Choose Your Games
Last updated: 11 September 2026
This policy explains what PandaPlay does with your personal data. PandaPlay is an independent provider of video game services, operated from Hong Kong SAR. For anything in this policy, write to support@mypandaplay.com.
1. What we collect
| Data | When |
|---|---|
| Email address | When you order, sign in with a one-time code, or contact us |
| Name and billing address | At checkout, where the payment method requires it |
| Order details | What you bought, options chosen, price, order status |
| Game identifiers | Activision ID, Helldivers 2 friend code, Xbox gamertag, Steam profile, platform – only where the service needs it to deliver |
| Account credentials | Only for services that require sign-in (some boosting and Comfort Trade orders), kept encrypted and deleted 7 days after the order completes – see section 4 |
| Discord username | If you talk to us on Discord or give it as a contact method |
| Messages | Support emails, contact form submissions, Discord tickets |
| Order ticket | What you and our staff write in your order ticket, files posted there (such as delivery screenshots), and when you confirm a delivery or report a problem, with the IP address it came from |
| Technical data | IP address, browser and device type, and pages requested, in ordinary server logs |
We never see your full card number. Card details are entered on the payment provider’s own page and never reach our server. We only receive the result: paid or not, plus the last four digits and card brand for reference.
2. Why we use it, and on what basis
- To deliver your order and to talk to you about it – performance of a contract.
- To take payment and prevent fraud and money laundering – contract, legal obligation, and our legitimate interest in not being defrauded.
- To handle refunds, disputes and chargebacks, including submitting order evidence to a bank – contract and legitimate interest.
- To keep the site working and secure – legitimate interest.
- To keep accounting records – legal obligation.
We do not sell your data, we do not use it to build advertising profiles, and we do not send marketing email unless you ask us to.
3. Who we share it with
- Payment providers – Stripe, PayPal, and (for crypto orders) NOWPayments. They act as their own controllers for the payment and have their own privacy policies.
- Our hosting provider, which stores the site and its database.
- The person fulfilling your order – a vetted worker receives only what is needed to deliver: the service bought, the game identifier or session details, and your order ticket conversation. They do not receive your billing address or payment data.
- Google Fonts – the site loads its typeface from Google’s servers, so your IP address reaches Google when a page loads.
- Google address suggestions – the billing address box at checkout offers autocomplete. It is provided by our payment provider’s address component, which sends what you type in that box to Google in order to return suggestions. If you would rather nothing was sent, ignore the suggestions and type the address out in full.
- Google preferred-source button – the “Add us on Google” button at the bottom of every page. Google’s script loads only when you point at, tab to or press that button, and it then receives your IP address and the page you are on. The window it opens is Google’s own and runs under Google’s privacy policy. If you never touch the button, nothing is sent.
- tawk.to – the live chat window. It loads only when you open it, and it then receives your IP address, the page you are on, and whatever you type into the chat. If you never open the chat, nothing is sent.
- Trustpilot – when an order is completed, we send Trustpilot your name, email address and order number so it can email you an invitation to review us. Trustpilot acts as its own controller for reviews and has its own privacy policy. You do not have to leave a review, and you can ignore or unsubscribe from the invitation.
- Discord, if you choose to contact us there or join our server. That conversation is subject to Discord’s own policy.
- Authorities or a bank, where we are legally required to respond or where we are defending a dispute.
Some of these providers are outside Hong Kong, including in the EU and the United States, so your data may be transferred internationally. Where EU or UK law applies, those transfers rely on the providers’ standard contractual clauses.
4. Account credentials
Some services cannot be delivered without signing in to your account. When that is the case you put the sign-in into the encrypted account box on your order ticket – not into the ticket chat, not by email, and never in a public channel. It is stored encrypted, only the staff member working on your order can open it, and every time they do is logged. We use it only for the service you bought and delete it automatically 7 days after the order completes, so that we can still fix a problem you report in that time. Change your password as soon as the order is complete.
If you paste a password into the ticket chat by mistake, we move it into the box and remove it from the conversation. Account logins we deliver to you sit in the same box and are deleted on the same schedule; if you ordered as a guest, we email you a one-time code before showing them. We never change your email or recovery settings.
5. How long we keep it
- Order and payment records – up to 7 years, for accounting and dispute purposes.
- Support conversations – up to 24 months.
- Order ticket messages – kept with the order record (up to 7 years), because they show what was delivered and when. Files and screenshots posted in the ticket are deleted after 180 days.
- Game identifiers – kept with the order record, since they are the proof of what was delivered where.
- Account credentials – deleted automatically 7 days after the order completes.
- Server logs – a short rolling window, typically weeks.
6. Cookies and local storage
We use no analytics, advertising or tracking cookies. No Google Analytics, no advertising pixels, no third-party trackers. What the site does use:
- Shopping and account cookies set by WooCommerce – your cart, your session, and staying signed in. Without these the shop cannot work.
- Live chat cookies set by tawk.to, but only from the moment you open the chat window – they keep your conversation attached to you if you reload the page. They are not used for analytics or advertising.
- A theme preference stored in your browser (light or dark), which never leaves your device.
- A record of your cookie notice choice, so we stop showing it.
- A creator-referral cookie, set only if you arrive through a creator’s link. It records which creator code sent you, for 30 days, so that we can pay them for the referral. It is not used for analytics or advertising, and it is not shared with anyone.
- Security and caching cookies set by our host when needed to serve pages.
You can clear or block cookies in your browser. Blocking the shopping cookies will break checkout.
7. Your rights
You can ask us to give you a copy of your data, correct it, delete it, or restrict how we use it, and you can object to processing based on legitimate interests. Write to support@mypandaplay.com from the email address on the order and we will answer within 30 days.
Deletion has limits: we must keep order and payment records for the periods above, so we can delete your contact details and game identifiers but not the fact that a transaction happened.
If you are in the EU or UK you may also complain to your national data protection authority. In Hong Kong, the Office of the Privacy Commissioner for Personal Data handles data access and correction complaints.
8. Security
The site runs over HTTPS, payment pages are hosted by the payment providers, and sign-in uses a one-time email code rather than a stored password, and account logins in the order ticket are stored encrypted. Order ticket links contain a private key – keep yours to yourself; we can replace it at any time. No system is perfect; if a breach ever affects your data we will tell you and the relevant authority where the law requires it.
9. Children
The site is not for people under 18. We do not knowingly collect data from children. If you believe a child has given us data, write to us and we will delete it.
10. Changes
We may update this policy; the date at the top shows when it last changed. Material changes will be noted on the site.
