Coda Payments

Privacy Policy

Effective date:        [•]

Last updated:         [•]

Table of Contents

1. Scope and Application of Policy
2. Collection of Personal Data
3. Storage of Personal Data
4. Legal Basis of our Processing
5. Use and Disclosure of Personal Data
6. Your choices, rights and exceptions
7. California residents' privacy rights
8. Retention and Disposal of Personal Data
9. Data Processors
10. Security
11. International Transfer of Personal Data
12. Collection of Statistical Data
13. Use by Minors
14. Links to Other Websites
15. Contact Us

1. Scope and Application of Policy

1. Coda US LLC. (“Coda US”) and its affiliates including Coda Payments Pte. Ltd. (“Coda Singapore”) (collectively referred to as “Coda” and “we”, “us”, or “our”) respect the privacy rights of its users and unreservedly acknowledges the importance of protecting all the information you share with us. Coda only collects and processes Personal Data from you where it is necessary for us to do so or where it is relevant to our dealings with you. To meet this commitment, we have adopted this Privacy Policy (the “Policy”). This Policy sets out our privacy practices in respect of the collection, processing, use, disclosure, transfer, retention, storage, and disposal of your Personal Data (as defined in Section 1.3 below) when we provide you with our services (“Coda Services”), and shall apply if you are residing in or located in the United States (“US”). In the event of any conflict between this Policy and any other privacy policy on our Platform, this Policy shall control to the extent necessary to resolve the conflict.

2. When you accept this Policy, you agree to the collection, processing, use, disclosure, transfer, retention or storage, and disposal of your Personal Data in the manner described in this Policy.

3. “Personal Data” shall refer to your personal information as an individual, whether true or not, from which you can be identified either by itself, or together with other information to which we have or are likely to have access. The Personal Data that we collect and process may include:

1. Your first name and last name;
2. Email address;
3. Mobile number (or MSISDN);
4. Publisher affiliation such as in-game/in-app ID and/or IP address;
5. Cookies and/or statistical/analytical data, such as your browsing behaviour and/or your device information, to the extent that you may be identified through these;
6. Documentation that may help us to verify the accuracy of the information you have provided, such as proof of identity;
7. Your social media links or public profiles, and any personal information that may be visible thereon, which you may provide to us in the course of customer support dealings;
8. Details in your curriculum vitae or resume, which you may provide to us in the course of applying for job openings;
9. Billing address details such as billing street, address line, ZIP code, city, state;
10. Account passwords that you may create; and
11. Any other personal information that you may provide to us in the course of using the Coda Services.

4. This Policy only applies to Personal Data which is in our possession or under our control.

5. The collection and processing of your Personal Data enable you to make purchases from us via Coda’s mobile platform, server or database applications, or website at Codashop.com (the “Platform”).

6. We reserve the right to amend this Policy from time to time. Any amendments will be made available and published on our Platform and will take effect on the effective date stipulated herein above. You may determine if any such revision has taken place by referring to the date on which this Policy was last updated set out herein above. In relation to any material changes, we will notify you either, by prominently posting a notice of such changes before they take effect or by directly sending you a notification via email. We recommend that you check this Policy periodically to review the latest version. To the extent permitted under applicable law, your continued use of the Coda Services after an amendment constitutes your acknowledgement and acceptance of such changes.

2. Collection of Personal Data

7. When you use the Coda Services or communicate with us, we collect your Personal Data. In these instances, you may provide your Personal Data to us directly, or it may be shared with us by our affiliates, your mobile network operator or the relevant third-party payment channel operator (“Payment Channels”), or the publisher of digital products (“Publishers”), pursuant to your consent given to these third parties.

8. You may also choose to submit Personal Data to us via other methods, including:

1. in response to our communications;
2. through social media or online forums;
3. through participation in an offer, program or promotion conducted by us;
4. while applying to any job opportunity via the "Careers" page on www.codapayments.com or https://jobs.lever.co/codapayments;
5. when you sign up for our newsletter; and/or
6. when you fill in the Partnerships and Marketing enquiry form on our website www.codapayments.com.

9. We also collect transaction information, such as purchase amount, date of purchase, information about the digital content, goods and/or services that you are purchasing (“Transaction Data”), in order to pursue our legitimate interests and to abide by our contractual obligation as per our Terms and Conditions, to provide you access to the Coda Services and/or our Platform. In most cases, these are not considered as Personal Data since your identity will not be apparent from them. However, to the extent that your identity may be determined from the Transaction Data, they will be considered as Personal Data under Section 1.3 and processed as Personal Data under this Policy. You agree to our collection of such Transaction Data from you when you use the Coda Services and/or our Platform.

10. You must provide us with information which is accurate and not misleading. In this connection, we reserve the right to request for documentation to verify the information that you provide to us.

