papawebaLegal
Privacy Policy
What I collect when you buy a code or write to me, why I need it, how long I keep it, and how you get it deleted. Because sales happen on marketplaces rather than here, the marketplace holds most of what you would expect a shop to hold — this policy says plainly which parts are mine.
01Who is responsible
The data controller is Levin Ronskii (ロンスキー レビン), a registered sole proprietor (個人事業主) in Japan, trading as Papaweba and DIGITY, based in Kitakyushu, Fukuoka. The full postal address and telephone number are disclosed without delay on request (statutory disclosure). There is no company, no data-protection department and no third party behind this — it is one person, and requests are handled by him.
Most of your data is not mine to begin with. You buy on Wildberries or Yandex Market, which are independent controllers for your account, your payment and your delivery details. They pass me only what is needed to fulfil the order. Their own privacy policies govern what they hold.
For any privacy question or request, write to [email protected] or [email protected].
02What I collect
| Data | When | Why |
|---|---|---|
| Marketplace order record | When you order on a marketplace | Order identifier, product, region, denomination, price, timestamps and delivery status, as passed to me by the platform. Needed to fulfil the order and for support, refunds, accounting and fraud checks. |
| Buyer display name | With the order, as the platform shows it | To address you correctly and to match an enquiry to an order. I do not receive your full identity or your address from the platform. |
| Order chat messages | If you write to me inside the order | To answer you. The chat lives on the platform; I hold a copy of what was said. |
| Email address and name | Only if you use the contact form on this site or mail me directly | To reply to you. Nothing else. |
| Code record | At fulfilment | The code itself, encrypted and bound to the order, plus a one-way SHA-256 fingerprint of it. The fingerprint is what proves the code was issued to your order and only to your order. See code handling. |
| Payment data | Never | I never receive your card number, the last four digits, your CVC or any bank credential. The marketplace takes the payment and settles with me in aggregate; I see that an order was paid, not how. |
| Technical data | On every request | IP address, user agent, timestamps and requested page, written to server logs for security, abuse prevention and rate limiting. |
| Verification documents | Only in a suspected-fraud case, and only if I ask | To confirm the order is yours. Providing them is voluntary; refusing means the order is cancelled and refunded instead. |
I do not collect special category data, I do not ask for your date of birth beyond an age confirmation, I do not buy personal data from third parties, and I run no advertising, profiling or email marketing of any kind.
03Legal bases
- Performance of a contract — processing an order, delivering the code, handling refunds and support.
- Legal obligation — keeping transaction records for accounting and anti-fraud obligations.
- Legitimate interests — securing the site, preventing fraud and abuse, and defending legal claims, balanced against your rights.
- Consent — only where you actively give it, for example by sending me verification documents. You can withdraw it at any time, and withdrawing does not affect processing carried out before that point. I run no mailing list, so there is no marketing consent to manage.
04Cookies and analytics
This site sets no cookies at all. There is no checkout here, so there is no session and no basket to keep; there are no advertising cookies, no cross-site trackers and no third-party analytics. That is why you are not being asked to dismiss a consent banner — there is nothing here to consent to and nothing to opt out of.
Web fonts are loaded from Google Fonts, which means your browser makes a request to Google’s servers and Google receives your IP address for that request. If you would rather avoid this, a content blocker prevents it; the site remains fully usable with system fonts.
05Who I share data with
I share the minimum necessary with:
- The marketplace you bought on, which is where the order and the payment live, and through which the code is delivered to you;
- Code distributors, to buy the code. They receive a purchase request and an order reference, not your identity — unless a product has to be provisioned against an account identifier you supplied yourself;
- Email providers, to carry replies to and from this site's contact address;
- Hosting and infrastructure providers, who store the data on my behalf;
- Authorities, where I am legally required to respond, and to the extent required.
I do not sell personal data, and I do not share it for third-party marketing. Ever.
06International transfers
I am established in Japan, and the servers running this site are in the European Union. Marketplaces and code distributors operate in their own jurisdictions. Where personal data is transferred out of the EEA or the UK, the transfer relies on an adequacy decision — Japan holds one from the European Commission — or on Standard Contractual Clauses with the provider. Ask and I will tell you which mechanism applies to a specific provider.
07How long I keep it
| Record | Retention |
|---|---|
| Order and transaction records | Up to 6 years, to meet accounting and tax obligations |
| Encrypted code and its fingerprint | 12 months after delivery, then deleted. The code is never stored in readable form at any point. |
| Support correspondence and contact form messages | 24 months from the last message |
| Server access logs | 90 days |
| Fraud verification documents | Deleted within 30 days of the case closing |
08Your rights
Subject to the law that applies to you, you can ask me to:
- give you a copy of the personal data I hold about you;
- correct data that is wrong or incomplete;
- delete data I no longer need — noting that transaction records have to be kept for the retention period above;
- restrict or object to processing based on legitimate interests;
- receive your data in a portable, machine-readable format;
- withdraw consent where processing is based on it.
Write to [email protected]. I answer within 30 days and I do not charge for it. I may ask you to confirm the order the request relates to, so that I do not hand your data to someone else. For data the marketplace holds rather than me, the request has to go to the marketplace — tell me and I will say which is which.
If you are in the EEA or the UK and you are unhappy with my answer, you have the right to complain to your local data protection authority. In Japan, the supervisory authority is the Personal Information Protection Commission (個人情報保護委員会).
09Security
The site is served over HTTPS only and internal services are not exposed to the public internet. Order data is accessible to one person. Payment credentials never touch my infrastructure at all, because the marketplace takes the payment. Gift-card codes are encrypted with AES-256-GCM under a versioned key before they are stored, bound to their own order, and are never written to a log — details on the code handling page. No system is perfect: if a breach affects your data and is likely to put you at risk, I will tell you and the competent authority without undue delay.
10Children
The service is not directed at children under 16, and the marketplaces enforce their own age rules at the account level. I do not knowingly collect a child's data. If you believe a child has given me personal data, write to me and I will delete it.
11Changes
When this policy changes, the version and date at the top change with it. Material changes are published here at least 14 days before taking effect.
12Contact
Privacy requests: [email protected]
General support: [email protected]
Owner: [email protected]
Full statutory details: 特定商取引法に基づく表記