Loot Ninja

Last modified: March 2025

Thank you for using our products and services! We respect your concerns about privacy and appreciate your trust and confidence in us.

Please note that this privacy policy (“Privacy Policy”) only applies to Loot Ninja in connection with the provision of services to support payment transactions (“Service”). If you use any other products or services, please refer to the privacy policy for that particular product or service.

Last modified: March 2025

Welcome to Loot Ninja!

This Privacy Policy explains the when, how and why when it comes to the processing of your personal information in connection with the LootNinja service including the website for Midasbuy in connection with the provision of services to support payment transactions (the “Service”), and sets out your choices and rights in relation to that information. Please read it carefully – it will allow you to understand how we collect and use your information, and how you can control it.

Please note that this Privacy Policy only applies to the Service. If you use any other products or services please refer to the privacy policy for that particular product or service.

If you do not agree to the processing of your personal information in the way this Privacy Policy describes, please do not provide your information when requested and stop using the Service. By using the Service you are acknowledging how we process your personal information as described in this Privacy Policy.

Pursuant to our contract with you, we may transfer data outside of the location in which you are based for the purposes described in this Privacy Policy. For EEA/UK users, transfers between our affiliates and to third parties use applicable safeguards, such as incorporating standard contractual clauses, obtaining your consent first or taking into account adequacy assessments.

Only where necessary will we share your personal information with third parties. Situations where this occurs include:

• Third parties that provide services in support of the Service (e.g., cloud backup, fraud detection, payment processors, data analysis, Trustpilot). All are prohibited from using your data for anything other than delivering their service or complying with legal obligations.
• Companies within our corporate group that process your information solely to provide the Service (e.g., Proxima Beta Pte. Ltd. for social media integration).
• Regulators, judicial authorities, and law enforcement agencies when legally required (e.g., subpoenas, search warrants).
• Third parties to ensure safety, security, or legal compliance, including enforcing our terms, preventing fraud/technical issues, or protecting rights and safety under law.
• A third party that acquires all or substantially all of our business or assets in a sale, merger, or transfer; your data may be disclosed as part of that transaction.

We have information security and access policies that limit access to our systems and technology, and we protect data through technological measures such as encryption.

Unfortunately, internet transmission is not completely secure. While we implement reasonable measures to protect your personal information, we cannot guarantee its security; any transmission is at your own risk.

We do not keep your data longer than necessary to fulfill the purposes described above unless required or permitted by law. If we retain your information beyond the retention periods set out below (e.g., to comply with legal obligations), we will store it separately from other personal information.

For further details on retention periods for specific data categories, please refer to the table below.

If you are a California resident and the CCPA does not recognize an exception that applies to you or your personal information, you have the right to:

• Request we disclose to you free of charge the following information covering the 12 months preceding your request:
  • the categories of personal information about you that we collected;
  • the categories of sources from which the personal information was collected;
  • the purpose for collecting personal information about you;
  • the categories of third parties to whom we disclosed personal information about you and the categories of personal information that was disclosed (if applicable) and the purpose for disclosing the personal information about you;
  • the specific pieces of personal information we collected about you;
• Request we delete personal information we collected from you, unless CCPA recognises an exception;
• Request we correct inaccurate personal information that we maintain about you;
• Be free from unlawful discrimination for exercising your rights including providing a different level or quality of services or denying goods or services to you when you exercise your rights under the CCPA.

We aim to fulfil all verified requests within 45 days pursuant to the CCPA. If necessary, extensions for an additional 45 days will be accompanied by an explanation for the delay.

First, you may wish to log into your account and manage your data from there. If you are a California resident to whom the CCPA applies, you may also exercise your rights, if any, regarding other data by contacting us as specified in Section 8 (Contact). We may take steps to verify your identity before complying with your request to protect your privacy and security, and may decline your request if we are unable to verify your identity. To verify your identity, we may need the following information from you: your first name, last name, address, phone number, date of birth and email address.

Under the CCPA, you may exercise these rights yourself or designate an authorized agent to make these requests on your behalf. In order for us to process the request, you must provide the authorized agent with signed written permission. We reserve the right to require the agent to verify their own identity and to confirm directly with you that you have provided the authorized agent permission to submit the request.

Questions? If you have questions or concerns regarding this Privacy Policy, please contact us as set out in Section 8 (Contact).

