Privacy policy

This policy explains what personal data MyPinCard collects, why, who we share it with, and your choices. Golden Codes, which operates MyPinCard, is responsible for your data. Contact: info@goldencodes.com.iq.

What we collect

• Account details: name, email, mobile number, password (stored only in scrambled form), and preferred language and currency.
• Verification: one-time codes sent to your phone or email, stored in scrambled form and deleted once used or expired.
• Orders: products, amounts, order numbers, delivery status and the messages we send you about them.
• Payments: payment method, transaction reference, amount and status. For card payments, the payment provider also tells us the card's masked number (first six and last four digits only), the name on the card, its expiry month, and the internet address the payment was made from. We use these to prevent fraud and stolen-card payments. We never receive or store your full card number or security code.
• The codes you buy, stored encrypted, and a record of each time a code is viewed: when, how (website, email or support), and the IP address and device used.
• Support: WhatsApp and email messages, and the screenshots and files you send us.
• Technical data: IP address, browser and device information, your device's timezone and language setting, and session and security logs.
• Your marketing choice (off unless you opt in).
• Advertising measurement through the Meta Pixel, only if you accept advertising cookies.

We never ask for your game or platform passwords. We only ask for identity documents when this is needed to prevent fraud.

Why we use it

• To run your account, take payment, obtain and deliver your codes and send order messages. This is needed to perform our contract with you.
• To prevent fraud, stolen payments and money laundering, including by recording code views and checking higher-risk orders.
• To handle complaints, returned payments and payment disputes, including giving evidence to payment providers.
• To keep the accounting and tax records required by law.
• To send offers, only with your consent. You can withdraw it at any time in your account or from any message.
• To measure our adverts, only with your consent.

Some orders are flagged automatically for a fraud check. A person on our team reviews every flagged order before it is refused. Where we ask for an identity document, an automated check reads it, confirms its details agree with each other and with your account, and compares your photo of yourself with the photo on the document, using software that runs on our own servers — your photo of yourself is never sent outside MyPinCard. If a photo cannot be used, the check may ask you for a new one before you pay. It never rejects you or closes your account on its own: anything it cannot settle is reviewed by a person.

Who we share it with

• We do not sell your personal data. We share only what each party needs.
• Payment providers, to process payments and refunds.
• Code distributors, which receive order details (not your contact details) so they can issue codes.
• Service providers that run MyPinCard for us under contract: website and server hosting, email and SMS delivery, WhatsApp messaging, accounting software, and an automated document-reading service that processes identity document photos for the check described below and does not keep them.
• Meta, for advertising measurement, only if you consent.
• Authorities or courts where the law requires it, or to investigate fraud or defend legal claims.

Some of these providers store data outside Iraq, including in Europe and the United States. Where the law requires it, we use contractual safeguards to protect your data.

Our mobile apps

The MyPinCard apps for iOS and Android contain no advertising or analytics trackers, and do not track you across apps or websites owned by other companies. We do not share information from the apps with data brokers, or use it for advertising in other companies’ apps or websites. The Meta Pixel described above is used only on this website, and only if you accept advertising cookies. When you open our policies from the apps, such as this one, the page does not show the cookie banner and does not load the Meta Pixel.

How long we keep it

• Account details: while your account is open, then deleted or anonymised within 30 days after you delete it, except for the records below.
• Orders, payments and code-view records: 7 years, for accounting, tax, fraud prevention and disputes.
• Identity documents and the photo of you: 5 years from when you send them, so we can answer a payment dispute with your bank or card issuer. Then deleted.
• Support conversations: 2 years after they end.
• One-time codes: until used or expired.
• Security logs: 12 months.

Your rights

You can ask for a copy of your data, ask us to correct or delete it, object to or restrict some uses, or ask for it in a portable format. You can delete your account yourself in account settings, and withdraw marketing or cookie consent at any time. We reply within 30 days and may first need to confirm your identity. We cannot delete records the law requires us to keep; we will tell you when that applies. If you live in the European Union, the United Kingdom or Turkey, you can also complain to your local data protection authority.

Security

Codes are stored encrypted and every view is logged. Passwords and one-time codes are stored only in scrambled form. Staff access is limited by role and recorded. All connections are encrypted. If a breach puts you at risk, we will tell you promptly.

MyPinCard is for people aged 18 and over, or younger people with a parent’s or guardian’s permission.

We will post changes here and email you about significant ones.

Privacy questions and requests: info@goldencodes.com.iq.