Privacy Policy

This Privacy Policy describes which personal data Top-up Harbor (topupharbor.nl and topupharbor.com) processes when you use the website, create an account, place an order or contact us, why we do so, with whom we share data and how long we keep it.

1. Who is responsible for your data

Top-up Harbor is a sole proprietorship and the controller ("we", "us"). Chamber of Commerce (KVK) number 42167382, VAT ID NL005551549B56. Postal address: Begijnstraat 6, 4871 EH Etten-Leur, the Netherlands (no visiting address). For privacy questions and to exercise your rights, email info@topupharbor.com.

2. Which data we process, why and on what legal basis

2.1 Visiting the website

• Data: your IP address, date and time, the requested page, the status code, your browser type and the referring page (technical server logs). We determine your language from your browser's language setting and from your own choice; we do not determine your location from your IP address.
• Rate limiting: to prevent abuse of login, order and other forms we store a hashed form of your IP address or customer number (an HMAC with a secret key, which cannot be converted back to your IP address or customer number) together with the route accessed and a counter.
• Purpose: keeping the website running and protecting it against abuse. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).
• Retention: server logs 14 days; hashed counters at most a few days (see section 5).
• Third parties: our pages load fonts, images and scripts from our own server. No fonts, scripts, analytics or advertising services of third parties are loaded. You only open WhatsApp if you click the WhatsApp button yourself (see 2.9).

2.2 Account and logging in

• Data: email address, your Player ID (Governor ID, 19 digits; mandatory when creating an account), your language, the time you accepted the terms and your last login time. For every successful login we record the time, the network part of your IP address (for IPv4 the first three numbers, for IPv6 the first three blocks) and the browser type.
• Logging in: without a password, using a one-time login link sent by email. The link is valid for 15 minutes and is stored by us only as a one-way hash. Your session ends after 15 minutes of inactivity.
• Purpose: account, access to your orders, security of your account. Legal basis: performance of the contract (Art. 6(1)(b)) and our legitimate interest in security (point f).
• Retention: the account for as long as you use it and afterwards at most 24 months without an order or login; expired login links 7 days after expiry; login history (network part of the IP address, browser type) 12 months.

2.3 Order

• Data: email address, Player ID and server/zone (if provided), your name as you enter it, your country, product, quantity, amount, currency, language, chosen payment method, the language in which you ordered, the text and time of the consents you gave (terms and conditions, age, immediate delivery of digital content with loss of the right of withdrawal), the version of the terms and of this privacy policy that you saw, the network part of your IP address (for IPv4 the first three numbers, for IPv6 the first three blocks) and your browser type at the moment of consent, and any remarks.
• Purpose: performing and delivering your order, linking the payment to your order, VAT and bookkeeping, and being able to show what was agreed and which text you consented to. Legal basis: performance of the contract (point b), legal obligation for bookkeeping and VAT (point c) and our legitimate interest in evidence and fraud prevention (point f).
• Retention: the order at most 7 years (tax retention obligation, or longer where the law requires); the network part of the IP address and the browser type 12 months, the period in which a payment is usually disputed.
• IP country as VAT evidence: when you place your order, we use a database on our own server to determine which country your IP address comes from. Only the country code and the version of the database are recorded with the order; your IP address is not sent to anyone for this and is not stored for this. The network part of your IP address that we record when you consent to your order (see above) is a separate data item with its own purpose and retention period and is independent of the IP country. The IP country is extra evidence of which VAT rules apply, besides the country you state and the country of the bank or card you pay with. Purpose: VAT records and fraud prevention. Legal basis: legal obligation (point c) and our legitimate interest (point f). Retention: the country code 7 years, together with the order (tax retention obligation); 10 years once the VAT One-Stop Shop (OSS) applies to us (2027). If the country differs from the one you stated (for example because of a VPN) and that country has no Dutch VAT, we check the order manually before we deliver. Attribution: IP Geolocation by DB-IP (db-ip.com), licence CC BY 4.0.

2.4 Payment

• You can pay with a Tikkie (ABN AMRO) or by bank transfer to our business account. We do not process card details ourselves.
• Tikkie: we send ABN AMRO the amount, a description ("Top-up Harbor" with our order number), an expiry date and a reference. We do not send your name or email address. After payment we receive from ABN AMRO the payment status and the name and account number (IBAN) of the payer.
• Bank transfer: you transfer the amount to our business account. We then see name, IBAN, amount and description on our bank account.
• Check: we compare the payer's name with the name you gave with your order. A difference leads to a manual check by us; it does not automatically lead to a refusal. We also record the country of the payer's bank; that is our evidence of where you live for VAT.
• Purpose: linking the payment to your order, refunds, bookkeeping, fraud prevention. Legal basis: performance of the contract (point b), legal obligation (point c), legitimate interest (point f).
• Retention: the payer's full IBAN 18 months, afterwards only masked; the payer's name and the amount for as long as the order is kept (7 years).

