Privacy notice

Who is responsible

[Legal name] B.V., trading as Coin Plug, [Street and number], [postcode] [city], the Netherlands (KvK [KvK number]), is the controller of your personal data under the General Data Protection Regulation (GDPR).

For anything about your data, email [privacy email]. We have not appointed a data protection officer, because the law does not require one for a business like ours.

What we use, and why

Here is what we use, what for, and the legal basis for each use.

Your order

Platform, amount, price, order number, country, language, the time of each step and the delivery log (coins delivered, transfer times, any fixes). We use these to carry out your order, show its progress and send your receipt and invoice. Basis: performing our contract with you (GDPR art. 6(1)(b)).

Your EA login

Your EA account email, password and backup codes, and the coin balance of your club, which our delivery partner reads during delivery. We use them only to check your account and deliver your coins. Basis: performing our contract (art. 6(1)(b)). How we protect and delete them is explained below.

Contact and account

Your email address and, if you sign in, your sign-in links, passkeys and sessions. We use them to send your order emails and to let you sign in and see your orders. Basis: performing our contract (art. 6(1)(b)).

Payment

Payment method, status, amount, refunds and the card type or last digits where our payment provider shares them; for crypto, the refund address you give us. Card numbers stay with our payment provider. Basis: performing our contract (art. 6(1)(b)); keeping financial records: legal obligation (art. 6(1)(c)).

Your confirmations at checkout

Your 18+ confirmation and your request to start delivery straight away, each with its time and the version of the text you saw. We keep them to show what was agreed. Basis: our legal duties as a seller to consumers (art. 6(1)(c)) and our legitimate interest in being able to prove what was agreed (art. 6(1)(f)).

Security and fraud prevention

IP address, device and browser details, the number of account checks and orders per email address, device and IP address, and the result of our bot check. We use these to protect accounts and payments, prevent fraud and answer chargebacks. Basis: our legitimate interest in a secure store and in preventing fraud (art. 6(1)(f)).

Support

What you write to us by chat or email, and the order it is about. Basis: performing our contract (art. 6(1)(b)) and our legitimate interest in helping you (art. 6(1)(f)). Please never send us your EA password or backup codes by chat or email. If you do, we delete them the same day.

Site statistics

Pages viewed, the site that sent you, your country and browser type, without cookies and without identifying you. We use this to see how our site is used. Basis: our legitimate interest in improving our site (art. 6(1)(f)).

Review requests

After a completed order, we may email you once to ask for a review. Basis: our legitimate interest in collecting genuine reviews (art. 6(1)(f)). You can opt out in that email.

Your EA login

• Encrypted in your browser. Your login is encrypted on your device before it is sent, with a key only our order engine can unlock.
• Stored encrypted, briefly. We keep it encrypted in a separate store with no backups, for 48 hours at most.
• Used once, for your order. Our order engine unlocks it in memory only to pass it to our delivery partner, which signs in to check your account and deliver your coins. We log every time it is unlocked.
• Deleted. We delete our copy when delivery ends or your order stops. Our delivery partner must delete its copy under our agreement. Your certificate shows the time of each confirmed deletion.

After delivery, change your EA password and create new backup codes. That makes the login you gave us useless, whatever happens to it.

Who receives your data

We share data only with service providers that need it for the purposes above, under agreements that let them use it only on our instructions:

• Our delivery partner [name, legal entity and country to be added once its data processing agreement is signed]: your EA login, platform, amount and order number, to deliver your coins;
• Payment providers [names to be added once approved]: your payment details, name, email address and IP address, to take payments and make refunds. They also have legal duties of their own, for example to prevent money laundering;
• Hosting: Vercel (our website, in Frankfurt), Amazon Web Services (our order engine, the encrypted login store, files and logs, in Frankfurt), Neon (our database, in Frankfurt) and Hetzner (encrypted backups, in Germany);
• Email: Postmark, which sends our order emails;
• Security and errors: Cloudflare (our domain name service and the bot check at checkout) and Sentry (error reports, in its EU region, with logins, codes and email addresses removed first);
• Site statistics: Plausible Analytics (in the EU, without cookies);
• Support chat: Crisp (in the EU);
• Our accountant and lawyer, when their work needs it, bound by professional confidentiality;
• Authorities, such as the tax authorities, only when the law requires us to.

We don’t sell your data or share it with advertisers. We don’t send your data to EA. When our delivery partner signs in to your EA account, EA processes that sign-in under its own privacy policy, as it does any sign-in.

Data outside the EU

Most of our providers keep data in the EU. Some are companies based in the United States, or may access data from outside the European Economic Area: Postmark (which stores email data in the US), Vercel, Amazon Web Services, Cloudflare and Sentry. [Our delivery partner’s location is to be confirmed.]

When data leaves the European Economic Area, we rely on the European Commission’s standard contractual clauses or on an adequacy decision, such as the EU–US Data Privacy Framework where a provider is certified, with extra safeguards where needed. You can ask for a copy of these safeguards at [privacy email].

How long we keep it

• Your EA login: until delivery ends or your order stops, and never more than 48 hours;
• Orders, payments and invoices: 7 years, as Dutch tax law requires;
• Your confirmations at checkout and the delivery log: [2 years] after your order, to answer questions, complaints and chargebacks;
• Support conversations: [12 months] after the conversation ends;
• Sign-in sessions: until you sign out or the session expires; passkeys until you remove them;
• Security logs: 30 days; error reports: [90 days];
• Backups: encrypted database backups for up to 30 days.

When a period ends, we delete the data or make it anonymous.

Your rights

You can ask us to:

• show you the data we hold about you and give you a copy (access);
• correct it (rectification);
• delete it (erasure), unless we must keep it, for example for tax law;
• limit how we use it (restriction);
• give it to you, or to another company, in a common format (portability);
• stop using it where we rely on our legitimate interests (objection).

Email [privacy email], or use the privacy tools: in your account when you are signed in, or with your email address when you are not. We answer within one month, and may first ask you to confirm who you are.

You can also complain to a data protection authority: in the Netherlands, the Autoriteit Persoonsgegevens, or the authority of the EU country where you live or work.

Do you have to give us your data?

No one has to buy from us. But we can’t deliver coins without your EA login, or take an order without your email address and a payment. Everything else is collected automatically, as described above, or is up to you.

Automatic limits

To prevent fraud and protect accounts, we use automatic limits, such as a maximum amount for a first order, at most 3 account checks an hour per email address, device and IP address, and checks that block clearly fraudulent payments. An order that is blocked is never charged. If you think a limit was applied to you by mistake, contact us and a person will review it.

Security

We protect your data with encryption in transit and at rest, strict access rules (our staff sign in with passkeys, see only what their role needs, and every action is logged), regular testing by outside security specialists, and the protections for your login described above. If a data breach puts you at high risk, we tell you without undue delay.

Age

Our store is for adults: you must be 18 or older to buy. We don’t knowingly collect data about children. If you believe a child has ordered from us, contact [privacy email] and we will look into it straight away.

Changes

We update this notice when our use of data changes, for example before we add a new service. The version and date are at the top. If a change matters to you, we email you before it takes effect.