Privacy Policy

1. Purpose and scope

This Privacy Policy explains how SKINSITIM OÜ, company number 17578269, trading as TopUpGuy, processes personal data when you browse the site, create an account, place or receive a mobile top-up, contact support, use a business integration, apply to work with us or otherwise interact with the service.

It is written to provide the information required by Articles 12 to 14 of Regulation (EU) 2016/679 (EU GDPR), the UK GDPR as supplemented by the Data Protection Act 2018, and related privacy and electronic-communications rules. Product-specific or jurisdiction-specific notices may supplement this Policy.

Personal data means information relating to an identified or identifiable natural person. Anonymous information that cannot reasonably identify a person is not personal data.

2. Controller and contact

SKINSITIM OÜ is the sole data controller operating TopUpGuy for account, checkout, customer-support, fraud-prevention, marketing and product-improvement processing that it determines. SKINSITIM OÜ is an Estonian private limited company with company number 17578269.

Privacy questions and data-subject requests may be sent to privacy@topupguy.com. Formal legal notices may be sent to legal@topupguy.com or by post to SKINSITIM OÜ at its registered office: Estonia, Harju maakond, Tallinn, Kesklinna linnaosa, Rotermanni tn 6, 10111.

Payment providers, identity-verification providers and mobile operators may act as independent controllers for processing they determine, such as payment authorisation, statutory customer due diligence or management of the recipient mobile account. Their notices govern that processing.

3. Data we collect from users

Account and profile data may include name, email address, telephone number, authentication identifiers, language, country, account settings, saved-recipient labels and communication preferences.

Order data may include source and destination country, operator, recipient mobile number, product, amount, currency, fee, exchange-rate record, order reference, timestamps, delivery status, refund and dispute information.

Payment-related data may include billing name and address, payment-method type, issuer country, limited card metadata such as brand and last four digits, payment token, authentication outcome and provider references. TopUpGuy should not store complete card numbers or card security codes.

Support and relationship data may include correspondence, call or chat records where enabled, attachments, complaint details, survey responses, business-contact information, employment-application information and notes needed to investigate or respond.

Technical data may include IP address, device and browser attributes, operating system, language, time zone, identifiers, cookie or local-storage data, login events, referral URL, pages viewed, interaction logs, crash information and security telemetry.

4. Recipient data and data supplied by another person

A sender may provide a recipient mobile number, country, operator and optional name or message. The sender must have a lawful reason to provide that information and must not use TopUpGuy to harass, monitor or target a recipient.

We use recipient data to validate compatibility, deliver the requested product, provide order support, prevent fraud, meet legal obligations and maintain transaction records. A recipient does not need a TopUpGuy account.

If you receive a top-up and want to understand or object to processing, contact privacy@topupguy.com. We may need an order reference, the relevant number and proportionate evidence that you control it. We will not disclose the sender identity where doing so would violate law, another person’s rights or a legitimate security need.

5. Sources of personal data

We obtain data directly from users and recipients; from mobile operators, aggregators and catalogue partners; from payment, identity, fraud and authentication providers; from support and communications providers; from business customers using the API; and from public authorities or lawful public sources where necessary.

We may derive risk indicators, approximate location, device reputation, likely operator, order patterns and account-security signals from data collected. We do not treat an inferred risk score as proof of unlawful conduct.

6. Purposes and lawful bases

We process account, recipient, order and support data to take steps at your request, perform the contract, deliver products, communicate status, process payment, provide receipts, investigate failures and administer refunds. The lawful basis is performance of a contract or steps before entering one.

We process records for tax, accounting, consumer-protection, sanctions, anti-money-laundering, law-enforcement response and other duties where necessary to comply with a legal obligation.

We process device, order, payment and behavioural signals to prevent fraud, protect users and systems, enforce service rules, defend legal claims, improve reliability, understand aggregate product performance and communicate with business contacts. The lawful basis is our legitimate interests or those of another party, balanced against the rights and expectations of affected people.

We use consent where the law requires it, including for non-essential storage technologies, certain direct marketing, optional profile information or another clearly identified purpose. Consent may be withdrawn at any time without affecting earlier lawful processing.

We may process data to protect vital interests in a genuine emergency and for the establishment, exercise or defence of legal claims. Special-category or criminal-offence data is not intentionally requested through ordinary checkout and is processed only where a specific legal condition permits it.

7. Fraud screening and automated tools

We use rules, device signals, payment-provider outputs, velocity checks, account history, location inconsistencies and sanctions data to identify activity requiring rejection or human review.

A tool may automatically pause or reject a transaction where the risk is clearly outside permitted thresholds. Where Article 22 EU GDPR or UK GDPR applies to a decision producing legal or similarly significant effects, we will provide safeguards required by law, which may include the ability to request human review, express your view and contest an error.

We do not publish security thresholds or provide information that would enable evasion. This does not prevent us from giving a meaningful explanation of the main factors where law requires it.

