← Back home

Privacy Policy

Effective Date: June 19, 2026 · Last Updated: June 19, 2026

This Privacy Policy explains how VBR GROUP LLP, operating the GotYa platform, collects, uses, shares, stores, and protects personal information.

In this Privacy Policy, “GotYa”, “we”, “us”, and “our” refer to VBR GROUP LLP.

This Privacy Policy applies when you use:

• The GotYa website
• The GotYa application
• Your GotYa account
• Digital Packs
• The GotYa Marketplace
• Auctions
• Buyback Offers
• The GotYa Wallet
• Vault services
• Physical redemption and shipping
• Leaderboards
• Rewards
• Giveaways
• Promotional communications
• Customer support

1. Who We Are

GotYa is operated by:

VBR GROUP LLP, 32 Kinburn Street, London, SE16 6DW, United Kingdom

Registered in England and Wales

VBR GROUP LLP is the controller responsible for the personal information described in this Privacy Policy.

For privacy questions or requests, contact:

info@gotya.com

2. Personal Information We Collect

The personal information we collect depends on how you use GotYa.

Account information

When you create or use an account, we may collect:

• Email address
• Username
• Password or authentication information
• Account creation date
• Account preferences
• Communication preferences
• Account status
• Self-exclusion status

Public profile information

GotYa includes public profile and community features.

Information visible to other users may include:

• Username
• Profile image, where available
• Public profile
• Marketplace listings
• Sales history
• Leaderboard position
• Public activity
• Rewards or achievements
• Collectibles displayed publicly

You should not include private or sensitive information in your username, profile, listings, or other public areas.

Transaction information

We collect records relating to your activity on GotYa, including:

• Pack purchases
• Pack openings
• Collectibles allocated to your account
• Marketplace listings
• Marketplace purchases
• Marketplace sales
• Auction bids
• Buyback Offers
• Accepted Buybacks
• Wallet deposits
• Wallet credits and debits
• Refunds
• Withdrawals
• Chargebacks
• Rewards
• Giveaways
• Physical redemption requests

Payment information

Deposits are processed through Stripe.

Stripe may collect payment information directly from you, including:

• Cardholder name
• Card number
• Expiration date
• Security code
• Billing address
• Payment details
• Device and fraud-prevention information

GotYa does not generally need to receive or store your full payment-card number.

We may receive limited payment information from Stripe, such as:

• Payment amount
• Currency
• Payment status
• Payment reference
• Card brand
• Last digits of the payment method
• Billing country
• Refund information
• Chargeback information
• Fraud or risk indicators

Stripe handles personal information under its own privacy policy.

Withdrawal information

When you request a withdrawal, we may collect:

• Account holder name
• Bank account information
• Withdrawal amount
• Currency
• Bank country
• Payment reference
• Withdrawal status
• Information needed to verify or complete the withdrawal

We may use banks, payment processors, or payout providers to complete withdrawals.

Shipping and fulfillment information

When you request physical delivery, we may collect:

• Full name
• Shipping address
• Email address
• Telephone number
• Delivery instructions
• Collectible details
• Customs information
• Tracking information
• Delivery status
• Proof of delivery
• Returned shipment information

Communications

When you contact us, we may collect:

• Your email address
• Your username
• The content of your message
• Support history
• Complaints
• Screenshots
• Attachments
• Transaction references
• Other information you provide

Promotion and giveaway information

If you join a giveaway, promotion, referral campaign, or leaderboard, we may collect:

• Username
• Email address
• Entry details
• Referral information
• Eligibility information
• Prize details
• Shipping information
• Winner information

3. Information We Collect Automatically

When you use GotYa, we and our providers may automatically collect:

• IP address
• Browser type
• Device type
• Operating system
• Language
• Approximate location based on IP address
• Login time
• Session information
• Pages viewed
• Screens viewed
• Buttons and links clicked
• Referring website
• Time spent on the Service
• Error logs
• Crash information
• Cookie identifiers
• Analytics identifiers
• Security indicators
• Fraud-prevention signals
• Email opens and link clicks

We use this information to operate, secure, analyze, and improve GotYa.

4. Cookies and Google Analytics

GotYa uses cookies and similar technologies.

These may include:

• Cookies
• Local storage
• Pixels
• Tags
• Analytics scripts
• Session technologies

Essential cookies

Essential cookies help us:

• Keep users logged in
• Maintain account sessions
• Process account actions
• Remember security settings
• Prevent fraud
• Remember cookie preferences
• Operate the website

These cookies may be necessary for GotYa to function.