11. Information that we may process but is not directly collected by us: Please note that we process the following credit card details i.e. bank identification number (first 6 digits of your credit card number which identifies the bank), and last 4 digits of the credit card number that you may submit to Payment Channels. We process these credit card details for the purposes of fraud detection and verification. These credit card details aren’t directly collected by us and therefore, we recommend you to reach out to the relevant Payment Channel to whom you have submitted such credit card details, in case of any concerns. We also recommend you to read the privacy policy of the relevant Payment Channel to whom you have submitted credit card details, as the terms of that privacy policy is applicable to you with respect to the processing of your credit card details.

3. Storage of your Personal Data

We store your Personal Data in AWS servers located in N. California. Please note that with respect to the billing address details (Sub-section (i) of Section 1.3), we only store state and ZIP code. However, please note that in order to process orders and to provide customer service/support, certain Personal Data is transferred to Singapore as well as other countries by our Processors (For detailed information please refer to Section 9 and 11). 

4. Legal Basis of our Processing

12. We process Personal Data only if at least one of the following applies:

1. You have given consent to the processing of your Personal Data;
2. The existence of our legitimate interest, or that of a third party, which justifies that we process the Personal Data;
3. The performance of a contract between you and us requires that we process the Personal Data; and/or
4. We are required to comply with legal and regulatory obligations, which require the processing of the Personal Data concerned.

13. We have set out a table below to help you understand the legal basis for collecting each of the Personal Data:

5. Use and Disclosure of Personal Data 

14. Your Personal Data shall be processed for the following purposes:

1. Transaction processing and content delivery;
2. Marketing and promotional campaigns; and
3. Other permitted uses and disclosures.

15. Content Delivery

1. Coda US provides content distribution services in the US via Codashop, and sells the relevant codes to you. 

2. As an online distributor of digital content, and provider of related services, Coda will use the Personal Data collected from you and share it with third parties such as Zendesk, AWS, Google Analytics, Segment, Avalara and Facebook (“Processors”), including our affiliates, the Payment Channels, and Publishers, for the purpose of providing you with the Coda Services, or where it is a necessary part of doing business with you.

3. Your Personal Data shall also be used for the following purposes:

1. Facilitating your use of the Coda Services;
2. Processing and verifying your online transactions and payments on our Platform;
3. Resolving any disputes in relation to your transaction;
4. Mitigating fraud;
5. Informing you about products, services or promotional offers that you might find interesting if you have chosen to receive these types of communications;
6. Enforcing our contractual rights; and
7. Providing you with information which you have requested from us.

‍

4. For the foregoing purposes, your Personal Data will be shared between Coda US and the following:

1. The Publisher supplying the content to Coda;      
2. The Payment Channel that you have selected as your method of payment; and
3. Coda Singapore and Processors.

If you reside or are located in the United States where Coda US is present, you understand that Coda US acts as the controller of your Personal Data, and Coda Singapore is the processor, performing processing on behalf of the former.

16. Marketing and Promotional Campaigns

5. From time to time, we run promotional campaigns where we reward our users for being top spenders on our Platform in a particular country, for a particular publisher, or in other various categories. To this end, if you opt in then we may analyse transaction information collected from your purchase transactions and use your Personal Data to contact you for the purpose of awarding you with the prizes offered for such promotional campaigns, which typically would be free Publisher or Payment Channel credits, or other free gifts. These promotional campaigns are conducted by Coda, and your Personal Data will not be shared with any third party for such purposes. If you would like to opt out of receiving gifts and other prizes from promotional events, please contact us.

6. Coda may conduct promotional campaigns jointly or in partnership with Publishers, Payment Channels, or other third parties. In such instances, if you opt in then we may share with them your name, email address, and/or mobile number so that you can participate in these campaigns. If you would like to opt out of participating in these joint promotions, please contact us.

7. If you opt in to receiving marketing and promotional communications, we may use your Personal Data to notify you about promotional campaigns relating to any of the Coda Services or in connection with any Publishers, Payment Channels, or third parties, and we may share your name, email address, and/or mobile number with them for this purpose. If you would like to opt out of receiving marketing and personal communications or having your Personal Data disclosed for this purpose, please contact us.

‍

17. Other Permitted Uses and Disclosures

8. You accept that we may also use your Personal Data for the following purposes:

1. Maintaining and securing any user accounts that you may have with Coda;
2. Notifying you of matters relating to your account or your transactions that may require your attention;
3. Processing service requests, resolving concerns, and responding to queries or feedback that you may communicate to us;
4. Managing or complying with our internal security or risk management mechanisms;
5. Conducting statistical analysis or market and customer research;
6. To improve Coda Services to ensure that content is presented in the most effective manner for you and for your device;
7. Improving your experiences with our customer care services; and
8. Notifying you of material changes to this Policy or to our Terms and Conditions as may be necessary.

