Privacy Policy

LootCodes Digital Pty Ltd (ABN 76 696 529 745, ACN 696 529 745), whose registered office is at Unit 18, 28-32 Sturdee Parade, Dee Why NSW 2099, Australia, operates LootCodes Wholesale: the partner portal at wholesale.lootcodes.com and our wholesale API. We are responsible for the personal information described in this policy and, where the GDPR or the UK GDPR applies, we are its controller.

This policy covers LootCodes Wholesale only. Our consumer store at www.lootcodes.com has its own Privacy Policy. The Terms & Conditions explain the rules of the partner relationship. Questions about this policy go to privacy@lootcodes.com.

Most of what we handle is information about businesses. This policy is about the information that relates to individuals, namely:

• people who apply for a partner account for their business;
• partners’ staff who use the Portal or the API, or who are our contacts;
• directors, owners and other people whose details or identity documents a partner gives us to verify its business;
• people whose account details a partner gives us so that we can deliver a top-up to them; and
• visitors to our public pages.

If you give us personal information about someone else, please make sure you are allowed to and that they know about this policy.

When you sign in, we set one cookie, __Host-lcw_portal_session, which keeps you signed in. Scripts on the page cannot read it, it is sent only over encrypted connections, it expires after at most 24 hours (5 minutes while we wait for your two-factor code), and it is removed when you sign out. The Portal cannot work without it.

Cloudflare, which protects our sites, may set a strictly necessary security cookie (such as __cf_bm) to tell people apart from automated traffic.

We do not use analytics, advertising or tracking cookies or tools on this site. Our fonts are served from our own site. Product images in the Portal can be loaded from the services that host them, which see your IP address when your browser fetches an image.

The last column gives our legal basis where the GDPR or the UK GDPR applies. Under Australian law we use personal information for the purposes for which we collected it and as the law otherwise allows.

We do not sell personal information, we do not use it to advertise to you or your customers, and we do not share your prices with other partners.

Orders. Simple rules check each order against your account limits and recent activity — the number of orders in the last hour, your daily spending limit, and how much of that limit a single product line uses. An order that trips a rule is held for a member of our team instead of being refused, and the amount stays on hold meanwhile. Orders above your per-order limit are refused automatically.

Deposits. A deposit is credited automatically when it matches an open deposit request, as the Terms & Conditions describe. Until a first deposit has been credited to your account, deposits are held for 24 hours before they are credited. A deposit can also be held for review, in which case a person decides.

You can ask us to look again at any of these outcomes by writing to support@lootcodes.com.

The deposit addresses we assign to your account, and every transfer to them, are recorded on public blockchains. Anyone can read that record, and neither we nor anyone else can change or delete it. Anyone who knows that an address belongs to your business can see its transfers, so treat your deposit addresses as public identifiers of your account with us.

To detect deposits, our servers ask public blockchain data services — currently TronGrid for TRON, a PublicNode server for BNB Smart Chain and TON Center for TON — about transfers to our deposit addresses. We send them those addresses, not your name or contact details.

We use these service providers, which handle personal information on our behalf and only for the purpose stated:

Where these providers store and process information is explained in section 9.

We also share information:

• with Binance or your bank, when you deposit with Binance Pay or by bank transfer — they process the payment and tell us about it;
• with the provider that delivers a top-up, which receives the recipient details and our order reference it needs to deliver it;
• with our professional advisers, auditors and insurers, where they need it;
• with police, regulators, courts and other authorities, when the law requires us to; and
• with a buyer of all or part of our business, who would have to handle it under this policy.

Within LootCodes, your information is held in systems we share with our consumer store, including our staff tools and our support desk. Our staff can see it only where their role requires it.

Our main systems are in the United States: Amazon Web Services (US East, North Virginia), Supabase (US East, Ohio) and Vercel (US East, Washington D.C., with pages delivered through its global network). Cloudflare, Resend, Sentry and the blockchain data services may process information in the United States and the other countries where they operate. People who work for us may access information from the countries where they are based.

This means we disclose personal information outside Australia, mainly to the United States. We choose providers that commit to protecting it, and where the GDPR or the UK GDPR requires, we rely on recognised transfer safeguards and contractual protections.

Information we delete can remain in backups until those backups are replaced.

• Connections to the Portal and the API are encrypted (HTTPS).
• Passwords are stored only as one-way hashes (scrypt), and recovery codes, session tokens and activation tokens only as one-way hashes.
• Two-factor secrets, API signing secrets and webhook signing secrets are encrypted with AES-256-GCM, using a key that is kept outside the database.
• Verification documents are kept in private storage that is not publicly accessible.
• The database tables for this service cannot be read with public credentials; only our own backend services can reach them.
• Two-factor authentication is required for partner sign-in, and sessions expire.
• Account and security events are logged, and you can see your own in the Portal’s Security page.
• Our staff use internal tools that require their own sign-in, and changes they make to partner accounts are recorded.

No system is completely secure. If a data breach is likely to cause you serious harm, we will tell you and the relevant authorities as the law requires.

You can ask us for access to the personal information we hold about you and ask us to correct it. You can also ask us to delete it where we are not required or entitled to keep it. Where the GDPR or the UK GDPR applies, you can also ask us to restrict how we use it, object to uses based on our legitimate interests, and receive a copy of information you gave us in a portable format.

Some things you can do yourself in the Portal: see your sessions and security activity, sign out other sessions, change your password, and manage your API keys and webhooks.

To make a request, write to privacy@lootcodes.com — from your account e-mail address if you have an account. We may need to confirm your identity first. We will respond within 30 days, or sooner if the law that applies to you requires. We do not charge for a request unless the law allows a reasonable fee. If we refuse a request, we will tell you why, unless the law prevents us, and how you can complain.

If you have a concern about how we handle your personal information, please write to privacy@lootcodes.com. We will respond within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (www.oaic.gov.au) or, if you are in the European Union or the United Kingdom, to your local data protection authority.

We may update this policy when our service or the law changes. We will publish each new version on this page with a new version number and date, and e-mail partners before a significant change takes effect. See section 15 to ask about any change.

• Privacy questions and requests: privacy@lootcodes.com
• Account and service support: support@lootcodes.com
• Legal notices: legal@lootcodes.com
• Post: LootCodes Digital Pty Ltd, Unit 18, 28-32 Sturdee Parade, Dee Why NSW 2099, Australia