Analytics cookies

We use Google Analytics to understand how visitors use GotYa.

Google Analytics may process information such as:

• IP address
• Device information
• Browser information
• Pages visited
• Session duration
• Referral source
• Website interactions
• Approximate location
• Analytics identifiers

Where required by law, Google Analytics is activated only after you provide consent.

Cookie choices

Our website uses a cookie-consent banner.

You can:

• Accept cookies
• Reject non-essential cookies
• Change cookie categories
• Edit your preferences later

You may also control cookies through your browser.

Rejecting certain cookies may reduce some website functionality.

5. Information We Receive From Other Sources

We may receive personal information from third parties.

Stripe

Stripe may provide us with:

• Payment confirmation
• Payment status
• Payment reference
• Refund information
• Chargeback information
• Fraud indicators
• Billing country
• Limited payment-method details

Banks and payout providers

Banks or payout providers may provide:

• Withdrawal status
• Returned-payment information
• Bank verification information
• Failed-payment information
• Compliance requests

Shipping and fulfillment providers

Shipping companies and fulfillment providers may provide:

• Tracking updates
• Delivery status
• Customs status
• Failed-delivery information
• Address corrections
• Proof of delivery

Google Analytics

Google may provide analytics reports and information about how users interact with GotYa.

Other users

Other GotYa users may provide information about you when reporting:

• Marketplace disputes
• Fraud
• Abuse
• Suspicious behavior
• Ownership disputes
• Promotion abuse

Public and commercial sources

We may use public or commercial sources for:

• Collectible pricing
• Certification verification
• Fraud prevention
• Legal compliance
• Sanctions screening
• Dispute investigation

6. How We Use Personal Information

We use personal information for the following purposes.

To provide GotYa

We use information to:

• Create and manage accounts
• Authenticate users
• Process Pack purchases
• Record Pack results
• Maintain collectible ownership records
• Operate the Marketplace
• Process marketplace purchases and sales
• Operate auctions
• Display Buyback Offers
• Complete Buybacks
• Maintain Wallet balances
• Process deposits and withdrawals
• Operate public profiles
• Maintain sales history
• Operate leaderboards
• Process rewards and giveaways
• Store collectibles
• Process physical redemption
• Arrange shipping
• Provide customer support

To communicate with you

We may send:

• Account messages
• Payment confirmations
• Withdrawal updates
• Marketplace updates
• Buyback confirmations
• Shipping updates
• Security alerts
• Support replies
• Changes to our policies
• Service announcements

These messages are necessary for operating your account and are separate from marketing.

To secure GotYa

We use information to:

• Protect accounts
• Detect unauthorized access
• Detect duplicate or abusive accounts
• Prevent payment fraud
• Prevent chargeback abuse
• Prevent marketplace manipulation
• Prevent promotion abuse
• Investigate suspicious activity
• Protect GotYa and its users
• Enforce our Terms of Service

To improve GotYa

We use information to:

• Understand how GotYa is used
• Improve features
• Fix technical issues
• Measure website performance
• Analyze user activity
• Develop new features
• Improve the user experience
• Improve fraud controls

To comply with legal obligations

We may use information to:

• Comply with applicable laws
• Respond to lawful requests
• Comply with court orders
• Maintain tax and accounting records
• Investigate disputes
• Defend legal claims
• Prevent illegal activity
• Comply with sanctions requirements

7. Marketing Communications

We may send promotional emails relating to:

• New Packs
• New collectibles
• Marketplace promotions
• Rewards
• Giveaways
• Referral campaigns
• Product updates
• Special offers

You can unsubscribe by:

• Using the unsubscribe link in the email
• Emailing info@gotya.com

Even after opting out of marketing, you may still receive essential messages about:

• Your account
• Transactions
• Security
• Withdrawals
• Shipping
• Policy changes
• Customer support

We may introduce promotional SMS messages in the future.

Where required by law, we will request consent before sending promotional SMS messages and will provide a way to opt out.

8. Public Information

Certain information is public by design, including:

• Username
• Public profile
• Marketplace listings
• Sales history
• Leaderboard position
• Public activity
• Public rewards
• Public achievements

Public information may be:

• Viewed by other users
• Shared
• Copied
• Screenshotted
• Cached
• Indexed by search engines
• Stored outside GotYa

We cannot control information copied or stored by third parties after it has been made public.