9. You understand and accept that we may also disclose your Personal Data to our affiliates, Publishers, Payment Channels, or other parties as permitted or required by applicable law, such as government authorities or regulators, or other necessary persons, for the following purposes:

1. For or in connection with the negotiation of any merger, sale of company stock or assets, financing, acquisition, divestiture, or dissolution of all or a portion of our business; or
2. If we believe that disclosure is reasonably necessary to (i) comply with any applicable law, regulation, legal process, or governmental request; (ii) assist in any investigations or proceedings; and (ii) protect the security or integrity of the Coda Services, us, or any of our users or the public from harm or illegal activities.

6. Your choices, rights and exceptions

18. Your right of information: You acknowledge that this Policy provides you with information about the purposes, legal framework, interests, recipients or categories of recipients with whom your Personal Data is shared, and the Personal Data transfer to a third country or international organization. In addition to this information and with the aim of ensuring fair and transparent processing of your Personal Data, you further acknowledge that you have received additional information concerning the period for which your Personal Data will be kept and the existence of the rights which are granted to you and how you can exercise them. If we decide to process Personal Data for purposes other than those indicated, all information relating to those new purposes will be communicated to you.

19. Your right to erasure of your Personal Data and your right to withdraw your consent: You have the right to have your Personal Data removed or withdraw consent (when processing we carry out is based on your consent) to the processing thereof. If you wish to have your Personal Data erased, or want to withdraw your consent, please contact us. However, please note that if your Personal Data is removed or you withdraw your consent for any of the purposes stated above, depending on the nature of your request, we may not be in a position to continue providing the Coda Services to you, or process and complete the transactions you wish to make on our Platform. Additionally, the exercise of right to erasure will not be possible when the retention of your Personal Data is necessary for compliance with laws and regulations and in particular for the establishment, exercise or defense of legal claims and withdrawal of consent will have no impact on the previous transactions based on the consent you gave before the withdrawal, subject to compliance with the statutory and regulatory obligations which requires data retention to which we are subject.

20. Your right of access to your Personal Data: You have the right to access the Personal Data that you have provided to us at any time. If you would like to access the Personal Data that we have on file about you, you may contact us. Depending on the nature of your request, we may charge a reasonable administration fee, of which we will inform you as soon as reasonably practicable.

21. Your right to data portability: You have the right to request that your provided Personal Data be moved to a third party, if the processing is based on consent or contract and the processing is carried out by automated means.

7. California residents’ privacy rights: If you’re a California resident, please note that you have certain rights with respect to your Personal Data under the California Consumer Privacy Act (“CCPA”). This Section 7 supplements the information contained in this Policy.

22. Categories, sources, purposes, and recipients of the Personal Data we collect: Please note that we collect the categories of Personal Data described in Section 1.3 of this Policy. The sources from which we collect Personal Data, and the purposes for which we collect and process it, are described in Sections 2 and 5, respectively. We have disclosed for business purposes each of the categories of Personal Data with the categories of third parties as described in Section 5.

23. Sale of Personal Data: Please note that we do not sell your Personal Data. By ‘sell’ we mean that we do not share your Personal Data with third parties in exchange for valuable consideration. However, we disclose your Personal Data to our third parties as described in Section 5 of this Policy.

24. As a resident of California you have the right to (i) know what personal information we collect, use, disclose and sell; (ii) request deletion of your Personal Data, subject to certain exceptions; (iii) request information about the Personal Data we have sold or disclosed to third parties for business purposes, in the preceding 12 months; (iv) opt out from the sale of your Personal Data, if applicable; and (v) not be discriminated against for exercising your rights under the CCPA.

To exercise your rights described above, please contact us. We will contact you to request for additional information which we need in order to verify your identity and if we are unable to verify your identity then we will deny your request. Please note that you may designate an authorized agent to make requests on your behalf for exercising your rights under the CCPA. However, before accepting any request from your agent, we will require your agent to provide us with proof that you have authorized the agent to act on your behalf and we may need you to verify your identity directly with us.

25. California Do Not Track disclosures: Do Not Track (“DNT”) is an internet browser setting which allows you to avoid having your online actions monitored. Currently, our Platform doesn’t support such a setting since there are no agreed upon standards for DNT signals and no guidelines on how to deal with DNT requests. Therefore, we will be unable to act on any requests we receive regarding DNT. However, we will process all your other requests as described in this Policy.

All the rights enumerated above can be exercised by contacting us (please refer to Section 15 of this Policy).

8. Retention and Disposal of Personal Data

Your Personal Data will be retained for as long as it is necessary to fulfil or complete the purpose for which it was collected and until it is no longer necessary for any other legal or business purposes. Thereafter, we dispose of your Personal Data in a manner that prevents further access or processing, including but not limited to deletion or irreversible anonymization.