2.5 Delivery via our supplier (Indonesia)

• What the supplier receives: only the product code (SKU), your Player ID, the server/zone (if provided) and our own randomly generated order reference, which cannot be traced back to you. In addition, the supplier technically receives the IP address of our server with every request. The supplier does not receive your name, email address, IP address, country, payment details or our order number.
• Role of the supplier: the supplier uses this data to deliver your order and is an independent controller for the data it receives from us (see section 4). The supplier may pass data on to parties further down the chain who are needed for the delivery; we do not know who they are. You can request a copy of the standard contractual clauses from us at info@topupharbor.com.
• What the supplier also does with the data: besides delivering your order, the supplier uses the data to investigate failed or delayed deliveries, for customer support, to prevent fraud, chargebacks and sanctions violations, and for legally required records. It keeps the data for as long as needed to fulfil and support your order and afterwards for five years, or longer where the law requires, after which it erases or anonymises it.
• Checking your Player ID: if you click "Check my Player ID", we send your Player ID (and zone, if provided) to the supplier. The supplier returns the corresponding player name. We only show it to you on screen and do not store it.
• Delivery: the supplier puts the digital content on the Player ID you provide.
• What we keep ourselves: a delivery log with Player ID, server/zone, the supplier's transaction number, status and purchase price, for 7 years.
• Purpose: delivering your order. Legal basis: performance of the contract (point b). For the transfer, see section 4.

2.6 Invoices and bookkeeping

• Data: invoice number, date, product, quantity, amount and VAT, payment method and reference, your email address and your Player ID (both are on the invoice). We email you the invoice (PDF). Our bookkeeping software Moneybird receives the invoice as a PDF attachment and an invoice line; the Moneybird contact list holds no customer name or email address. For the link with our bank account Moneybird uses a bank data service.
• Purpose: statutory invoicing and bookkeeping obligations. Legal basis: legal obligation (point c).
• Retention: 7 years (tax retention obligation, or longer where the law requires).

2.7 Email

• What we email: the login link, the confirmation of your order (with the agreed information and your consents: text version, language and time), the invoice, the acknowledgement of a withdrawal, and once, about three days after delivery, an invitation to write a review (with an opt-out link; basis: our legitimate interest in feedback), and if you sign up for the waiting list, a confirmation email and, once, an email when we reopen (see 2.14). All email is sent and received through our email provider TransIP (the Netherlands).
• Customer service: if you email us, we keep your message and our reply in our mailbox. Legal basis: steps at your request before a contract or performance of it (point b), otherwise our legitimate interest in answering you (point f).
• Retention: customer service email at most 24 months after the last message, unless the message is needed for bookkeeping or a dispute.

2.8 Withdrawal

• Data: name, email address, the order number, time, whether the right of withdrawal still existed at that moment, and the network part of your IP address and your browser type. You receive an acknowledgement by email.
• Purpose: operating the statutory withdrawal function and being able to show that and when you withdrew. Legal basis: legal obligation (point c) and our legitimate interest in evidence (point f).
• Retention: 7 years, together with the order; network part of the IP address and browser type 12 months.

2.9 Contact via WhatsApp or phone

• If you contact us via WhatsApp, WhatsApp (Meta) processes your phone number, profile name and messages under WhatsApp's own privacy policy. We use this data only to handle your request, for example a custom order. Legal basis: steps at your request (point b) or our legitimate interest in answering you (point f).
• Retention: at most 24 months after the last message, unless needed for the order (then the retention period of the order).

2.10 Reviews

• After a delivered order you can write a review: stars, optional title and text, and a name of your choice (first name or initials) or "Verified customer". We only show the review after our check, together with the month and the product. We never show your email address, Player ID, order number or full name. Please do not mention player names, Governor IDs, servers or alliances.
• Legal basis: your consent (point a). You can withdraw it at any time by asking us to remove the review; we do so without delay.
• Retention: as long as the review is shown. If you opt out of reminders, we keep your email address on an opt-out list so as not to email you again.
• Translation: reviews can be translated automatically into English for visitors who have chosen English. When we do this, it happens locally on our own server with an offline model; the text of your review is not sent to any third party. We keep a translation for as long as the review exists and delete it together with the review. The original always remains visible.

2.11 Fraud prevention and automatic limits

We apply the following rules automatically:

• Customers whom we have not approved manually can order up to a maximum amount per order, per day and per week. Above that limit the shop rejects the order until we have approved the account.
• After two failed deliveries in a row to the same Player ID, a waiting period applies to that Player ID, during which the shop refuses new orders for that Player ID.
• For high totals we flag the order for a manual check. We can block a customer or a Player ID manually.