8. Who receives personal data

We disclose the minimum necessary data to mobile operators, airtime aggregators and fulfilment partners; payment processors, acquiring banks and authentication providers; cloud hosting, database, security, observability and customer-support providers; email, SMS and communications providers; identity, fraud, sanctions and compliance providers; professional advisers, auditors and insurers; and competent authorities where lawfully required.

A business customer may receive order and recipient status for orders it validly submits. We require appropriate contractual, confidentiality, security and data-protection commitments from processors. Independent controllers remain responsible for their own legal basis and notice.

If TopUpGuy is involved in a merger, financing, reorganisation or asset sale, relevant data may be disclosed under confidentiality and transferred subject to continuity of privacy protections and applicable law.

9. International transfers

Global top-up delivery can require personal data to move outside the United Kingdom, European Union or European Economic Area, including to the destination operator’s country. Data-protection standards may differ.

Where transfer restrictions apply, we use an available lawful mechanism such as an adequacy decision, European Commission Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, binding corporate rules where applicable, or a limited statutory derogation. We assess transfer risks and apply supplementary contractual, organisational or technical measures where appropriate.

You may request information about the transfer mechanism relevant to your data. Commercially sensitive and third-party confidential provisions may be redacted.

10. Retention

We keep personal data only for as long as needed for the relevant purpose, including delivery, account administration, support, security, tax, audit, fraud prevention, disputes and legal obligations.

Indicative periods are: active account data for the account lifetime and a reasonable closure period; order, payment-reference, refund and accounting records generally for six to ten years depending on applicable tax, contract and financial-crime rules; support records generally for three years after closure unless tied to a longer dispute; unsuccessful verification material for a shorter risk-based period; security logs typically from several months to two years; and marketing preferences until withdrawal plus a suppression record needed to respect the choice.

Actual periods may be shorter or longer where law, litigation hold, an authority request, unresolved complaint, fraud pattern or technical backup cycle requires it. Data is deleted, anonymised or access-restricted when the retention purpose ends.

11. Security

We use proportionate technical and organisational measures intended to protect confidentiality, integrity and availability. Measures may include encryption in transit, access control, least privilege, authentication, environment separation, logging, monitoring, vendor review, secure development, incident response and backup controls.

No internet service is completely secure. Users must protect credentials and devices and report suspected compromise. We will assess personal-data breaches and notify affected people and supervisory authorities where the applicable legal threshold is met.

12. Your rights

Depending on applicable law, you may request access to personal data; correction of inaccurate data; deletion; restriction; portability of data you provided; objection to processing based on legitimate interests; objection to direct marketing; withdrawal of consent; and safeguards relating to qualifying automated decisions.

Rights are not absolute. We may retain or withhold data where necessary for another person’s rights, legal privilege, fraud prevention, transaction records, tax, regulatory duties, claims or another lawful exemption. We will explain a refusal unless law prevents that explanation.

Send requests to privacy@topupguy.com. We may verify identity and authority proportionately. Under EU and UK GDPR we normally respond without undue delay and within one month, subject to a lawful extension for complexity or volume. Requests are ordinarily free, but manifestly unfounded or excessive requests may be handled as law permits.

13. Marketing and communications

Service messages about security, orders, receipts, policy changes and account administration are not marketing and may be sent where needed to perform the contract or protect the service.

Promotional email, SMS or similar messages are sent with consent where required by the Privacy and Electronic Communications Regulations 2003, Directive 2002/58/EC as implemented locally, or other direct-marketing law. A limited existing-customer exception may be used only where lawful and with a clear opt-out.

You can unsubscribe through the message or account settings. We retain a minimal suppression record so that the opt-out is respected.

14. Cookies and similar technologies

We use essential cookies or similar storage for authentication, security, load balancing, session continuity and privacy preferences. Non-essential analytics, advertising or personalisation technologies require the consent required by applicable law and must remain disabled before valid consent.

The Cookie Policy describes categories, choices, retention and browser controls. Rejecting non-essential technologies must not prevent access to the core service.

15. Children

TopUpGuy is not directed to children and users placing orders must be at least 18. A recipient may be younger because a parent, guardian or other adult sends airtime to that number; we use the recipient number only for the delivery and related purposes described here.

If you believe a child provided account or payment data directly without appropriate authority, contact privacy@topupguy.com.

16. Complaints and supervisory authorities

Please contact privacy@topupguy.com first so we can investigate. You also have the right to complain to the supervisory authority in the country of your habitual residence, place of work or alleged infringement under EU GDPR.

SKINSITIM OÜ’s lead supervisory authority in Estonia is the Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate), subject to the EU GDPR cooperation and consistency mechanisms. In the United Kingdom, the supervisory authority is the Information Commissioner’s Office. Using an authority complaint route does not remove any right to seek a judicial remedy.

17. Changes to this Policy

We may update this Policy when services, vendors, law or processing practices change. The current date appears at the top. Material changes will be highlighted or communicated where required.

A change does not retrospectively create a new lawful basis. Where fresh consent is required, we will ask for it before the new processing begins.