Privacy policy

01Overview

PexyCard Digital Ltd. ("PexyCard", "we", "us") operates https://pexycard.com. This policy explains what personal data we collect when you browse the site or buy a gift card, why we collect it, how long we keep it and what you can ask us to do with it.

We collect as little as we can get away with. You do not need an account to buy from us, and we do not sell or rent personal data to anyone.

02Data we collect

Depending on how you use the site, we may hold the following:

• Order data — the email address you give us for delivery, the cards and denominations you bought, the amount paid and the payment method.
• Payment data — a transaction reference from our card processor, or the public wallet address and transaction hash for a crypto payment. We never receive or store full card numbers.
• Communications — the contents of messages you send us through the contact form or by email, along with your reply address.
• Technical data — IP address, browser type and pages visited, used for security, fraud prevention and aggregate analytics.
• Preferences stored in your browser — your basket contents and whether you have used the first-order discount. These are held in local storage on your device, not on our servers.

03How we use it

• To fulfil your order: issuing gift card codes and delivering them to the address you gave us.
• To provide support: answering questions, resending codes and processing refunds.
• To prevent fraud: gift cards are a common target for stolen payment credentials, so we screen orders and may pause one for manual review.
• To meet legal obligations: keeping transaction records for tax, accounting and anti-money-laundering requirements.
• To improve the service: understanding, in aggregate, which brands people look for and where checkout goes wrong.

04Legal bases for processing

Where the UK GDPR or EU GDPR applies, we rely on the following bases: performance of a contract (fulfilling your order and providing support); legal obligation (tax and financial record keeping); and legitimate interests (fraud prevention, service security and product improvement, balanced against your rights).

Where we rely on consent — for example, marketing email — you can withdraw it at any time without affecting anything that happened before you did.

05Who we share data with

We share the minimum necessary with the following recipients. Each processor we appoint is bound by contract to use the data only on our instructions; public blockchains are not, which is why the first item below works differently from the rest:

• Blockchain networks, which record the crypto payment you send. Transactions on a public chain are permanent and visible to anyone.
• Gift card distributors, to issue the codes you have purchased.
• Email delivery providers, to send your codes, receipts and support replies.
• Infrastructure and analytics providers who host the site and help us keep it running.
• Law enforcement or regulators, where we are legally required to respond to a valid request.

06How long we keep it

• Order and payment records: seven years, as required for financial record keeping.
• Support correspondence: two years from the last message in the thread.
• Technical and security logs: twelve months.
• Browser storage on your device: until you clear your browser data — you control this entirely.

07Your rights

Subject to local law, you can ask us to give you a copy of the data we hold about you, correct it if it is wrong, delete it, restrict how we use it, or object to processing based on legitimate interests. You can also ask for your data in a portable format.

Send any request to support@pexycard.com and we will respond within 30 days. If you are not satisfied with our response, you have the right to complain to your local data protection authority.

08Cookies and local storage

PexyCard uses browser local storage to remember your basket and whether the first-order discount has been used. This is functional storage on your own device, it is not shared with us or with third parties, and clearing your browser data removes it.

Any analytics or advertising cookies would be set only with your consent, and would be listed here before being introduced.

09Security

The site is served over TLS. PexyCard is crypto-only, so there is no bank or card data to store in the first place. Wallet payments are signed on your own device — we never ask for, and can never receive, a seed phrase or private key. For deposit coins we only ever see the public address and the transaction hash.

No system is perfect. If we discover a breach affecting your personal data, we will notify you and the relevant regulator as required by law.

10Children

PexyCard is not directed at children under 16 and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, contact us and we will delete it.

11Changes to this policy

We update this policy when our practices change. The date at the top of this page always reflects the current version, and material changes will be announced on the site. Questions go to support@pexycard.com.