Privacy Policy

1. Controller

The controller responsible for processing personal data on https://coinshawk.com is:

COINSHAWK c/o COCENTER, Koppoldstr. 1, 86551 Aichach, Germany Email: support@coinshawk.com

We have not appointed a data protection officer; please address all requests to the email above.

2. What we process and why

2.1 Visiting the website

When you open a page, our web server processes your IP address, the requested URL, date and time, referrer, browser and operating system. This is technically necessary to deliver the page and to detect abuse. Server logs are kept for a maximum of 14 days. We do not use third-party analytics or advertising tools, and our pages load no content from other websites except the bot protection described in section 3 and the live chat described in section 2.7.

Legal basis: legitimate interest in operating a secure website (Art. 6(1)(f) GDPR).

From time to time we compare different designs of this website (colours, fonts and shapes; the content, prices and terms are the same in every design). While a comparison runs, the cookie ch_skin stores which design you were shown, so it stays the same on your next visits, for at most 90 days. On our own server we count, per design and day, how many browsers were shown it and how often a card was added to the cart, and we store the design with an order you place. We evaluate these numbers only in totals, to decide which design works better; no profile of you is made, and nothing is shared with anyone. Search engines and our staff are not part of a comparison.

Legal basis: legitimate interest in improving our website (Art. 6(1)(f) GDPR).

2.2 Cart, session and settings

A session cookie stores your cart (product codes, amounts and quantities), your sign-in state, a partner code you entered and a security token that protects forms against cross-site request forgery. When you choose a language, country, currency or the light or dark display, we store that choice in a cookie in your browser. Your country and currency are first suggested from the language settings your browser sends; we do not locate you by your IP address. See the Cookie Policy.

Legal basis: performance of the contract and technically necessary (Art. 6(1)(b) and (f) GDPR). Storing these cookies in your browser is strictly necessary for the service you request (section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG).

2.3 Orders

To process an order we store your email address, the ordered products, prices and fees, the currency and exchange rate of your invoice, the language you ordered in, a partner code if one was used, the order status, your IP address and browser identifier at the time of ordering, the time you accepted our terms and the immediate-delivery notice, the payment reference and status reported by our payment provider (including the coin and amount received), and the delivered card codes and redemption links. If you pay through Binance, Coinbase, PayPal (USA) or Robinhood (USA), we also store which of them you chose, PayGate.to's reference for the payment, the coin and amount that reached our wallet and the blockchain transaction ids. We use this data to deliver your order, to send you order emails, to prevent fraud and to comply with accounting and anti-money-laundering obligations.

With each order we also record, as proof of the purchase and its delivery: the version of the Terms of Service, the Refund and Cancellation Policy and this Privacy Policy that applied when you ordered, the wording of the boxes you ticked at checkout, the language settings of your browser, and the time, IP address and browser each time the order page is opened, a Card's redemption link is followed, the order is found with the order lookup or its emails are sent again (no such record is made for our staff). We also record whether your mail server accepted our order emails, as reported by our email provider.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR); legal obligations (Art. 6(1)(c) GDPR); legitimate interest in fraud prevention and in establishing and defending legal claims (Art. 6(1)(f) GDPR).

2.4 Accounts

If you create an account we additionally store a username, a hashed password (we never see your password), whether and which email address you have confirmed, and the time, IP address and browser of each sign-in.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR); legitimate interest in protecting accounts (Art. 6(1)(f) GDPR).

2.5 Balance, CoinsHawk gift cards and Hawk Coins

For your account balance and your Hawk Coins we store every change with its date, amount, reason and the order it belongs to. When you redeem a CoinsHawk gift card we record the attempt with your account, IP address, time and result, so that repeated wrong codes can be blocked. Hawk Coins earned by an order placed without an account are kept under the order's email address until that address is confirmed on an account.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR); legitimate interest in preventing misuse (Art. 6(1)(f) GDPR).