9. How We Share Personal Information

We may share personal information with the following categories of recipients.

Payment providers

We share information with Stripe and other payment or payout providers where necessary to:

• Process deposits
• Process withdrawals
• Issue refunds
• Handle chargebacks
• Prevent fraud
• Confirm payments

Technology providers

We may use providers for:

• Website hosting
• Databases
• Cloud infrastructure
• Authentication
• Security
• Error monitoring
• Email delivery
• Data storage
• Analytics

Google

We share analytics data with Google when Google Analytics is enabled.

Google processes this information under its own terms and privacy policy.

Fulfillment providers and carriers

We may share information with:

• Shipping carriers
• Fulfillment providers
• Packaging providers
• Customs intermediaries
• Logistics providers

This may include:

• Name
• Shipping address
• Email address
• Telephone number
• Collectible details
• Customs information

The GotYa Vault is currently operated directly by VBR GROUP LLP.

Professional advisers

We may share information with:

• Lawyers
• Accountants
• Auditors
• Tax advisers
• Banks
• Consultants
• Insurers

Authorities

We may disclose information to:

• Courts
• Regulators
• Law-enforcement authorities
• Tax authorities
• Government agencies

We may do this where required by law or where reasonably necessary to protect GotYa, our users, or others.

Corporate transactions

Information may be shared in connection with:

• A merger
• Acquisition
• Investment
• Financing
• Restructuring
• Sale of assets
• Sale of the business
• Insolvency
• Due diligence

Other users and the public

Public profile and Marketplace information is shared with other users and website visitors.

We do not sell personal information in exchange for money.

10. Legal Bases for Processing

Where the GDPR, UK GDPR, or similar law applies, we rely on the following legal bases.

Contract

We process information where necessary to:

• Create your account
• Process Pack purchases
• Maintain ownership records
• Operate the Marketplace
• Operate the Wallet
• Process Buybacks
• Process withdrawals
• Store collectibles
• Ship collectibles
• Provide support

Legitimate interests

We may process information for legitimate interests such as:

• Preventing fraud
• Securing GotYa
• Improving the Service
• Maintaining accurate records
• Preventing marketplace manipulation
• Managing chargebacks
• Understanding website use
• Defending legal claims

Legal obligations

We may process information to comply with:

• Tax obligations
• Accounting rules
• Court orders
• Legal requests
• Sanctions requirements
• Consumer-protection laws
• Other legal duties

Consent

We may rely on consent for:

• Non-essential cookies
• Google Analytics where required
• Promotional SMS
• Certain marketing communications
• Other optional processing

You may withdraw consent at any time.

11. Identity Verification

GotYa does not currently require routine identity verification for every user.

However, we may request verification in the future or in specific cases, such as:

• High-value withdrawals
• Suspicious activity
• Account ownership disputes
• Payment-provider requests
• Legal requirements
• Fraud prevention
• Sanctions screening

We may then request:

• Legal name
• Date of birth
• Residential address
• Government-issued identification
• Proof of address
• Bank-account ownership evidence
• Source-of-funds information
• Other necessary verification information

If we introduce a third-party identity-verification provider, we may provide additional information at the time the data is collected.

12. Self-Exclusion

GotYa provides a self-exclusion option through account settings.

Self-exclusion may restrict:

• Pack purchases
• Deposits
• Marketplace purchases
• Auction participation
• Promotions
• Other spending-related features

We may retain self-exclusion information to:

• Apply the restriction
• Prevent circumvention
• Protect the user
• Handle support requests
• Maintain security
• Comply with legal duties

Self-exclusion does not automatically delete your account.

A self-exclusion may be reversed by contacting support, subject to any review, waiting period, or conditions applied by GotYa.

13. Account Deletion

You may request account deletion by contacting:

info@gotya.com

Before deleting your account, we may need to:

• Verify the request
• Complete or cancel pending transactions
• Resolve chargebacks
• Resolve negative balances
• Withdraw eligible funds
• Resolve collectibles stored in the Vault
• Complete physical redemption
• Resolve Marketplace disputes
• Comply with legal requirements

Eligible funds may be withdrawn before account termination, subject to verification, payment-provider requirements, and applicable restrictions.

Deleting your account does not necessarily mean that all information is erased immediately.

