1. Introduction
This policy explains how [LEGAL ENTITY NAME], trading as XPwinz ("we", "us"), handles your personal data when you visit our site or buy from us. We are the data controller for that data.
We keep this simple on purpose: we collect what we need to sell you a code and support you afterwards, and nothing we can't justify.
We never sell your personal data.We don't see or store your full card number — that stays with our payment processor.
2. What we collect
We collect this when you create an account, place an order, contact support, subscribe to our newsletter, or simply browse the site.
3. How we use your data
- To deliver your order — issuing your code and emailing it to you.
- To support you — answering questions and resolving problems with codes.
- To take payment — processing transactions and handling refunds and chargebacks.
- To prevent fraud — detecting stolen cards, abuse of promotions, and reseller fraud.
- To improve the store — understanding which products and pages people actually use.
- To market to you — sending deals and offers, but only where you have opted in.
- To meet legal duties — tax, accounting, and responding to lawful requests.
Marketing email is opt-in, and every message has a one-click unsubscribe. Unsubscribing never affects order or support emails, which you receive because they are necessary to your purchase.
4. Legal basis for processing
Where data protection law (such as the GDPR) applies to you, we rely on:
| Purpose | Legal basis |
|---|---|
| Delivering your order and supporting it | Performance of a contract |
| Fraud prevention and site security | Legitimate interests |
| Analytics and product improvement | Legitimate interests / consent |
| Marketing emails | Consent |
| Keeping tax and accounting records | Legal obligation |
7. International transfers
Some of our providers operate outside [YOUR COUNTRY], so your data may be transferred abroad. Where it is, we rely on appropriate safeguards — such as standard contractual clauses or an adequacy decision — to make sure it stays protected to the same standard.
8. How long we keep your data
| Data | Retention period |
|---|---|
| Account data | While your account is open, then [X] months after closure |
| Order and invoice records | [X] years — required by tax and accounting law |
| Support conversations | [X] months after the ticket is closed |
| Analytics data | [X] months, usually aggregated or anonymised |
| Fraud-prevention records | [X] years, to protect against repeat abuse |
When a retention period ends, we delete the data or anonymise it so it can no longer identify you.
9. How we protect your data
- All traffic is encrypted in transit using HTTPS/TLS.
- Passwords are stored hashed, never in readable form.
- Access to customer data is limited to staff who need it, and is logged.
- Card data is handled by a PCI-DSS compliant payment provider — it never touches our servers.
No system is perfectly secure, so we can't guarantee absolute security. If a breach ever affects your rights, we will notify you and the relevant regulator as the law requires.
10. Your rights
Depending on where you live, you may have the right to:
- Access — get a copy of the data we hold about you;
- Rectification — have inaccurate data corrected;
- Erasure— ask us to delete your data ("right to be forgotten");
- Restriction — ask us to pause processing while a dispute is resolved;
- Portability — receive your data in a machine-readable format;
- Objection — object to processing based on legitimate interests;
- Withdraw consent — at any time, without affecting past processing;
- Complain — to your local data protection authority.
To exercise any of these, email privacy@xpwinz.com. We will respond within 30 days and may ask you to verify your identity first. Some data — such as invoices — must be kept even after an erasure request, because the law requires it.
11. Children's privacy
XPwinz is not intended for children under 18, and we do not knowingly collect their data. If you believe a child has provided us with personal data, contact us and we will delete it promptly.
12. Changes to this policy
We may update this policy as our services or the law change. The "last updated" date above always reflects the current version, and we will notify you of material changes by email or a notice on the site.
13. Contact us
Questions about your data, or want to exercise a right?
Postal address: [REGISTERED ADDRESS].