9. Data Processors

26. For processing orders/fulfilling our contractual obligations, providing customer support/services, storage of Personal Data and for data analytics we use the following service providers:

1. Zendesk, Inc. (“Zendesk”): Zendesk helps us in providing customer support/services to our users. Please refer to their privacy policy here;
2. Amazon Web Services (“AWS”): AWS helps us in storage of Personal Data. Please refer to their privacy policy here;
3. Google Analytics by Google LLC. (“Google Analytics”): Google Analytics helps us in performing statistical/data analysis. Please refer to their privacy policy here;
4. Segment.io, Inc. (“Segment”): Segment helps us in performing statistical/data analysis. Please refer to their privacy policy here;
5. Avalara, Inc. (“Avalara”): Avalara helps us in calculating tax while billing you. Please refer to their privacy policy here; and
6. Facebook, Inc. (“Facebook”): Facebook helps us in marketing and providing leads based on your consent. Please refer to their privacy policy here.

Please note that these Processors may transfer your Personal Data to a location outside of the US depending on their respective privacy policies. Therefore, we recommend you to read each of the privacy policies to learn about the privacy terms applicable to you.

10. Security

27. Coda makes reasonable efforts to safeguard Personal Data in our possession or under our control, in order to protect against loss, misuse, modification, unauthorised or accidental access or disclosure, alteration, or destruction. Unfortunately, no data transmission or storage over the internet can be guaranteed as totally secure. Nonetheless, we have adopted and currently practice administrative, organizational, technical, and physical security measures to protect your Personal Data to the best of our reasonable capacity, including but not limited to the following:

1. Limiting Personal Data access to authorized and/or necessary personnel;
2. Implementing technical solutions to ensure information security;
3. Continuous monitoring and review of Personal Data protection measures; and
4. Other security measures, as may be required by the laws and regulations applicable in the country where you are located.

11. International Transfer of Personal Data 

28. As we operate internationally, your Personal Data may be stored and processed in a country outside of the United States (“US”) where we have operations, where our Publishers are located and where our data Processors are located (For more information on Processors please see Section 9). You therefore accept and understand that we may share your Personal Data with recipients who are located outside of the US, in order to provide the Coda Services to you, process and complete the transactions you wish to make on our Platform, or for any other purposes set out in this Policy.

29. In such circumstances, we take steps to ensure that these overseas recipients located outside of the US shall provide a standard of protection to the Personal Data so transferred that is comparable to the protection under the CCPA as well as the local data protection laws applicable in your jurisdiction. We will take all steps reasonably necessary to ensure that your Personal Data is subject to appropriate safeguards and that it is treated securely and in accordance with this Policy.

12. Collection of Statistical Data

30. We collect and also allow third parties (including but not limited to Facebook and Google) to collect statistical information relating to your website use and online activities as you interact with our Platform, using “cookies” and similar technologies. Such statistical information is anonymous in nature and does not identify who you are. This includes page visits, access times and dates, and browser type. This information is collected for analysis and evaluation to help us improve our Platform and the Coda Services. Please refer to our Cookie Policy for a detailed overview.

31. “Cookies” are a feature on your Internet browser which store small amounts of data on your computer when you visit a website. They allow us to recognise a particular device or browser so that we can personalise and curate content to your preferences and make our services and Platform more useful to you. “Cookies” do not tell us who you are unless you specifically give us personally identifiable information. You may be able to manage and delete “cookies” by selecting certain options on your browser.

32. Your statistical data may be shared with our third-party partners: (i) with whom we advertise; (ii) who help us deliver or optimize our services; (iii) who wish to market their goods or services, which may be of interest to you; or (iv) who wish to improve their goods or services to be provided to you.

13. Use by Minors

We recognise we have a special obligation to protect Personal Data obtained from children. We do not and will not knowingly collect Personal Data of any child below the age of 18 (“minors”). If we become aware that we have collected Personal Data of a minor, then we will delete such Personal Data immediately.

14. Links to Other Websites

Our Platform may contain links to other websites which are not maintained by us. Therefore, when visiting these third-party websites, you should read their respective privacy policies, which will apply to your use of their websites. We are not responsible for the content, use, or privacy practices of these websites.

15.  Contact Us

33. To contact us on any aspect of this Policy or your Personal Data, including but not limited to withdrawing consent, opting out of receiving gifts and prizes, opting out of receiving marketing and promotional communications, requesting access to your Personal Data or exercising any of your rights under this Policy or applicable data protection laws, you may either submit your information in the Request Form or contact our Data Protection Officer at dpo@codapayments.com.

34. For any other issues, please contact support@codapayments.com or visit our Help Center.