If you are located in Canada and wish to obtain written information about our policies and practices with respect to our service providers located outside Canada, you may contact us as specified in Section 8 (Contact). Where we use service providers who might have access to your personal information, we require them to have privacy and security standards that are comparable to ours. We use contracts and other measures with our service providers to maintain the confidentiality and security of your personal information and to prevent it from being used for any purpose other than as provided in this Privacy Policy.

We do not knowingly collect or solicit personal information from anyone under the age of 7 or knowingly allow such persons to register on the Service platform. If you are under 7 years of age, please do not attempt to use or register for our Service or send any personal information about yourself to us. No one under the age of 7 may provide any personal information to us while using the Service. In the case of users located in Chinese Taipei, persons under the age of 20 are required to obtain parental/guardian consent prior to using the Service.

Your authorization to process personal information for the Service may be expressed (i) in writing, (ii) orally or (iii) through unequivocal conduct that allows us to reasonably conclude that your authorization has been granted, such as the act of accepting the Privacy Policy. We may keep evidence of said authorizations, while respecting the principles of confidentiality and privacy of information.

As a data subject you have certain rights, including (i) to access, update and rectify your personal data; (ii) to request a copy of the consent you have given us; (iii) to be informed about how we have processed your personal data; (iv) to file claims before your country’s data protection authority; (v) to revoke the consent you have given us to process your personal data, unless the processing is based on compelling legitimate grounds or is needed for legal reasons; (vi) to ask for the suppression of your personal data (right to erasure); and (vii) to freely access your information. You can contact us to exercise any of these rights, using the information specified in Section 8 (Contact).

By clicking “accept” or by proceeding with the sign up process, you acknowledge that you have read, understood, and consented to this Privacy Policy. You are acknowledging your consent to the processing, storage, and cross-border transfer of your personal data. The cross border transfer may be to any country in which we have databases or affiliates, in particular to the jurisdictions specified in Section 4 (How We Store and Share Your Personal Information).

You also acknowledge your consent to receiving marketing messages from us, whether through e-mails or pop-ups or other such means.

If you are a new user, you have seven days to inform us of any objection you may have to this Privacy Policy.

As an Egyptian data subject, you have certain rights under the Egyptian Personal Data Protection Law.

Instructions for the processing of your personal data after your death. You have the right to provide us with general or specific instructions for the retention, deletion, and communication of your personal data after your death. The specific instructions are only valid for the processing activities mentioned therein and the processing of these instructions is subject to your specific consent. You may amend or revoke your instructions at any time.

You may designate a person responsible for the implementation of your instructions. This person will be informed of your instructions in the event of your death, and be entitled to request their implementation from us. In the absence of designation or, unless otherwise provided for, in the event of the death of the designated person, their heirs will have the right to be informed of your instructions and to request their implementation from us.

When you wish to make such instructions, please contact us as set out in Section 8 (Contact).

As a Hong Kong data subject you have legal rights in relation to the personal information we hold about you (to the extent permitted under applicable laws and regulations). You are entitled to make a subject access request to receive a copy of the data we process about you, a data correction request as well as a right to reject to the use of your personal data for direct marketing purposes. A fee may be chargeable by us for complying with a data access request.

Age Restrictions

Parental consent is required for children under the age of 18 years to use our services.

Sensitive Personal Information

Sensitive Personal Information under local law includes passwords, financial information (such as bank account, credit card, debit card or other payment instrument details), biometric data, physical or mental health, sex life or sexual orientation, and/or medical records or history, but does not include information available in the public domain, or provided under Indian laws, including the Right to Information Act, 2005.

Sharing Of Your Sensitive Personal Information

Where we permit any third parties to collect and use Sensitive Personal Information, we shall use reasonable measures to ensure that the third parties do not further disclose the Sensitive Personal Information to the extent required by applicable laws.

To the extent provided by applicable laws and regulations, you may withdraw any consent you previously provided to us for certain processing activities by contacting us as set out in Section 8 (Contact). Where consent is required to process your personal information, if you do not consent to the processing or if you withdraw your consent, we may not be able to deliver the expected service. Where the processing of your personal data is not based on consent, our processing is based on certain legitimate uses as permitted under law and in compliance with applicable law.

