Privacy Policy of mytopup.co.uk – last updated 22 October 2026.
This website (“mytopup.co.uk”, “we”, “us”) collects some Personal Data from its Users. This policy explains exactly which data is collected, which services we use, what each one is used for, where the data is processed and what your rights are.
Owner and Data Controller
JDF Tech LTD, trading as My Top Up
396 Barking Road, London, E13 8HJ, United Kingdom
Owner contact email: info@mytopup.co.uk
Types of Data collected
Among the types of Personal Data that this website collects, by itself or through third parties, there are: first name; last name; email address; phone number; billing address (street, town or city, county, postcode, country); password (stored only in encrypted, hashed form); order details (products, amounts, date, payment method); the IMEI number and model number of a phone, mobile WiFi or USB modem (for unlock code orders); the mobile number to be topped up (for international top-ups); Trackers; Usage Data (such as IP address, browser and device type, pages visited, the website that referred you).
Complete details on each type of Personal Data collected are given in the sections below. Personal Data is either provided by you (for example at checkout) or, in the case of Usage Data, collected automatically when you use the website.
The data asked for at checkout is needed to deliver your order. If you do not provide it, we cannot complete the order. Fields marked “optional” can be left empty.
If you give us Personal Data about someone else – for example the mobile number of a relative you are topping up – you confirm that you have their permission to do so.
Mode and place of processing the Data
Methods of processing
We take appropriate security measures to prevent unauthorised access, disclosure, modification or destruction of the Data. The whole website uses an encrypted HTTPS connection, passwords are stored hashed and never in plain text, and card details are entered directly into the payment provider’s secure fields – we never see or store your full card number.
The Data is processed using computers and IT tools, following procedures strictly related to the purposes described here. Besides the Owner, the Data may be accessible to the external service providers named in this policy (payment, hosting and email providers), acting as Data Processors or as independent controllers. An up-to-date list of these parties may be requested from the Owner at any time.
Place
The website, its database and its email are hosted on servers in the United Kingdom. Some of the service providers named below may process Data outside the UK (for example in the European Union or the United States). Where this happens, the transfer is protected by safeguards recognised under UK data protection law, such as UK adequacy regulations or the UK International Data Transfer Agreement / Addendum. Details are given for each service below.
Retention time
- Orders and invoices: 6 years from the end of the financial year in which the order was placed, as required by UK tax law.
- Customer account: until you ask us to delete it (order records are still kept for the tax period above).
- Mailing list: until you unsubscribe.
- Emails you send us: up to 2 years after our last contact.
- Server logs: up to 90 days.
- Identity documents (only if we ask for them to verify an order): deleted once the check is complete, and no later than 30 days.
The purposes of processing
The Data concerning you is collected to allow us to provide our service, meet our legal obligations, respond to enforcement requests, protect our rights and interests (or those of our Users or third parties), and detect fraudulent or malicious activity, as well as for the following purposes: Handling payments; Processing and delivering orders; Registration and authentication; Contacting the User; Managing support and contact requests; Platform services and hosting; Traffic source statistics; Analytics; Security and fraud prevention.
Detailed information on the processing of Personal Data
Personal Data is collected for the following purposes and using the following services:
Handling payments
Payment services let us take payments by credit or debit card, PayPal and Google Pay. The Data used for the payment is collected directly by the payment provider. We only receive confirmation of the payment, the payment method and limited information such as the payer’s name and email address.
PayPal (PayPal UK Ltd)
PayPal processes payments made with a PayPal account, Pay Later and debit or credit cards entered in the card fields at checkout. The card fields and PayPal buttons are loaded from PayPal’s servers.
PayPal Fastlane: when you enter your email address at checkout, PayPal checks whether you have a Fastlane profile so that your saved card and address can be filled in after you confirm with a one-time code. If you choose to create a Fastlane profile, your details are stored by PayPal, not by us.
Personal Data processed: billing address; email address; first name; last name; phone number; payment information; Usage Data; Trackers.
Place of processing: United Kingdom, with possible transfers to the European Union and the United States – Privacy Policy.
