Privacy Policy
How we handle your data
Last updated: August 2026
1. Who we are
| Business name | Mobile Airtime Services |
| KvK number | 42019808 |
| Address | Parnassiaveld 120, 1115 EL Duivendrecht, Netherlands (postal address only, no visitors) |
| Phone | +31 85 401 65 38 |
| lars@indonesia-topup.com | |
| Website | indonesia-topup.com |
2. What personal data we collect
- Email address: for order confirmations and your account
- Name: if you provide it
- PLN meter numbers and phone numbers: to fulfill your orders. These belong to the recipient in Indonesia, not necessarily the buyer.
- Payment transaction data: processed by our payment provider. We receive transaction status and reference only. We never see full card numbers.
- Pay.nl transaction ID: the payment reference returned by our payment provider, used to reconcile your order
- Supplier transaction ID and delivery receipt: returned by our wholesale fulfillment provider as proof that the PLN token or pulsa top-up was delivered
- Email delivery confirmation: the delivery status returned by our email service provider for each transactional email we send you
- IP address and approximate geolocation: for fraud prevention; geolocation is derived from the IP address at country/region level only
- Browser language: for language detection
- Device fingerprint: a non-personal hash derived from your browser configuration (user agent, screen size, time zone, installed fonts) used for fraud prevention
- Timestamp of acceptance of these terms, and the version accepted: recorded when you place an order, as evidence that you agreed to the terms in force at that moment
- Your answer to "how did you find us": the option you pick, and any free text you add, if you choose to answer the optional question shown after an order or linked from your confirmation email. Answering is entirely voluntary and nothing changes if you ignore it.
With your consent, we also collect usage and performance data (pages visited, clicks, page load times, browser and device information, IP address) through Datadog Real User Monitoring, to monitor site performance and diagnose errors. Anything you type into forms is masked before it is sent, and we do not record your screen. We do not use advertising trackers or sell data to advertisers.
3. Why we use your data
| Data | Purpose | Legal basis |
|---|---|---|
| Order confirmations, support | Contract fulfillment (Art. 6(1)(b) GDPR) | |
| Meter/phone numbers | Fulfilling orders | Contract fulfillment |
| Payment data | Processing payments | Contract fulfillment |
| IP address | Fraud prevention | Legitimate interest (Art. 6(1)(f)) |
| Browser language | Language detection | Legitimate interest |
| How you found us | Understanding which channels bring customers | Legitimate interest (Art. 6(1)(f) GDPR) |
| Usage and performance data | Site performance monitoring, error diagnosis | Consent (Art. 6(1)(a)) |
We do not send marketing emails unless you explicitly opt in.
4. Who we share data with
| Party | Data shared | Purpose | Location |
|---|---|---|---|
| Payment provider | Payment details | Payment processing | Netherlands |
| Our wholesale fulfillment provider | Meter/phone number + denomination | Order fulfillment | Ireland |
| AWS | Encrypted transaction data | Cloud hosting | Frankfurt, Germany (EU) |
| Email service provider | Email address | Transactional emails (order confirmations) | United States |
| Crisp (live chat) | Chat messages, IP address, browser/device info | Live chat support | France (EU) |
| Datadog (monitoring) | Usage and performance data (with your consent); technical logs, which can include your email address | Site performance monitoring, error diagnosis | EU (datadoghq.eu) |
We do not sell personal data. Most processors are within the EU/EEA. Our email service provider is based in the United States; transfers are protected by EU Standard Contractual Clauses (SCCs) in accordance with Article 46(2)(c) GDPR.
Payment processing: Our payment service provider (based in the Netherlands) processes card and iDEAL transactions on our behalf. They handle card data directly. We never see your full card number or CVC. Their privacy policy: pay.nl privacy statement.
5. How long we keep data
We retain transaction records for 7 years from the date of the transaction. This period is required by Dutch fiscal law and corresponds to the chargeback windows of the card schemes we accept. Records include: customer email address, the destination identifier (PLN meter or mobile number), payment reference, supplier transaction ID, IP address, device fingerprint, terms-acceptance timestamp, and email delivery confirmation.
- Account data: until you request deletion
- Support correspondence: 12 months after last contact