1.About this notice
1.1This notice explains how we use personal data when you visit niceway.io, use your Niceway account or buy from us.
1.2It is written for the EU General Data Protection Regulation (GDPR) and, for customers in the UK, the UK GDPR and the Data Protection Act 2018.
2.Who is responsible for your data
2.1The controller of your personal data is Al Mashrab Welthandel General Trading LLC, company number 2542307, Sharjah Media City, Sharjah, United Arab Emirates.
2.2For anything about your data, write to [email protected].
2.3We have not appointed a data protection officer, because our activities do not require one under Article 37 of the GDPR. Write to the address above about anything to do with your data.
3.What we collect
| Data | What it includes |
|---|---|
| Account | Your first name, last name, email address and password, your phone number if you add one to your profile, and the two-step sign-in setting if you turn it on. |
| Orders | What you bought, the price, the currency, the time, the delivery status, and the email address for the receipt. |
| Game top-ups | The player ID you enter, and the zone or server where the game asks for one. |
| Payments | The payment result, amount and reference from the payment provider, the type of payment method, and the card brand and last four digits. Never the full card number. |
| Virtual cards | Your cards, their top-ups and transactions. If we have to check your identity, the identity document and the selfie you send us. |
| Visits | Only if you accept all optional cookies: your IP address, browser, the page you opened, the page you came from, and any campaign or referral code in the link. |
| Messages | What you write to us, and our replies. |
3.1We do not use analytics or marketing cookies at the moment. If we start, we will ask for your consent first. The cookie policy lists every cookie we use.
4.Why we use it and our legal basis
4.1We use each kind of data only for the purposes below. The legal basis is the one the GDPR gives for that purpose.
| Purpose | Legal basis |
|---|---|
| Open and run your account | Contract (Article 6(1)(b)) |
| Take payment, deliver your order and send receipts | Contract (Article 6(1)(b)) |
| Keep accounting and tax records | Legal obligation (Article 6(1)(c)) |
| Verify your identity for virtual cards and run anti-money laundering checks | Legal obligation (Article 6(1)(c)), under anti-money laundering law that applies to us or to the card issuer |
| Prevent fraud and keep the service secure | Legitimate interests (Article 6(1)(f)) |
| Count where visitors come from, with partner and campaign cookies and a record of the visit | Consent (Article 6(1)(a)), given in Cookie settings |
| Credit a partner when you sign up through the partner’s link | Legitimate interests (Article 6(1)(f)) |
| Answer your questions and complaints | Contract or legitimate interests (Article 6(1)(b) or (f)) |
| Optional analytics and marketing cookies | Consent (Article 6(1)(a)) |
4.2Where we rely on legitimate interests, our interests are running a safe service, stopping fraud and knowing which partners and campaigns bring customers. You can object to this use at any time (see Your rights).
5.Who we share it with
5.1We share personal data only with the companies that help us provide the service, and only what each one needs.
| Recipient | Why |
|---|---|
| Our hosting provider, with servers in Germany | Runs the site, your account and our database |
| Payment providers | Take your payments and refunds |
| Our eSIM supplier | Issues your eSIM and its data plan |
| Gift card and game top-up suppliers | Issue your code or send your top-up |
| Our licensed partner card issuer in Singapore | Issues and runs your virtual card under its own licence |
| An identity verification provider | Checks your identity, only when we have to ask for an ID document |
| Our email delivery provider | Sends receipts, codes and account emails |
| Authorities and courts | When the law requires it, for example for tax or fraud investigations |
5.2The card issuer is a separate controller for your card and its transactions. Its own privacy notice applies to them.
6.Transfers outside the UK and the EEA
6.1We are based in the United Arab Emirates, so your data is processed there. Our servers are in Germany. The card issuer processes card data in Singapore, and some of our suppliers and payment providers process data in other countries, such as the United States.
6.2Where a country does not have an adequacy decision from the European Commission or the UK, we protect the transfer with the European Commission’s standard contractual clauses and, for data from the UK, the UK International Data Transfer Addendum. You can ask us for a copy.
7.How long we keep it
| Data | How long |
|---|---|
| Account | While your account is open, then 5 years after you close it |
| Orders and invoices | 7 years after the end of the financial year, as tax law requires |
| Identity checks and card transactions | 5 years after our relationship ends, as anti-money laundering law requires |
| Visits and security logs | 12 months |
| Messages to support | 3 years after the conversation ends |
7.1When a period ends, we delete the data or make it anonymous.
8.Your rights
8.1You have the right to ask for a copy of your data, to have it corrected, and to have it deleted when we no longer need it.
8.2You can ask us to restrict how we use your data, and to give you the data you provided in a format other services can read.
8.3You can object at any time to uses based on legitimate interests. Where you gave consent, you can withdraw it at any time; this does not affect what we did before.
8.4We do not make decisions with legal or similarly significant effects about you by automated means alone. Automatic fraud checks can hold a payment for review; a person then decides, and you can ask for that decision to be explained and reconsidered.
8.5To use any of these rights, write to [email protected]. We reply within one month. If a request is complex, we may need two more months, and we tell you within the first month.
9.Complaints to a data protection authority
9.1You can complain to the data protection authority in the EU country where you live or work, or where you think the problem happened. In the UK, the authority is the Information Commissioner’s Office.
9.2Because we have no establishment in the EU, we do not have a single lead supervisory authority, and you can go to the authority in your own country. We would like the chance to put things right first, so please write to us too.
10.Do you have to give us your data
10.1We need your name and email address to open an account, and the details of an order to deliver it. Without them we cannot provide the service.
10.2You do not need to send documents to get a virtual card. If the law requires an identity check, or a payment looks unusual, we ask for an ID document, and without it we cannot keep providing the card.
11.Data we receive from others
11.1Payment providers tell us whether a payment went through. Our suppliers tell us when an eSIM, a code or a top-up has been delivered, or that a game has rejected a top-up.
11.2For virtual cards, the card issuer tells us about your card and its transactions. If we ask you to verify your identity, the verification provider tells us the result.
12.Changes to this notice
12.1When we change this notice, we publish the new version here with its date. If a change affects how we use your data, we tell you by email first.