Google Pay (Google LLC)
Google Pay is offered at checkout through PayPal. If you choose it, your payment details are provided by Google.
Personal Data processed: payment information; email address; Usage Data; Trackers.
Place of processing: United States – Privacy Policy.
SumUp (SumUp Limited)
SumUp processes debit and credit card payments when you choose SumUp at checkout.
Personal Data processed: billing address; email address; first name; last name; payment information; Usage Data.
Place of processing: United Kingdom and the European Union – Privacy Policy.
Bank transfer (this website)
If you pay by bank transfer, we match the payment received in our business bank account to your order using your order number.
Personal Data processed: first name; last name; order number; amount paid; the name on the paying bank account.
Place of processing: United Kingdom.
Processing and delivering orders
Order processing (this website, WooCommerce)
We use your order details to supply the top-up voucher, calling card PIN or unlock code you bought and to email it to you. The online shop runs on WooCommerce software installed on our own server; no order data is sent to the WooCommerce developers.
Personal Data processed: first name; last name; email address; phone number; billing address; order details; IMEI number and model number (unlock codes); mobile number to be topped up (international top-ups).
Place of processing: United Kingdom.
Suppliers of top-ups and unlock codes
To issue your code we pass only the details the supplier needs: for unlock codes, the IMEI number and model of your device; for international top-ups, the mobile number to be credited and the amount. We do not pass your name, email address or payment details to suppliers.
Personal Data processed: IMEI number; model number; mobile number to be topped up.
Registration and authentication
Direct registration (this website)
Every order is saved to a customer account so you can see your order history. If you are new, an account is created automatically when you order, and we email you a link to set your password. You can also register on the “My account” page.
Personal Data processed: email address; first name; last name; password (hashed); billing address; phone number; order history.
Place of processing: United Kingdom.
Contacting the User
Order and account emails (this website)
We send emails that are part of the service: order confirmation, the email with your code, payment and refund notices, and account emails such as password resets.
Personal Data processed: email address; first name; order details.
Mailing list or newsletter (this website)
If you sign up on the homepage, we add your email address to our list and may send you coupon codes and offers, normally no more than once a month. You can unsubscribe at any time using the link in each email or by emailing us.
Personal Data processed: email address; date of sign-up.
Place of processing: United Kingdom.
Managing support and contact requests
Email contact (this website)
When you email us, we use your email address and the information you give us to answer your question or deal with a problem with an order.
Personal Data processed: email address; first name; last name; any information you include in your message.
Place of processing: United Kingdom.
Platform services and hosting
Hostinger (Hostinger International Ltd.)
Hostinger provides the servers that host this website, its database and our email. All Data handled by the website is stored on Hostinger’s servers.
Personal Data processed: all types of Data described in this policy.
Place of processing: United Kingdom – Privacy Policy.
Website caching (this website, LiteSpeed Cache)
Pages are stored in a cache on our own server so that they load faster. Logged-in customers are shown a personal, uncached version of the account and checkout pages.
Personal Data processed: Usage Data; Trackers.
Place of processing: United Kingdom.
Traffic source statistics
WooCommerce Order Attribution (this website)
Small cookies record how you arrived at our website (for example from a Google search, another website or an email) and attach this to your order, so we can see which channels lead to orders. The information stays on our own server and is not shared with anyone. We do not use advertising pixels or social media tracking.
Personal Data processed: Trackers; Usage Data (traffic source, landing page, number of pages visited, device type).
Place of processing: United Kingdom.
Analytics
Google Analytics 4 (Google Ireland Limited)
If you click “Accept” on our cookie bar, Google Analytics measures how the website is used – pages viewed, products looked at, items added to the basket and completed orders (order number, products and value) – so we can understand what customers need and improve the shop. If you click “Reject” or make no choice, no analytics cookies are set. Advertising features and Google signals are switched off, and we do not send your name, email address or phone number to Google. You can change your choice at any time by clearing this website’s data in your browser.
Personal Data processed: Trackers; Usage Data (pages visited, device and browser, approximate location from IP address, order details).
