Privacy Policy

This policy explains what we do with personal data when you use NolBoost. The data controller is NolBoost FZ-LLC, Office 1204, Business Central Towers, Dubai Media City, Dubai, United Arab Emirates. For any privacy question, write to legal@nolboost.com.

1. What we collect

Only what a top-up needs, plus the technical minimum required to run a website securely.

Transaction data: The transport card number you enter, the amount, the service fee, the total, the reference code and the time of the transaction.
Contact data: Your email address, and your mobile number if you choose to give one. The mobile number is optional and the form works without it.
Payment outcome data: Whether the payment succeeded, its provider reference, and the last four digits and card scheme as reported back to us. We never receive the full bank card number, expiry date or security code.
Support data: The content of messages you send us and our replies, so a conversation has a history.
Technical data: IP address, browser and device type, pages requested and timestamps, recorded in server logs.

We do not ask for your name, your address, your date of birth or any identity document, because a top-up does not need them.

2. Why we use it

We do not use your data for automated decisions that have a legal effect on you, and we do not profile you for advertising.

To perform the contract: Processing your top-up, taking payment, sending the receipt and answering support requests about it.
To meet legal obligations: Keeping accounting and tax records, and complying with anti-fraud and anti-money-laundering requirements.
For our legitimate interests: Preventing fraud and abuse, keeping the service secure and available, and understanding aggregate usage so we can improve it.
With your consent: Anything optional, such as non-essential cookies. Consent can be withdrawn at any time, and withdrawing it does not affect a top-up already made.

3. Payment data

Your bank card details are entered on the payment provider’s own pages, under its own privacy policy, and are never transmitted to or stored by us. What we receive is the outcome of the payment and a reference for it.

This is a deliberate design choice: data we never hold cannot be lost by us. It also keeps our systems outside the scope of full card-data compliance, which is better for everyone.

We share personal data only where it is necessary, and only with categories of recipient listed here.

The payment provider, to take your payment and to handle refunds and chargebacks.
The top-up processing partner, which receives the card number and amount in order to queue the credit.
Our email delivery provider, to send your receipt.
Our hosting and infrastructure providers, which store the data on our behalf.
Professional advisers, auditors, or a competent authority where we are legally required to disclose.

We do not sell personal data, rent it, or share it with advertising networks or data brokers. Our processors act on our instructions under written contracts and may not use your data for their own purposes.

5. International transfers

Our infrastructure is hosted in the United Arab Emirates and the European Union. Where a processor is outside the UAE, we rely on contractual safeguards, such as standard contractual clauses, to keep the protection of your data at an equivalent level.

You can ask us which countries are involved for a particular part of the service, and we will tell you.

6. How long we keep it

When a retention period ends, data is deleted or irreversibly anonymised. We do not keep data indefinitely on the basis that it might one day be useful.

Transaction and payment records: Five years from the transaction, to meet accounting, tax and anti-fraud obligations.
Support correspondence: Two years from the last message in the thread.
Server logs: Ninety days, then deleted or aggregated so individuals can no longer be identified.
Optional analytics data: Fourteen months, if you consented to it.

7. Your rights

Subject to applicable law, you may ask us to:

confirm what personal data we hold about you and give you a copy;
correct data that is inaccurate or incomplete;
delete data we no longer have a lawful reason to keep;
restrict or object to a particular use of your data;
provide your data in a portable, machine-readable form;
withdraw a consent you previously gave.

Write to legal@nolboost.com and we will respond within 30 days. To find your records we usually need the reference code or the email address used for the top-up — please include one. If we cannot act on a request, we will explain why.

8. Security

No system is perfect. If a breach ever affects your personal data and creates a real risk to you, we will notify you and the relevant authority as the law requires, and tell you what we are doing about it.

All traffic to and from this site is encrypted in transit using TLS.
Data is encrypted at rest, and access is restricted to staff who need it for their work.
Administrative access requires multi-factor authentication and is logged.
Bank card data is never in our systems at all.
We test and patch our infrastructure on a regular schedule and review access rights periodically.

9. Children

The service is for adults, and we do not knowingly collect data from anyone under 18. An adult may of course top up a card used by a child; in that case the adult is our customer and it is the adult’s data we hold.

10. Cookies

We use a small number of cookies, most of them strictly necessary to make the form and the language choice work. The Cookie Policy lists each one, what it does and how long it lasts.

11. Changes to this policy

When this policy changes, the date at the top of the page changes with it. If a change materially affects how we use your data, we will make it prominent rather than quietly editing the text.

12. Contact and complaints

Privacy questions and requests: legal@nolboost.com. General support: support@nolboost.com.

If you are not satisfied with our response, you may complain to the competent data protection authority in your jurisdiction. We would appreciate the chance to put it right first.