2.6 Partner programme

If you open a partner link or enter a partner code, we store the code in your session or in a cookie and with your order, so that the discount is applied and the partner is credited. The partner sees the order number and the commission, but not your email address, your Cards or other details of your order.

If you join the partner programme, we store your code, the website or channel you named and the message you sent with an application, your rates, your commission and its history, and your payout requests, including the wallet address you give for a payout in cryptocurrency.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR); legitimate interest in running the programme and preventing abuse (Art. 6(1)(f) GDPR).

2.7 Contact

When you write to us we process the data you provide (name, email address, order number, message) and the IP address of the contact form to answer your request.

Legal basis: performance of the contract or pre-contractual measures (Art. 6(1)(b) GDPR); legitimate interest in documenting support requests (Art. 6(1)(f) GDPR).

Our pages show a live chat window provided by Tidio. When a page loads, the chat is loaded from Tidio's servers, which receive your IP address, technical browser data, the address and title of the page you are on and its language. Tidio stores a random visitor identifier in your browser so that a conversation continues from page to page. If you write in the chat, Tidio stores your messages and any name or email address you give there and shows them to our staff. The chat is not loaded on pages whose address is private: the order page opened through its link, card links, the password reset page and the email confirmation page. Never send card codes in the chat.

Legal basis: legitimate interest in offering direct support (Art. 6(1)(f) GDPR); for messages about an order, performance of the contract (Art. 6(1)(b) GDPR).

2.8 Fraud prevention, limits and identity checks

We apply order limits per email address and may review orders that exceed thresholds, show inconsistent data or match known fraud patterns, for example the number of orders from one IP address or email address in a short time, or whether an email address belongs to a disposable email service. For such orders we may ask you for additional information before delivery.

For some payment methods other than cryptocurrency we apply spending tiers. Up to a first limit no information is needed. Above it we ask account holders for their name, date of birth and address, which we store with the account. Above a second limit, or when an order shows risk indicators, we ask for an identity check through our verification provider (see section 3): you photograph an identity document and take a selfie on the provider's page. We receive and store only the outcome of the check (approved, declined or under review), the document type and issuing country, the results of the liveness, face match, IP and anti-money-laundering checks, and the provider's warning labels. The images and the document data stay with the provider.

Legal basis: legitimate interest in preventing fraud and misuse (Art. 6(1)(f) GDPR); legal obligations (Art. 6(1)(c) GDPR).

2.9 Emails

We send emails about your orders, your account (confirmation of your address, password reset), identity checks and, if you are a partner, the partner programme. We do not send newsletters or advertising.

2.10 Internal notifications

Our staff are notified of paid orders, delivery results, identity checks and partner applications and payouts in a private channel on Discord. These notifications contain the order number, amounts, the Cards ordered (brand, value and number), your username and account number, a shortened form of your email address (for example jo***@gmail.com), the order's risk score and the outcome of a check; for partner applications also the website and message given. They never contain your name, address, date of birth, IP address, document data, wallet address or card codes.

Legal basis: legitimate interest in handling orders and checks quickly (Art. 6(1)(f) GDPR).

3. Recipients and processors

We share data only as far as necessary to run the service:

• Relograde (Relograde B.V., Netherlands): our main card distributor. We transmit the ordered product, its value and quantity and an order reference. Relograde does not receive your name or email address.
• Reloadly (Reloadly, Inc., USA): our second card distributor, for Cards that Relograde does not offer. For such a Card we transmit the ordered product, its value and quantity and an order reference. Reloadly does not receive your name or email address.
• CryptoPayr (CryptoPAYR Limited): our cryptocurrency payment service provider. We transmit the invoice amount and currency, the order reference and the addresses to return to. The provider processes the blockchain transaction and stores the transaction data under its own privacy policy. If we refund an order through the provider, we transmit your email address so the provider can send you the claim link.
• PayGate.to (payment service for crypto purchases): only when you pay through Binance, Coinbase, PayPal (USA) or Robinhood (USA). We transmit your email address, the invoice amount in US dollars and the provider you chose. PayGate.to sends you to that provider and reports the transfer back to us. The provider (Binance, Coinbase, PayPal or Robinhood) processes your payment and account data as the seller of the cryptocurrency, under its own terms and privacy policy.
• Mailgun (Mailgun Technologies, Inc., USA): email delivery. Processes recipient address, subject and message content to deliver our emails. Our account uses the provider's US region.
• Google reCAPTCHA (Google Ireland Limited, Ireland, and Google LLC, USA) or Cloudflare Turnstile (Cloudflare, Inc., USA): bot protection on the sign-in, registration, password reset, contact and checkout forms; one of the two is switched on at a time. Processes your IP address and technical browser data (for reCAPTCHA also cookies Google has already set in your browser) to tell humans from bots. Google processes this data under its own privacy policy (https://policies.google.com/privacy).
• Didit (identity verification): only when you start an identity check from your account. We transmit an account reference, your email address and, if you entered them, your name and date of birth for comparison with the document. Didit processes the document images, the selfie and the extracted data under its own privacy policy and sends us the outcome.
• Discord (Discord Inc., USA): hosts the private staff channel described in section 2.10.
• Tidio (Tidio LLC, USA): the live chat described in section 2.7. Processes the technical data of your visit and the content of your chat messages to provide the chat.
• Hosting provider: operates the servers in the European Union on which the website and database run.

When you open the redemption page of a Card, you leave our website and the Issuer's or distributor's privacy policy applies there.

Our processors are bound by data processing agreements or by their published data processing terms. We do not sell personal data and do not use it for advertising.

4. International transfers

COINSHAWK is established in Germany. Our servers are located in the European Union. Some of the providers in section 3 process data in the United States or other countries outside the European Union. Where data is transferred to a country without an adequacy decision, we rely on the EU-U.S. Data Privacy Framework where the provider is certified, or on standard contractual clauses or other safeguards under Chapter V GDPR.

5. Retention

• Server logs: 14 days.
• Session data: 24 hours.
• The design cookie (section 2.1): 90 days. The totals per design contain no data about you.
• Orders, invoices and payment records, including the history of balances, Hawk Coins and partner commission: 10 years after the end of the year of the order (accounting and anti-money-laundering obligations). Card codes are retained with the order so you can retrieve them.
• Payment and webhook logs: 180 days.
• Email delivery logs and the access record of an order (section 2.3): 12 months.
• The checkout record of an order (section 2.3): 540 days.
• Sign-in records: 12 months.
• Contact messages: 12 months after they were sent, once answered.
• Gift card redemption attempts: 90 days.
• Internal notifications: deleted from our database 30 days after sending; they remain in the private Discord channel until we delete them there.
• Live chat conversations: kept in Tidio until we delete them there, at the latest 12 months after the conversation ended.
• Name, date of birth, address and identity check outcomes: as long as your account exists, or until you remove the details in your account.
• Accounts: until you ask us to delete your account; order records are then kept in anonymised form for the retention period above.

6. Your rights

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict processing, to data portability, to object to processing based on legitimate interests, and to withdraw consent at any time with effect for the future. You also have the right to lodge a complaint with a supervisory authority, in particular in the member state of your residence, your place of work or the place of the alleged infringement.

The supervisory authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.

To exercise your rights, email support@coinshawk.com from the address linked to your order or account. We may ask you to verify your identity.

7. Security

All traffic is encrypted (HTTPS). Passwords are stored as salted hashes. CoinsHawk gift card codes are stored only as a one-way hash. Card codes are accessible only through a private order link containing a random 256-bit token, or through your signed-in account. Administrative access is restricted and logged.

8. Children

The Website is not directed at persons under 18, and we do not knowingly process their data.

9. Changes

We update this policy when our processing changes. The current version is always available at https://coinshawk.com/legal/privacy-policy.

Last updated 8 November 2026.