We may retain information where necessary for:

• Tax
• Accounting
• Fraud prevention
• Chargebacks
• Transaction history
• Ownership records
• Dispute resolution
• Security
• Legal claims
• Compliance with law

Public profile information may be removed or anonymized, but copies may remain in screenshots, search-engine caches, backups, or records maintained by other users.

14. Data Retention

We retain personal information only for as long as reasonably necessary.

The retention period depends on:

• The type of information
• The purpose for which it was collected
• Whether your account remains active
• Whether you have funds or collectibles remaining
• Tax and accounting obligations
• Chargeback periods
• Fraud risk
• Legal limitation periods
• Ongoing disputes
• Legal or regulatory duties

For example:

• Account information may be retained while your account is active and for a reasonable period afterward.
• Payment and transaction records may be retained for accounting, fraud, tax, and dispute purposes.
• Collectible ownership records may be retained while collectibles remain vaulted and afterward where needed to establish ownership history.
• Shipping information may be retained for delivery, customs, tax, and dispute purposes.
• Support communications may be retained for complaint, security, and legal purposes.
• Marketing information may be retained until you opt out or it is no longer needed.
• A limited suppression record may be retained after an opt-out so we do not send further marketing.
• Deleted information may remain temporarily in secure backups.

15. International Data Transfers

VBR GROUP LLP is based in the United Kingdom.

Personal information may be processed in:

• The United Arab Emirates
• The European Economic Area
• The United Kingdom
• The United States
• Other countries where our providers operate

Privacy laws in these countries may differ from those in your country.

Where required by law, we use appropriate transfer safeguards, which may include:

• Standard contractual clauses
• Data-processing agreements
• Adequacy decisions
• Contractual protections
• Technical and organizational safeguards

16. Security

We use reasonable technical, organizational, and physical safeguards designed to protect personal information.

These may include:

• Access controls
• Authentication
• Secure hosting
• Encryption where appropriate
• Monitoring
• Logging
• Backups
• Fraud controls
• Limited staff access
• Physical security

No internet service, database, website, or storage system is completely secure.

We cannot guarantee that personal information will never be lost, accessed, altered, or disclosed without authorization.

You are responsible for protecting:

• Your password
• Your email account
• Your device
• Your login credentials

You should contact us immediately if you believe your account has been accessed without authorization.

17. Your Privacy Rights

Depending on where you live, you may have the right to:

• Access your personal information
• Correct inaccurate information
• Request deletion
• Restrict processing
• Object to processing
• Request data portability
• Withdraw consent
• Object to direct marketing
• Request review of certain automated decisions
• File a complaint with a privacy authority

These rights are not absolute.

We may retain or continue processing information where necessary for:

• Tax
• Accounting
• Fraud prevention
• Chargebacks
• Ownership records
• Legal claims
• Security
• Contract enforcement
• Compliance with law

To submit a privacy request, contact:

info@gotya.com

We may need to verify your identity and account ownership before completing a request.

18. Automated Fraud and Security Tools

GotYa and its providers may use automated tools to identify:

• Suspicious payments
• Unusual login activity
• Duplicate accounts
• Chargeback risk
• Marketplace manipulation
• Promotion abuse
• Security threats
• Suspicious withdrawal activity

These systems may cause an activity to be:

• Flagged
• Delayed
• Reviewed
• Restricted
• Rejected

Where applicable law provides rights relating to a significant decision made solely by automated processing, you may contact us to request human review.

19. Children

GotYa is intended only for users aged 18 or older.

We do not knowingly allow anyone under 18 to create an account or use GotYa.

If you believe we have collected information from someone under 18, contact us so we can investigate and take appropriate action.

20. Third-Party Services

GotYa may contain links to or use services operated by third parties, including:

• Stripe
• Google
• Banks
• Payment providers
• Shipping carriers
• Grading-company websites
• Social-media platforms

These third parties have their own privacy policies.

We are not responsible for their privacy practices.

21. Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

• Changes to GotYa
• New features
• New providers
• New payment methods
• New verification processes
• Changes in law
• Changes in data processing
• Changes in security practices

We will update the Last Updated date when changes are made.

For material changes, we may notify you through:

• Email
• An account notice
• The website
• Another reasonable method

Where required by law, we will request consent before beginning materially different processing.

22. Contact Us

For privacy questions, complaints, or requests, contact:

info@gotya.com

VBR GROUP LLP, 32 Kinburn Street, London, SE16 6DW, United Kingdom

Registered in England and Wales