Loading...
Loading...
Card details are entered on the payment provider’s own secure page and never reach our systems. There is no card number here for anyone to steal, including us.
Card payments are handled by an authorised payment provider certified to the PCI DSS standard, which is the card industry’s security requirement for anyone who touches card data.
The details you enter go straight to that provider. We receive only the outcome, the amount, and a masked reference showing the card type and last four digits — enough to match a payment to an order, and useless to anyone who obtained it.
Every card payment goes through strong customer authentication under European payment rules, normally a confirmation in your banking app or a one-time code. This is what makes an unauthorised online card payment hard to complete even if someone has your card number.
The provider also runs automated fraud checks. A payment can be declined by those checks or by your bank without us being told why, which is deliberate: telling us would tell an attacker too.
The whole site is served over an encrypted connection. Your account password is stored only as a one-way hash, so it cannot be read back — not by an attacker with the database, and not by us. Accounts can be protected further with a second authentication step.
We will never ask you for your full card number, your card security code, or your password by e-mail, telephone or message. If you receive such a request in our name, it is not from us.
If you see a payment you do not recognise, contact your bank first — they can block the card and reverse the transaction, which we cannot. Then tell us at [email protected] so we can look at the order behind it.
How your personal data is handled more generally, and who the controller is, is set out in the privacy policy, which stays available whatever else on this site is switched off.