Google Search Console for keyword research and analysis of our website. This includes processing keyword ideas, search volume estimates, search queries, clicks, and impressions. Google access credentials are stored server-side securely; we do not receive the administrator’s Google password. For creation and translation of editorial texts, administrators may transmit selected keywords, existing shop texts, and product information to the OpenAI API. Contents serve to create and review editorial drafts. This editorial function is separate from security checks for customers and payments. Personal data should not be unnecessarily entered in editorial input fields. If personal data are processed in these operations, this serves our legitimate interest in shop management, analysis, and editorial maintenance under Art. 6 para. 1 lit. f GDPR. Necessary consent is obtained separately. More information from providers: https://policies.google.com/privacy?hl=de and https://openai.com/policies/data-processing-addendum/ 10. Recipients and Processing Outside the EEA Data may, as necessary, be transmitted to technical operations and hosting service providers, email and push services, payment providers, product suppliers, security providers, and legal or tax consultants. Authorities receive data when legally obligated. Depending on the service used, processing outside the European Economic Area may occur. For such transfers, conditions of Chapter V GDPR must be met, e.g., a valid adequacy decision or appropriate safeguards like EU standard contractual clauses. Information on recipients and transfer bases in the specific case can be requested at support@giftcardrefill.com. 11. Storage Duration and Data Provision Storage duration depends on the respective purpose. Account data are needed for account management; order and delivery data for processing, complaints, and possible legal claims. Invoice and accounting documents are subject to applicable statutory retention periods. Security and identity data must not be stored indefinitely solely as a precaution; relevant are the specific verification purposes, necessary evidence, and possible legal obligations. Deleting a customer account does not necessarily lead to immediate deletion of all order or invoice data. If data are further needed due to legal obligations or open claims, processing remains limited to these purposes. Information on applicable retention criteria can be requested. Required data queried for registration, order, payment, and delivery are necessary for the respective functions. Without these data, we cannot provide the respective service. Required security checks may be a prerequisite for continuing an order. Voluntary information is marked accordingly or results from optional functions. 12. Your Rights Under the GDPR, you have the right to access, correction, deletion, restriction of processing, and data portability. You may revoke given consent for the future; the lawfulness of processing until revocation remains unaffected. If processing is based on legitimate interests, you may object for reasons related to your particular situation. You may object to processing for direct marketing at any time. For privacy inquiries, please write to support@giftcardrefill.com. To prevent unauthorized data disclosure, we may require reasonable proof of identity. You may also complain to a data protection authority, especially at your place of residence, workplace, or where the alleged violation occurred. For Greece, this is the Hellenic Data Protection Authority: https://www.dpa.gr/ 13. Changes We adjust this privacy policy when our functions, used services, or legal requirements change. The current version and its status are published on this page.