1. The short version
We collect only the information that is needed to process a hafilat top-up and to reply to you when you write in. We do not sell data, we do not run advertising trackers, and we do not load chat widgets that follow you across the web.
2. What we collect
2.1 When you top up a card
- The hafilat card number you enter (10 digits) and the chosen amount.
- The card category and, for Personal cards, the cardholder name.
- Payment data, which is captured by our PCI-compliant payment processor — we do not see or store the full card number, CVV, or 3-D Secure password.
- An email address, but only if you provide one for a receipt.
- A mobile number, but only if you provide one for SMS confirmation.
2.2 When you write to us
- Your name and email address, plus the contents of your message.
- Any context you choose to share (e.g. the last four digits of a card number).
2.3 Site usage
- Standard server logs (IP address, browser identifier, requested page, timestamp) used for security and to find faults. Logs are kept for thirty days and are not joined to personal accounts.
- One small first-party cookie remembers whether you have dismissed the cookie note.
3. Why we use it
- To process a top up bus card transaction and to forward the credit to the hafilat network.
- To send a receipt or an SMS, when you ask for one.
- To reply to questions sent through the contact form, email or WhatsApp.
- To keep the site running and protect it from abuse.
4. Who we share data with
We share the bare minimum needed to complete the transaction:
- The PCI-compliant payment processor, to take the card payment.
- The hafilat network, to forward the chosen amount onto the card.
- Service providers that host this website and provide email delivery.
We do not sell your data and we do not pass it to advertising platforms.
5. How long we keep it
Transaction records are kept for as long as is needed to issue receipts, handle refunds, and meet legal record-keeping requirements. Contact emails are kept until the question is resolved and for a short period afterwards. Server logs are kept for thirty days.
6. Your rights
You can ask us to:
- tell you what information we hold about you;
- correct anything that is wrong;
- delete data we no longer need to keep;
- limit how we use your data while a question is being resolved.
Write to care@topupbuscard.org with a short description of your request.
7. Cookies
The site uses one small first-party cookie to remember that you have seen the cookie note. No third-party analytics or advertising cookies are loaded on initial visit. If we ever change this, the cookie note will be updated.
8. Changes to this notice
If the way we handle data changes, this notice will be updated and the date at the top of the page will be refreshed. Material changes will be highlighted on the home page for a short period.
9. Contact
Privacy questions and data requests: care@topupbuscard.org. Postal address is listed on the Contact page.