Privacy Policy

This Privacy Policy explains how Voucher Marketplace Ltd ("we", "us", "our") collects, uses, shares and protects your personal data when you visit buy-voucher.com, purchase a digital voucher, contact support, or otherwise interact with our services (the "Service"). It applies to visitors, customers, and business contacts worldwide, and is written to comply with the UK GDPR, the Data Protection Act 2018, and — where applicable — the EU GDPR. Effective date: 01.06.2026.

1. Data controller

VOUCHER MARKETPLACE LTD, a company registered in England and Wales under number 17218574, with its registered office at 196 High Road, N22 8HH, London, United Kingdom, is the controller of your personal data. You can contact us at support@buy-voucher.com for any privacy-related question, request or complaint.

2. Personal data we collect

We collect only what we need to operate the Service. Depending on how you use it, this may include:

Account and contact data: email address, name (optional), and any information you provide when contacting support.

Order and transaction data: order number, product(s) purchased, brand, denomination, price, currency, order status, delivery method used, timestamps, and — for bank transfer payments — the payment reference you send with your transfer. We do not store full payment card numbers.

Voucher delivery data: the email address to which the voucher is delivered, the voucher code, PIN, serial and/or barcode received from our supplier, and delivery attempt logs.

Communications: the content of emails you send us, our replies, and delivery/error logs for transactional emails we send you.

Technical data: IP address, device and browser type, referring page, pages viewed, and interaction events, collected via server logs and strictly necessary cookies. See the Cookie Policy.

Fraud and security data: signals used to detect abuse, chargebacks and automated attacks (rate-limit counters, challenge results from our infrastructure provider).

We do not intentionally collect special-category data (e.g. health, religion, biometrics) and we do not knowingly collect data from children under 18.

3. Sources of data

Most data comes directly from you when you place an order or contact us. Some data is generated automatically by your browser and our infrastructure (technical and security data). Voucher codes, PINs and barcodes are received from our voucher supplier after we submit your order on your behalf.

4. Purposes and legal bases

Providing the Service (contract, Art. 6(1)(b)): processing orders, purchasing vouchers from suppliers, delivering the voucher and receipt to you, providing customer support, and managing refunds.

Compliance with legal obligations (Art. 6(1)(c)): issuing invoices, retaining tax and accounting records, responding to lawful requests from authorities, and anti-fraud/AML checks where applicable.

Legitimate interests (Art. 6(1)(f)): keeping the Service secure, preventing fraud and abuse, maintaining logs, defending legal claims, and improving the Service through aggregated analysis. We balance these interests against your rights and will stop processing on request unless we have overriding grounds.

Consent (Art. 6(1)(a)): optional analytics or marketing cookies (if and when enabled), and any marketing emails. You can withdraw consent at any time without affecting the lawfulness of prior processing.

5. How we share your data

We share personal data only with the parties needed to run the Service and only to the extent required:

Voucher supplier: Finperks — we transmit the product and quantity, plus (for URL/email delivery methods) your email address, to obtain the voucher.

Payment reconciliation: our bank(s) receive the transfer you initiate; we do not send them additional personal data.

Email delivery: Resend delivers transactional emails (order confirmations, voucher emails, support replies). They process the recipient address and email content on our behalf.

Hosting and infrastructure: Cloudflare (edge, security, DNS), Lovable Cloud (Supabase — hosted database and authentication for our admin dashboard).

Professional advisors: accountants and lawyers under duties of confidentiality, where necessary.

Authorities: where required by law, court order or to protect our rights, users or third parties.

We do not sell your personal data and we do not share it for third-party advertising.

6. Sub-processors we use

We keep the list below up to date. If we add, replace or remove a sub-processor that handles personal data, we update this section and — for material changes — flag it on the site. To request advance notice of changes, email support@buy-voucher.com.

We do not currently use analytics, advertising or marketing sub-processors. If we add any, they will appear in this table and — where consent is required — be gated behind the consent banner before any data is shared with them.

7. International transfers

Some of our processors (e.g. Resend, Cloudflare) may process data outside the UK/EEA. When that happens, transfers are protected by the UK International Data Transfer Addendum, the EU Standard Contractual Clauses, or an adequacy decision, together with supplementary technical and organisational measures where appropriate. You may request a copy of the relevant safeguards from support@buy-voucher.com.

8. Retention

We keep personal data only as long as necessary for the purposes above:

Order, invoice and tax records: up to 7 years from the end of the relevant financial year, to meet UK tax law requirements.

Voucher codes/PINs/barcodes: retained on the order record while it is active and for the statutory retention period above, so that we can re-send or support the voucher if needed.

Support communications: up to 3 years after the last contact.

Server and security logs: typically up to 90 days.

Cookie consent choices: up to 12 months, then we ask again.

9. Your rights

Subject to the applicable law, you have the right to:

access your personal data; obtain a copy in a portable format; request correction or erasure; restrict or object to processing (including profiling); withdraw consent at any time; and lodge a complaint with a supervisory authority.

In the UK, that authority is the Information Commissioner's Office (ICO) — ico.org.uk. In the EU, you can contact the authority in your country of residence.

To exercise any right, email support@buy-voucher.com from the address associated with your order. We respond within one month and may ask for additional information to verify your identity.

10. Automated decision-making

We do not carry out automated decisions with legal or similarly significant effects on you. Automated fraud/rate-limit signals may block an obviously abusive request, but a human reviews any dispute on request.

11. Security

We use TLS/HTTPS for all traffic, encryption for sensitive stored fields, role-based access, audit logs, principle-of-least-privilege for staff and processors, and provider security controls (Cloudflare, Supabase). No system is perfectly secure; if we become aware of a breach affecting your personal data we will notify you and the competent authority as required by law.

12. Cookies

We use strictly necessary cookies to run the site and, with your consent, may use analytics and marketing cookies. Details of every cookie and how to manage your preferences are in the Cookie Policy.

13. Third-party links

Our Service links to third-party sites (e.g. brand redemption pages). Their privacy practices are their own; please review their policies.

14. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of this page reflects the latest version. Material changes will be highlighted on the site and, where appropriate, communicated by email.

15. Contact

Voucher Marketplace Ltd, 196 High Road, N22 8HH, London, United Kingdom. Email: support@buy-voucher.com.