Privacy notice

This notice explains how MYLVEN LTD, which operates mylven.com, uses personal data. We are the controller of the data described here. You can reach us about privacy at [email protected] or through the contact form.

What we collect

• Account data: your name, e-mail address and password (stored only as a one-way hash), and the date you accepted our terms.
• Order data: what you bought, prices, the delivery e-mail, the codes delivered to you and when you revealed them.
• Balance and payment data: top-up amounts, references and status, and the billing address you give for a card top-up (name, phone, street, city, postal code, country). Card numbers are entered on the payment provider’s page; we never see or store them.
• Messages: what you send us through the contact form or by e-mail.
• Technical data: IP address, approximate country derived from it, browser type and security logs, used to keep the shop working and to prevent fraud.

Why we use it, and on what legal basis

• To open and run your account, take payments to your balance, fulfil orders and send codes — performance of our contract with you.
• To keep invoices and transaction records — legal obligation under tax and accounting law.
• To prevent fraud, payment abuse and attacks on the shop, and to answer your messages — our legitimate interests in a safe, working service, balanced against your rights.
• To send service e-mails such as order and top-up confirmations — contract. We do not send marketing e-mail unless you have asked for it.

Who receives it

We share data only with service providers that help us run the shop, under contracts that require them to protect it: the card payment provider and its acquiring bank (for top-ups and 3-D Secure), our hosting and content-delivery provider, which also screens traffic for abuse, and our e-mail delivery provider. Distributors who supply codes receive order details needed to supply them, not your payment details. We disclose data to authorities only where the law requires it. We do not sell personal data.

International transfers

Some providers process data outside the UK or the European Economic Area. Where that happens, the transfer is protected by an adequacy decision or by standard contractual clauses (or the UK equivalent) and additional safeguards where needed.

How long we keep it

Account data is kept while your account is open. When you ask us to close it, we delete or anonymise it within 30 days, except records we must keep by law — invoices and transaction records are kept for the period that tax and accounting rules require. Security logs are kept for a short period and then deleted.

Your rights

Under the UK GDPR and the EU GDPR you can ask to access your data, correct it, have it erased, restrict or object to its use, and receive it in a portable format. Where we rely on legitimate interests you can object at any time. To use any of these rights, write to [email protected]; we answer within one month. You can also complain to a data protection authority — in the UK the Information Commissioner’s Office, in the EU the authority of the country where you live or work.

Security

Connections to mylven.com are encrypted, passwords are hashed, and codes are shown only after you choose to reveal them. Access to customer data is limited to the people who need it to serve you.

Cookies

We use only the cookies needed to run the shop. See our cookie policy.

Changes

If we change how we use personal data, we update this notice and, where the change matters to you, tell you by e-mail.