By accepting and consenting to this Privacy Policy, you agree that we may collect, use and share your personal information in accordance with this Privacy Policy, as revised from time to time. If you do not agree to this Privacy Policy, you must not access or use our services and we have the right to not provide you with access to our services.

If you are under the age of 21, you undertake that you have the consent of your parent or legal guardian to register an account on and use the Service.

In the event we fail to maintain the confidentiality of your personal information in the Service, we will notify you through the contact information provided by you or via the Service, to the extent required by local laws and regulations.

You are responsible for making sure that any personal details which you provide to us are accurate and current. In order to confirm the accuracy of the information, we may also verify the information provided to us, at any time. You hereby represent that you have secured all necessary consent(s) before providing us with any other person’s personal information (for example, for referral promotions), in which case you will be responsible for any claims from any party arising as a result of the absence of such consent(s).

If you are under the age of 18, you must obtain your parent’s or legal guardian’s consent to register an account on and use the Service.

By clicking “accept”, you consent to the transfer of your personal information to third parties (if any), which may include the cross-border transfer of your information to any country where we have databases or affiliates and, in particular, to the jurisdictions specified in Section 4 (How We Store and Share Your Personal Information).

The categories of personal information specified in Section 4 may include "special care-required personal information" (i.e., sensitive information as detailed under applicable law), and you consent to the collection of such information.

You may request us to notify you about the purposes of use of, to disclose, to make any correction to, to discontinue the use or provision of, and/or to delete any and all of your personal information which is stored by us, to the extent provided by the Act on the Protection of Personal Information of Japan. When you wish to make such requests, please contact us as set out in Section 8 (Contact).

If you are under the age of 18, you must obtain your parent’s or legal guardian’s consent to register an account on and use the Service.

By clicking “accept”, you consent to the collection, use, disclosure, transfer, export (to the extent permitted by applicable laws), sharing and storage of your personal information as described in this Privacy Policy. The transfer of your personal information to third parties may include cross-border transfer to any country where we have databases or affiliates, in particular to Singapore.

In the event of any discrepancy or inconsistency between the English version and the Kazakh version of this Privacy Policy, the Kazakh version shall prevail.

• Right of access: You have the right to request access to and obtain a copy of the personal information we process about you or that is processed on our behalf. We may impose a fee as permitted under law.
• Right to correction: You may request correction of your personal information or deletion if correction is impossible.
• Right to blocking/de-blocking: You may request blocking if you become aware of violations in data collection/processing, and de-blocking if the violation is unproven.
• Right to deletion: You may request deletion if your personal data was collected or processed in violation of Kazakh laws.
• Processing in public sources: You may request to limit or consent to processing of your personal information in public personal data sources.

You consent to the collection, use, disclosure, transfer, export (to the extent permitted by applicable laws) and storage of your personal information as described in this Privacy Policy, including for the purposes of showing you advertising when you use the services.

By accepting this Privacy Policy, you expressly state that you authorise us to collect, use, store, and process your personal data and to disclose this data to third parties whether inside or outside of Kuwait, in line with the provisions of this Privacy Policy.

You have the right not to provide your personal information. However, as a result, we may not be able to provide the Service to you. As a Macau SAR data subject, you have legal rights in relation to your personal information (to the extent permitted under applicable laws and regulations). You are entitled to make a subject access request to request a copy of the data we process about you, to make a data correction request, and have the right to oppose the use of your personal information for marketing or any other form of commercial prospecting, or on any grounds of personal nature. A fee may be chargeable for complying with a data access request.

In the event you are agreeing to this Privacy Policy in order for a minor to access and use the Service, you hereby consent to the provision of personal information of the minor to be processed in accordance with this Privacy Policy and you personally accept and agree to be bound by its terms. Further, you hereby agree to take responsibility for the actions of such minor, and that minor’s compliance with this Privacy Policy.

• Right of access: You have the right to request access to and obtain a copy of your personal information that we have collected and is being processed by or on our behalf. We may impose a fee as permitted under law.
• Right of correction: You may request correction of your personal information. We may verify your identity before fulfilling such request.
• Right to limit processing: You may request to limit the processing of your personal information by contacting us, but this may affect our ability to provide the Service.

Some of the purposes of processing specified in Section 3 (How We Process Your Personal Information) are voluntary, such as showing you personalised recommendations or advertising. We may also use your personal data to send you information we consider relevant.