The shop shows an explanation with a refusal. You can ask us to have the decision reviewed by a person and to state your view: email the address in section 1. Legal basis: our legitimate interest in fraud prevention (point f). Retention: waiting-period data per Player ID 90 days after the last failure; blocks until we lift them, with an annual review.

2.12 Back-ups

• Every night we make a full encrypted back-up of our data (orders, customers, invoices, settings), and every hour an encrypted back-up of the order and customer data. The back-ups are encrypted before they leave the server. We keep the nightly back-ups for seven days on the server and the hourly ones for 48 hours; we place an encrypted copy in a dedicated, secured mailbox in our own mail environment at TransIP in the Netherlands.
• Our hosting provider TransIP also makes its own back-ups of the server about every four hours, with weekly copies that remain available for just over three weeks.
• Retention: the encrypted copies in the mailbox at most 30 days; an automated clean-up then deletes them permanently. If we erase data at your request, it can therefore remain in encrypted back-ups for at most 30 more days. When we restore from a back-up, we re-apply earlier erasures.

2.13 Identity document

We do not ask for a copy of your identity document and the webshop has no function to upload or store one. Please do not send us a copy of your identity document.

2.14 Waiting list for reopening

• If the webshop is temporarily closed, you can leave your email address to receive one email as soon as we are open again. For this we keep your email address, the language of the page, the times you signed up and confirmed, and the version of the consent text. To limit abuse we keep a hashed value (HMAC) of your IP address, not the address itself.
• You confirm your sign-up with the link in a confirmation email. Without confirmation we will not email you when we reopen.
• Legal basis: your consent (point a). You can withdraw it at any time with the unsubscribe link in the confirmation email or by emailing us; we then delete your address right away.
• Retention: without confirmation 48 hours. After confirmation until we have sent the email at the reopening (we then delete your address right away), and no longer than 12 months.

3. With whom we share data

We do not sell your personal data. We share data only with the following parties, as far as necessary for the stated purpose:

Services that receive no personal data of customers (exchange rates, availability monitoring of our website) are not listed here. Banks we do business with keep payment data for as long as their own legal obligations require; this also applies to a business account we no longer use.

4. Transfers outside the European Economic Area

• Our supplier, Indonesia. There is no European Commission adequacy decision for Indonesia. We therefore transfer the data in section 2.5 to our supplier on the basis of the European Commission's Standard Contractual Clauses (Module One, controller to controller), which form part of our agreement with the supplier, together with an assessment of the laws and practices of Indonesia that apply to the transfer. We limit the transfer to the data needed to deliver your order. You can request a copy of the Standard Contractual Clauses by emailing the address in section 1.
• WhatsApp (Meta). If you contact us via WhatsApp, Meta may process data outside the EEA; the basis for this is set out in WhatsApp's privacy policy.
• For the other recipients in section 3 no transfer outside the EEA takes place.

5. How long we keep data

When a period ends we erase or anonymise the data, unless a legal obligation or a pending dispute requires us to keep it.

6. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and you can withdraw a consent you gave.

• How: send an email to the address in section 1, from the email address of your account. We first ask you to confirm your identity, for example by replying from that address and stating a detail that we can check (such as your Player ID or an order number). We do not ask for a copy of an identity document for this.
• Time limit: we respond within one month. For complex requests or a large number of requests we can extend that period by up to two months; we will tell you within the first month. It is free of charge.
• Access and portability: you receive an overview of your data in a common, machine-readable format (JSON).
• Erasure: we erase or anonymise your data. Data we must keep by law (invoices and the related order data, 7 years) is retained and used only for that obligation; we tell you what remains and why. Data in encrypted back-ups disappears within the period in section 2.12.
• Restriction: we mark your data so that we no longer use it except for storage and for defending legal claims.
• Automatic limits: see section 2.11; you can ask for a review by a person.
• Complaint: you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

7. Cookies and local storage

• Session cookie tuh_shop (shop). Necessary for operation: remembers your language choice, your currency display, your login session, a security token against misuse of forms and a counter for the Player ID check. The cookie is HttpOnly, Secure and SameSite=Lax. Your login session ends after 15 minutes of inactivity.
• Local storage in your browser (localStorage and sessionStorage): remembers your language and currency choice on the static pages and whether you dismissed a notice. This data stays in your browser and is not sent to us.
• We do not use analytics, marketing or tracking cookies. See also our cookie policy.

8. Security

We take technical and organisational measures: connections over HTTPS, login links stored only as a hash and usable once, limited session duration, hashed IP addresses for rate limiting, encrypted back-ups, and access to customer data only for the owner through a secured admin panel. In the event of a personal data breach we follow a fixed procedure and report it within 72 hours to the Dutch Data Protection Authority where the law requires, and to you where the breach is likely to result in a high risk to you.

9. Changes

We may change this policy. The version and date at the top show which text applies. With an order we record which version you saw.