Privacy Policy

1. Who is responsible for your data

ARCTOPUP LIMITED, a company registered in Hong Kong and operating arctopup.com, is the controller of the personal data described in this notice. Wherever this page says "we", "us" or "ARCTopup", that is the entity meant.

This notice covers the website, our mobile web experience, our email communications and our customer support channels. It does not cover the games, apps or publisher platforms you top up — once credit reaches your game account, the publisher’s own privacy terms govern what happens next.

2. What we collect

We collect four kinds of data, and we collect as little of each as the job allows. We do not ask for your government ID, date of birth or physical address to complete an ordinary top-up.

3. Where the data comes from

• From you directly — when you register, place an order, contact support, or opt in to marketing email.
• Automatically from your device — when you browse the site, through cookies, local storage and our fraud-prevention scripts.
• From third parties — payment processors confirming a transaction, our fraud-screening provider returning a risk signal, supply channels confirming a delivery, and Google if you choose to sign in with a Google account (we receive your email address, name and profile picture, nothing else).

4. Why we are allowed to process it

Where data protection law requires a legal basis, these are the ones we rely on:

5. What we never do

We do not sell personal data. We do not rent, trade or otherwise make it available to unrelated companies for their own marketing. There is no arrangement under which a third party pays us for access to our customer list, and we have no intention of creating one.

If ARCTopup is ever involved in a merger, acquisition or sale of assets, customer data may transfer as part of that business along with the obligations in this notice, and we will say so on this page before the transfer takes effect.

6. Who we do share it with

Sharing is limited to parties that need the data to make an order work or to keep us lawful:

• Payment processors and acquirers — to authorise, capture and refund your payment.
• Supply channels and distributors — the Player ID and product details needed to deliver your top-up, and nothing more.
• Fraud prevention providers — device and transaction signals used to score an order’s risk.
• Email delivery providers — to send transactional and, where you have consented, marketing email.
• Cloud hosting, storage and CDN providers — the infrastructure the site runs on.
• Professional advisers, auditors, regulators and law enforcement — where we are legally required to disclose, or where disclosure is necessary to establish or defend legal claims.

Every processor is bound by contract to use the data only on our instructions and to protect it to a standard consistent with this notice.

7. Sending data across borders

We operate globally, so your data may be processed in countries other than your own, including Hong Kong, Singapore, the European Union and the United States.

Where we transfer personal data out of a jurisdiction that restricts such transfers, we rely on an approved safeguard — most commonly the European Commission’s standard contractual clauses, or an adequacy decision covering the destination country — together with contractual and technical controls at the receiving end.

8. How long we keep it

When a period expires the data is deleted or irreversibly anonymised. Anonymised aggregates — order volumes, popular products, conversion rates — may be kept indefinitely because they no longer identify anyone.

9. How we protect it

• All traffic between your browser and our servers is encrypted with TLS.
• Passwords are stored as salted hashes; nobody at ARCTopup can read your password.
• Access to production data is restricted to staff who need it for their role, and access is logged.
• Payment card data is handled entirely by PCI DSS compliant providers rather than by us.
• Session tokens expire and are rotated, and the administrative console is restricted by IP allow-list.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify you and the relevant supervisory authority within the timeframes the applicable law sets.

10. Automated checks on your orders

Orders are scored automatically for fraud risk using signals such as device fingerprint, IP reputation, payment method behaviour and order history. A high score can delay an order for manual review or cause it to be cancelled and refunded.

No delivered order is ever reversed by this process, and cancellation always returns your money in full. If an automated decision has affected you and you believe it is wrong, email us — a person will look at it and you can put your side of it.

11. Cookies and similar technologies

We use cookies and browser local storage for three things only:

• Strictly necessary — keeping you signed in, holding your cart, remembering your language and currency, and protecting against cross-site request forgery. The site does not function without these.
• Fraud prevention — a device identifier used to recognise returning devices and detect abusive patterns.
• Analytics — aggregate measurement of which pages are visited and where people drop out of checkout.

We do not run third-party advertising cookies or cross-site behavioural ad tracking. You can clear or block cookies in your browser settings, but blocking the strictly necessary ones will break sign-in and checkout.

12. Children

ARCTopup is not intended for children. The service is offered only to people aged 18 or over, or to those who have reached the age of majority where they live and have the legal capacity to enter a contract.

We do not knowingly collect data from children. If you believe a child has registered or placed an order, contact us and we will delete the account and the associated personal data promptly. Parents and guardians should note that a delivered top-up cannot be recovered from a game account, even where the order is later found to have been placed by a minor.

13. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you and receive a copy of it.
• Correct anything inaccurate or incomplete.
• Delete your data, where we have no overriding legal reason to keep it.
• Restrict or object to processing based on our legitimate interests.
• Port your data to another provider in a structured, machine-readable format.
• Withdraw consent at any time, without affecting anything done before you withdrew it.
• Complain to your local data protection authority.

Order, payment and AML records are the usual limit on deletion: we are legally required to retain them for the period in section 8 even after an account is closed. In that case we will delete everything else and lock the remainder from ordinary use.

14. Making a request

Email [email protected] from the address registered on your account and tell us which right you are exercising. We may ask a question or two to confirm it is really you — that check protects you, not us.

We respond within 30 days. If a request is unusually complex we may extend by a further 30 days and will tell you why before the first period runs out. There is no charge unless a request is manifestly unfounded or repetitive.

15. Marketing email

Promotional email is only sent to people who opted in. Every such message carries a one-click unsubscribe link, and opting out takes effect immediately.

Transactional email — order confirmations, delivery notices, refund updates, security alerts — is part of the service you bought and cannot be unsubscribed from while your account remains open.

16. Changes to this notice

We update this notice when our processing changes. The effective date at the top always reflects the current version.

For material changes — a new purpose, a new category of recipient, a materially longer retention period — we will give notice on the site or by email before the change takes effect, so you can object or close your account first.

17. Contacting us about privacy

Privacy questions, rights requests and complaints all go to [email protected]. Postal correspondence can be sent to the registered office below.