We do not require your consent to carry out the transfers detailed in Section 4 (How We Store and Share Your Personal Information). By using the Service and providing us with your personal data, you agree to those transfers requiring consent.

To understand more about and exercise your rights—“Access”, “Correction”, “Erasure”, “Objection”, “Restriction of Processing to Storage Only”, and “Advertising”—please contact us as specified in Section 8 (Contact).

We collect information for purposes strictly necessary for the proper use of the Service. By accepting this Privacy Policy, you explicitly accept that your personal data may be subject to processing by the Service.

• The Data Controller is set out at the beginning of this Privacy Policy.
• The purposes of processing are in Section 3 (How We Process Your Personal Information).
• Recipients or categories of recipients are in Section 4 (How We Store and Share Your Personal Information).
• Whether answers are compulsory or optional and consequences are described in Section 3 and Section 7 (Your Rights).

• the identity of the Data Controller is set out at the beginning of this Privacy Policy
• the purposes of processing personal data are set out in Section 3 (How We Process Your Personal Information)
• recipients or categories of recipients are set out in Section 4 (How We Store and Share Your Personal Information)
• whether the answer to the questions is compulsory or optional, as well as the possible consequences of a lack of answer: please refer to Section 3 (How We Process Your Personal Information) and Section 7 (Your Rights)

We take reasonable steps to ensure that third party recipients of your personal information located outside New Zealand handle your personal information in a manner that is consistent with New Zealand privacy laws. However, you acknowledge that we do not control, or accept liability for, the acts and omissions of these third party recipients.

You have the right to access personal information we hold about you, how we use it, and who we share it with. You have the right to request the correction of any of your personal information we hold that is inaccurate.

If you are under the age of 16, you undertake that you have the consent of your parent or legal guardian to register an account on and use the Service.

If you are dissatisfied with our response to your request for access to, or correction of, your personal information or your privacy complaint in respect of your personal information, you may contact the Office of the New Zealand Privacy Commissioner (www.privacy.org.nz).

While we take reasonable steps to ensure that third party recipients of your personal information comply with privacy laws that are similar to those of your jurisdiction, you acknowledge and agree that we cannot control the actions of third party recipients and so cannot guarantee that they will comply with those privacy laws.

You may exercise rights related to the protection of personal information by requesting access to your personal information or the correction, deletion or suspension of processing of your personal information, pursuant to the Personal Data Protection Law (the “Law”). You may also exercise these rights through your legal guardian or someone who has been authorised by you to exercise the right. However, in this case, you must submit a power of attorney to us in accordance with the Law.

You can also withdraw your consent or demand a suspension of the personal information processing at any time.

If you consider that your request has not been met you may file a claim with the Peruvian National Authority of Personal Data Protection.

To protect your personal information and handle complaints relating to your personal information, we have appointed the following department responsible for managing and protecting your personal information:
Data Protection Team, responsible for the management and safety of your personal information
Contact: as set out in Section 8 (Contact)

You are entitled to the following rights:

• Right to be informed: You may in certain circumstances have the right to be informed whether personal data pertaining to you is being, or has been processed, including the existence of automated decision-making and profiling.
• Right to object: You may in certain circumstances have the right to object to the processing of your personal information, including processing for direct marketing, automated processing or profiling.
• Right to access: You may in certain circumstances have the right to seek reasonable access to, upon request, your personal information.
• Right to rectification: You may in certain circumstances have the right to dispute an inaccuracy or error in your personal information and have us correct it, unless the request is vexatious or otherwise unreasonable.
• Right to erasure or blocking: You may in certain circumstances have the right to suspend, withdraw or seek the blocking, removal or destruction of your personal information.

By consenting to this Privacy Policy, you consent to us:

• collecting and processing your personal information as described in Section 3 (How We Process Your Personal Information);
• sharing your personal information with third parties, companies within our corporate group, and a third party that acquires substantially all or substantially all of us or our business, as described in this Privacy Policy and for the purposes stated herein; and
• transferring or storing your personal information in destinations outside the Philippines as described in Section 4 (How We Store and Share Your Personal Information).

If you are using the Service in Qatar, you consent (for the purposes of Law No. 13 of 2016 on the Protection of Personal Data, as may be amended from time to time) to the processing of your information in accordance with this Privacy Policy.