Privacy & Cookies Policy

1 Who We Are

PlanetCaShop is a digital marketplace that allows registered users to purchase Bitcoin (BTC) and Ethereum (ETH) voucher codes and cryptocurrency gift cards. We are committed to protecting your personal information and your right to privacy.

This Privacy & Cookies Policy explains what data we collect, why we collect it, how we protect it, and your rights regarding your personal information. By registering an account or using our platform, you acknowledge that you have read and understood this policy.

2 Data We Collect

We only collect data that is strictly necessary to provide our services, complete your transactions, and comply with legal obligations. We do not sell your data.

2.1 Registration Data

When you create a PlanetCaShop account, we collect:

Full name — for identity verification and transaction records.
Email address — to deliver purchased codes, transaction confirmations, and essential account communications.
Phone number — for two-factor authentication (2FA) and fraud prevention alerts.
Date of birth — to confirm you are at least 18 years of age.
Country of residence — for compliance with applicable regional regulations.
Password — stored encrypted using industry-standard hashing (bcrypt). We never store your plain-text password.

2.2 Identity Verification (KYC) Data

For transactions above certain thresholds or upon security review, we may request:

Government-issued photo ID (passport, national ID, or driver's license).
Proof of address (utility bill or bank statement, dated within 90 days).
Facial biometric verification (selfie for liveness check).

2.3 Transaction Data

For each purchase, we record:

Products purchased (type, amount, denomination).
Payment method type (card type, last 4 digits — full card numbers are never stored by us).
Transaction amount, date, and time.
Delivery status and confirmation timestamp.

2.4 Technical & Usage Data

Automatically collected when you visit our platform:

IP address and approximate geolocation.
Browser type and version, operating system.
Pages visited, time spent, click patterns.
Referral URL (how you arrived at our site).

3 Purpose of Data Collection

We collect and process your personal data exclusively for the following purposes:

Data Type	Purpose
Email address	Deliver purchased cryptocurrency codes, order confirmations, security alerts, and essential account notifications.
Phone number	Two-factor authentication (2FA), fraud prevention SMS alerts.
Full name & DOB	Identity verification to prevent fraud and comply with AML regulations.
KYC documents	Verify identity for high-value or flagged transactions as required by law.
Payment data	Process transactions securely (via PCI-DSS compliant payment processors).
IP & device data	Fraud detection, security monitoring, and platform performance optimization.

Your personal data is never used for marketing purposes without your explicit consent. We do not send promotional emails unless you have opted in.

4 Legal Basis for Processing

We process your personal data based on the following legal grounds:

Contractual necessity — Processing is required to fulfill our contract with you (i.e., to complete your purchase and deliver your code).
Legal obligation — We may be required to collect certain data to comply with anti-money laundering (AML) and know-your-customer (KYC) regulations.
Legitimate interest — Fraud prevention, security monitoring, and platform integrity.
Consent — For optional processing such as marketing communications or analytics cookies, where you have given explicit consent.

5 Data Sharing & Disclosure

PlanetCaShop does not sell, rent, or trade your personal data to any third party. Period.

We may share your data only in the following limited circumstances:

Payment processors — We use PCI-DSS compliant third-party payment gateways to process card transactions. These processors receive only the data necessary to process the payment and are bound by strict confidentiality agreements.
Identity verification providers — KYC document verification may be handled by accredited third-party identity verification services that are contractually obligated to protect your data.
Legal authorities — We may disclose data if required to do so by law, regulation, court order, or governmental authority. We will notify you of such requests where legally permitted.
Business transfers — In the event of a merger, acquisition, or sale of assets, user data may be transferred as part of the transaction, subject to equivalent privacy protections.

Any third party with whom we share data is required to process it only for the specified purpose and in compliance with applicable data protection laws.

6 Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

Account data: Retained for the duration of your account and up to 5 years after account closure, as required for financial compliance.
Transaction records: Retained for a minimum of 7 years as required by financial regulations.
KYC documents: Retained for 5 years after the last transaction or as required by applicable law.
Technical/usage logs: Retained for 12 months for security and fraud analysis.

Upon expiry of retention periods, data is securely deleted or anonymized.

7 Data Security

We implement industry-standard technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:

All data transmitted between your browser and our servers is encrypted using TLS/SSL (HTTPS).
Passwords are hashed using bcrypt — we never store your plain-text password.
Sensitive account actions require two-factor authentication (2FA).
Payment card data is handled exclusively by PCI-DSS Level 1 certified payment processors — we never store full card numbers.
Access to user data is restricted to authorized personnel on a strict need-to-know basis.
We conduct regular security audits and vulnerability assessments.

Despite these measures, no method of transmission over the internet is 100% secure. We encourage you to use a strong, unique password and enable 2FA on your account.

8 Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

Right of access — Request a copy of the personal data we hold about you.
Right to rectification — Request correction of inaccurate or incomplete data.
Right to erasure — Request deletion of your data ("right to be forgotten"), subject to legal retention obligations.
Right to portability — Receive your data in a structured, machine-readable format.
Right to object — Object to processing based on legitimate interest.
Right to restrict processing — Request limitation of processing under certain circumstances.
Right to withdraw consent — Withdraw consent at any time for consent-based processing (e.g., marketing emails).

To exercise any of these rights, contact us at support@planetcashop.com. We will respond within 30 days. We may require identity verification before processing your request.

9 Cookies Policy

Our website uses cookies — small text files stored on your device — to ensure proper functionality and improve your experience.

Types of Cookies We Use

Cookie Name / Type	Category	Purpose	Duration
Session cookie (laravel_session)	Essential	Maintains your login session and CSRF protection.	Session
XSRF-TOKEN	Essential	Protects against cross-site request forgery attacks.	Session
remember_me	Functional	Keeps you logged in between visits if you select "Remember me".	30 days
currency_pref	Functional	Remembers your preferred display currency.	1 year
_ga, _gid (Google Analytics)	Analytics	Anonymous usage statistics to improve platform performance. Only set with your consent.	2 years / 24h

Managing Cookies

You can control and delete cookies through your browser settings. Note that disabling essential cookies will impair site functionality and may prevent you from logging in. Analytics cookies can be declined without affecting core functionality.

For more information on managing cookies, visit www.allaboutcookies.org.

10 Children's Privacy

PlanetCaShop services are intended exclusively for individuals who are 18 years of age or older. We do not knowingly collect personal data from minors. If we discover that a user under 18 has registered, we will immediately delete their account and all associated data. If you believe a minor has registered, please contact us immediately at support@planetcashop.com.

11 International Data Transfers

PlanetCaShop operates globally and your data may be stored or processed in countries outside your home jurisdiction. We ensure that any international transfers are subject to appropriate safeguards, such as standard contractual clauses (SCCs) or equivalent data protection agreements, to ensure your data receives the same level of protection regardless of where it is processed.

12 Changes to This Policy

We may update this Privacy & Cookies Policy periodically to reflect changes in our practices, technology, or applicable laws. When we make material changes, we will notify registered users via email and update the "Last updated" date at the top of this document. We encourage you to review this policy periodically.

13 Contact Us

For any privacy-related questions, data requests, or concerns, please contact our Data Protection team:

Email: support@planetcashop.com
Support Hours: Monday to Sunday, 10:00 AM – 11:00 PM (Eastern Time, USA)

We aim to respond to all privacy inquiries within 5 business days and resolve requests within 30 calendar days.