Place of processing: Ireland, with possible transfers to the United States – Privacy Policy.
Security and fraud prevention
Order checks (this website)
To protect customers and ourselves from fraud, orders are checked before codes are sent. We currently accept orders from the United Kingdom only. In some cases we may ask for proof of identity or address (such as a photo ID or a recent bill). These documents are used only to verify the order and are deleted once the check is complete.
Personal Data processed: IP address; billing address; email address; order details; identity documents (only when requested).
Place of processing: United Kingdom.
Server logs and error monitoring (this website)
Our server keeps technical logs of requests (IP address, date and time, page requested, browser) and our SEO tool records addresses of pages that were not found, so that we can fix broken links and investigate attacks.
Personal Data processed: Usage Data.
Place of processing: United Kingdom.
Cookie Policy
This website uses the following cookies and similar Trackers:
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
| woocommerce_cart_hash, woocommerce_items_in_cart | This website | Remember the contents of your basket (essential) | Session |
| wp_woocommerce_session_… | This website | Keep your basket and checkout details between pages (essential) | 2 days |
| wordpress_logged_in_…, wordpress_sec_…, wordpress_test_cookie | This website | Keep you logged in to your account and protect it (essential) | Session, or 14 days if you tick “Remember me” |
| sbjs_first, sbjs_current, sbjs_first_add, sbjs_current_add, sbjs_udata, sbjs_session, sbjs_migrations | This website (WooCommerce Order Attribution) | Record how you found our website, attached to your order (traffic source statistics) | Session to 6 months |
| Various | PayPal (including Fastlane), Google Pay, SumUp | Process the payment and prevent fraud, only when you use these payment methods (essential) | Set by the provider – see their privacy policies above |
Essential cookies are needed for the basket, checkout and account to work. You can block or delete cookies in your browser settings, but the shop will not work properly without the essential ones.
Further information for Users
Legal basis of processing
We process Personal Data relating to you on one or more of these legal bases under the UK General Data Protection Regulation (UK GDPR):
- Contract: processing is needed to take and deliver your order and to run your customer account.
- Legal obligation: we must keep accounting and tax records.
- Legitimate interests: preventing fraud, keeping the website secure, answering your questions, and understanding which channels bring us orders.
- Consent: our mailing list. You can withdraw consent at any time.
Your rights under the UK GDPR
You have the right to:
- Access your Data and receive a copy of it.
- Correct Data that is inaccurate or incomplete.
- Delete your Data, unless we must keep it, for example for tax purposes.
- Restrict the processing of your Data in certain cases.
- Object to processing based on our legitimate interests, and to direct marketing at any time.
- Data portability: receive your Data in a structured, commonly used format and have it sent to another company.
- Withdraw consent at any time where processing is based on consent.
- Complain to the Information Commissioner’s Office (ICO), the UK data protection authority: ico.org.uk/make-a-complaint, telephone 0303 123 1113. We would appreciate the chance to deal with your concern first.
How to exercise these rights
Email info@mytopup.co.uk. Requests are free of charge and we will answer within one month. We may ask you to confirm your identity before acting on a request.
Additional information about Data collection and processing
Legal action
Your Personal Data may be used by the Owner in court or in the steps leading to possible legal action arising from improper use of this website or its services, and may be disclosed to public authorities when the law requires it.
Automated decisions
We do not make decisions about you based solely on automated processing.
Children
This website is not aimed at children under 13 and we do not knowingly collect their Personal Data.
Changes to this privacy policy
We may update this policy, for example when we add a new payment method or service. The date at the top shows when it was last changed. Please check this page from time to time.
Definitions
Personal Data (or Data): any information that directly or indirectly identifies a living person.
Usage Data: information collected automatically through this website, such as IP address, browser, device, pages visited and time of visit.
User: the person using this website.
Data Controller (or Owner): the person or company that decides why and how Personal Data is processed – here, JDF Tech LTD.
Data Processor: a company that processes Personal Data on behalf of the Data Controller.
Tracker: any technology, such as a cookie, that records information on your device.