Legal

Privacy Policy

Effective: 04-Nov-2026 Operator: [Your Company Legal Name]

In short: we collect only what we need to sell and deliver digital gift cards, game-store credit and in-game currency codes, take payment through KPay, keep your account secure and meet our legal obligations. We never sell your personal data, we don't use advertising trackers, and you can download or delete your data from your account at any time.

1. Who we are

This website (giftcodestore.com) is operated by [Your Company Legal Name], trading as GiftCodeStore, registration number [Company Registration No.], registered at [Registered business address], Pakistan (“we”, “us”). We are the controller of the personal data described in this policy. Privacy contact: [email protected].

2. The data we collect

Category	Examples	Source
Account data	Name, email, hashed password, optional mobile wallet number, age and terms confirmations, marketing preference	You
Order data	Items purchased, prices, order number, timestamps, gift recipient name/email and message (if you send a gift)	You
Payment data	KPay transaction reference, payment method (Raast QR, JazzCash or Easypaisa), status, amount, a masked wallet number. For JazzCash and Easypaisa, the mobile number you enter is sent to KPay so the payment request reaches your wallet. We never receive your PIN, OTP, card or bank login.	You and KPay
Usage & delivery data	When codes are revealed, files downloaded, content accessed — used to deliver your purchase and assess refund requests	Our systems
Technical data	IP address, browser user-agent, security and audit logs	Your device
Communications	Messages sent through our contact form or email, refund requests	You

3. Why we use it and our legal bases

To create your account, process orders, take payment and deliver your purchases — necessary to perform our contract with you.
To prevent fraud, money-laundering and abuse (e.g. purchase limits, payment verification, account security) — our legitimate interests and, where applicable, legal obligations.
To keep accounting and tax records — legal obligation.
To provide customer support and handle refunds — contract and legitimate interests.
To send service emails (receipts, delivery, security, pass expiry reminders) — contract.
To send marketing emails — only with your consent, which you can withdraw at any time in Account → Settings or via the unsubscribe link.

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Automated purchase limits may temporarily block an order; you can always contact us for a human review.

4. Who we share it with

KPay and its partner banks/wallets — to process and verify your payments and refunds.
Hosting, database and email-delivery providers acting as our processors under contract.
Gift card Issuers and authorised distributors — limited order details (such as the order number and the code or its serial number) when needed to verify, activate or replace a code. We never ask for, or share, your passwords for Issuer accounts.
Professional advisers (accountants, auditors, lawyers) under confidentiality.
Authorities, regulators or law enforcement when required by law or to protect against fraud.

We do not sell or rent your personal data, and we do not share it with advertisers.

5. International transfers

Our service providers may process data outside Pakistan. Where they do, we use appropriate safeguards such as contractual clauses and providers with recognised security certifications.

6. How long we keep it

Account data — while your account is open. Deleting your account removes your profile immediately.
Order, payment and refund records — for as long as tax and accounting law requires (typically 5–10 years), anonymised where possible after account deletion.
Security and audit logs — up to 12 months.
Contact messages — up to 24 months after the conversation ends.
Session data — up to 14 days of inactivity.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your data, to data portability, and to withdraw consent. You can:

Download your data and delete your account yourself in Account → Privacy & data;
Email [email protected] for any other request. We respond within 30 days and may need to verify your identity.

You also have the right to complain to your local data-protection authority.

8. Security

We use HTTPS throughout, salted password hashing (scrypt), secure HTTP-only cookies, CSRF protection, rate limiting, signed payment notifications, least-privilege admin access and audit logging. Purchased codes are hidden until you choose to reveal them. No method is 100% secure; if we become aware of a breach affecting you we will notify you and the relevant authorities as required by law.

9. Children

Accounts and purchases are only for people aged 18 or over (or the age of majority where they live). We do not knowingly collect personal data from children. If you believe a child has given us data, contact us and we will delete it.

10. Cookies

We use only essential cookies. See our Cookie Policy.

11. Changes

We may update this policy. Material changes will be announced on the site or by email before they take effect. The effective date above shows the current version.

Contact

Questions about this policy? Contact [Your Company Legal Name] (trading as GiftCodeStore), [Registered business address], Pakistan — email [email protected] or call [Support phone] (Mon–Fri, 9:00–18:00).