Privacy Policy

1. Controller

The controller of your personal data is DILMEX LIMITED (167-169 Great Portland Street, 5th Floor, London, England, W1W 5PF, United Kingdom; email: destek@dilmex.net). We process only the data needed to provide the service; your card and PayPal account details never reach us, PayPal takes the payment. If you live in Türkiye, the KVKK Privacy Notice also applies to you.

2. What we process and why

• Identity, contact and transaction details for the account, orders, code delivery and support; the codes you buy (stored encrypted, shown only to you) — performance of a contract.
• Your date of birth, once at your first purchase, to document the 18+ requirement and contractual capacity — performance of a contract and legal obligation. We do not ask for identity documents.
• Accounting and tax records, obligations under consumer law — legal obligation.
• For fraud prevention and security: your IP address and the country derived from it, the payer country and payer ID reported by PayPal, account and order history, records of when codes were viewed — legitimate interests. Orders with a high risk score calculated from these are held and reviewed by a member of our staff; no decision about you is based solely on automated processing. We do not block orders by where you are, we only show a region warning.
• We do not send marketing e-mails. Codes are never sent by e-mail; e-mails only tell you about the order and its delivery.

3. Cookies and browser storage

These cookies are strictly necessary for the service, so no consent is asked. We use no advertising, analytics or tracking cookies.

We count visits with Umami running on our own server: it uses no cookies, does not store your IP address and builds no profile of you; it keeps only aggregate counts such as page views, referring site, country and device type (legitimate interests).

• Session cookies (dilmex_key_*): needed to sign in, readable only by our server (httpOnly).
• Language (NEXT_LOCALE) and currency (dilmex_key_currency) cookies: remember your choices.
• Browser storage (localStorage): your basket and the coupon you entered stay in your own browser only.
• Bot check (Cloudflare Turnstile): on the sign-in, sign-up and password reset forms Cloudflare assesses technical signals from your browser (IP address, browser characteristics) to stop automated attacks; they are not used for advertising or tracking (legitimate interests).
• Error logging: technical errors on the site are recorded, with the page and browser details, in the error tracker on our own server (GlitchTip); form contents and passwords are not recorded (legitimate interests).

4. Transfers

Your data is processed in the United Kingdom and in the countries of our service providers: PayPal for payments, Mailgun (EU) for e-mail, DigitalOcean, Vercel and Cloudflare for hosting and storage. No personal data goes to our code suppliers; they only receive the product, the quantity and our order reference. Transfers outside the United Kingdom rely on adequacy regulations or standard contractual clauses (IDTA / UK Addendum).

5. Retention

Data is kept while your account is open and afterwards for the statutory retention periods (generally 6 years for accounting and tax records). When you delete your account your personal data is anonymised and the codes delivered to you are erased, so save any codes you have not used before deleting your account.

6. Your rights

You have the right to access your data, to have it corrected or erased, to restrict or object to its processing and to data portability. Send requests to destek@dilmex.net; they are answered within one month. You can export your data or ask for deletion in your account settings. Please raise any complaint about how we handle your data with us first; you may in any case complain to the UK data protection authority (Information Commissioner's Office, ico.org.uk); if you live in Türkiye, your rights under the KVKK Privacy Notice also apply.