Privacy Policy

How we handle your data

Last updated: October 2026

1. Who we are

Mobile Airtime Services is a sole proprietorship registered in the Netherlands. Mobile Airtime Services is the data controller responsible for your personal data.

Business name	Mobile Airtime Services
KvK number	42019808
Address	Parnassiaveld 120, 1115 EL Duivendrecht, Netherlands (postal address only, no visitors)
Phone	+31 85 401 65 38
Email	lars@indonesia-topup.com
Website	indonesia-topup.com

2. What personal data we collect

Email address: for order confirmations and your account
Name: if you provide it
PLN meter numbers and phone numbers: to fulfill your orders. These belong to the recipient in Indonesia, not necessarily the buyer.
Registered meter holder: when you enter a PLN meter number we check it and show the registered name in masked form, so you can confirm it is the right meter. The masked name is displayed to you and not stored with your order.
Payment transaction data: processed by our payment provider. We receive transaction status and reference only. We never see full card numbers.
Pay.nl transaction ID: the payment reference returned by our payment provider, used to reconcile your order
Supplier transaction ID and delivery receipt: returned by our wholesale fulfillment provider as proof that the PLN token, pulsa top-up, data bundle or SIM validity extension was delivered
Email delivery confirmation: the delivery status returned by our email service provider for each transactional email we send you
IP address and approximate geolocation: for fraud prevention; geolocation is derived from the IP address at country/region level only
Browser language: for language detection
Device fingerprint: an identifier for your browser computed by Fingerprint, our device-recognition provider, from your browser and device characteristics (user agent, screen size, time zone, installed fonts and similar signals), together with a first-party cookie that lets it recognise the same browser again. Used for fraud prevention only: it tells us when one device places orders under several email addresses or cards
Device time zone: the time zone your browser reports when you place an order, so that we can tell you delivery times in your local time as well as in Jakarta time
Timestamp of acceptance of these terms, and the version accepted: recorded when you place an order, as evidence that you agreed to the terms in force at that moment
Your answer to "how did you find us": the option you pick, and any free text you add, if you choose to answer the optional question shown after an order or linked from your confirmation email. Answering is entirely voluntary and nothing changes if you ignore it.

With your consent, we also collect usage and performance data (pages visited, clicks, page load times, browser and device information, IP address) through Datadog Real User Monitoring, to monitor site performance and diagnose errors. Anything you type into forms is masked before it is sent, and we do not record your screen. We do not use advertising trackers or sell data to advertisers.

3. Why we use your data

Data	Purpose	Legal basis
Email	Order confirmations, support	Contract fulfillment (Art. 6(1)(b) GDPR)
Meter/phone numbers	Fulfilling orders	Contract fulfillment
Payment data	Processing payments	Contract fulfillment
IP address	Fraud prevention	Legitimate interest (Art. 6(1)(f))
Browser language	Language detection	Legitimate interest
How you found us	Understanding which channels bring customers	Legitimate interest (Art. 6(1)(f) GDPR)
Usage and performance data	Site performance monitoring, error diagnosis	Consent (Art. 6(1)(a))

We do not send marketing emails unless you explicitly opt in.

4. Who we share data with

The Crisp live chat and Datadog Real User Monitoring are activated only after you grant functional consent via the cookie banner. You can withdraw at any time on the cookie policy page; revoking reloads the page, clears Crisp's cookies, and stops Datadog monitoring.

Party	Data shared	Purpose	Location
Payment provider	Payment details	Payment processing	Netherlands
Our wholesale fulfillment provider	Meter/phone number + denomination	Order fulfillment	Ireland
Our meter verification supplier	PLN meter number	Checking a meter before payment	Indonesia
AWS	Encrypted transaction data	Cloud hosting	Frankfurt, Germany (EU)
Email service provider	Email address	Transactional emails (order confirmations)	United States
Crisp (live chat)	Chat messages, IP address, browser/device info	Live chat support	France (EU)
Datadog (monitoring)	Usage and performance data (with your consent); technical logs, which can include your email address	Site performance monitoring, error diagnosis	EU (datadoghq.eu)
Trustpilot (reviews)	Name, email address and order number, only if you ticked the review box at checkout	One invitation to review your order	Denmark (EU)
Fingerprint (device recognition)	Browser and device characteristics, IP address, a first-party cookie	Recognising a device across orders, fraud prevention	United States; our data is kept in its EU region (Frankfurt, Germany)

We do not sell personal data. Most processors are within the EU/EEA. Our email service provider and our device-recognition provider are based in the United States; transfers are protected by EU Standard Contractual Clauses (SCCs) in accordance with Article 46(2)(c) GDPR. PLN meter numbers are sent to a supplier in Indonesia to check the meter before payment; this transfer is necessary to provide the service you ask for (Article 49(1)(b) GDPR).

Payment processing: Our payment service provider (based in the Netherlands) processes card, iDEAL, Bancontact and Wero transactions on our behalf. They handle card data directly. We never see your full card number or CVC. Their privacy policy: pay.nl privacy statement.

5. How long we keep data

We retain transaction records for 7 years from the date of the transaction. This period is required by Dutch fiscal law and corresponds to the chargeback windows of the card schemes we accept. Records include: customer email address, the destination identifier (PLN meter or mobile number), payment reference, supplier transaction ID, IP address, device fingerprint, terms-acceptance timestamp, and email delivery confirmation.

Account data: until you request deletion
Support correspondence: 12 months after last contact

6. Your rights

Under the GDPR, you have the right to access, correct, delete, restrict, port, and object to the processing of your personal data.

To exercise any of these rights, contact us at lars@indonesia-topup.com. We will respond within 30 days.

If you are not satisfied with our response, you may file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

7. Security

All data is encrypted in transit (TLS) and at rest (AES-256). We use EU data centers exclusively. Access to personal data is restricted to the business owner only.

8. Marketing emails

We only send marketing emails after a double opt-in: you first tick an optional checkbox, either at checkout or on your account page, and then confirm by clicking the link in a confirmation email we send you. No marketing emails are sent until that link is clicked.

The legal basis for marketing emails is your consent (Art. 6(1)(a) GDPR).

You can withdraw your consent at any time, either via the unsubscribe link included in every marketing email or by turning off the marketing toggle on your account page. Withdrawing consent does not affect transactional emails, such as order confirmations and delivery notifications, which continue regardless of your marketing preference.

Marketing emails are sent through the same email service provider listed as a processor above, under the same safeguards.

9. Changes to this policy

Material changes to this privacy policy will be communicated via email to registered users.