Privacy Policy

DRAFT — DEMO CONTENT. This text contains placeholders and must be reviewed and completed before publication.

Last updated: [DATE]

1. Who is responsible for your data

[LEGAL COMPANY NAME], trading as [BRAND NAME], operates [WEBSITE URL] and is responsible for the personal data described in this policy. Company registration number: [COMPANY REGISTRATION NUMBER]. Registered address: [REGISTERED ADDRESS, COUNTRY]. Privacy contact: [PRIVACY EMAIL]. [INSERT DATA PROTECTION OFFICER OR LOCAL REPRESENTATIVE DETAILS IF REQUIRED.]

2. Information we process

Depending on the features you use, we process:

• Account information: your verified Steam identifier, your website account identifier and session information. Steam sign-in does not require you to disclose your Steam password to us.
• Purchase information: the items ordered, price, currency, order status, payment references, email address, Steam Trade URL and any billing details required for your transaction.
• Skin-sale information: selected inventory items, item and asset identifiers, Trade URL, quotations, sale references, trade and settlement statuses, and records of the merchant payout status. [ADD THE DATA REQUIRED BY THE CONFIRMED PAYOUT METHOD.]
• Support information: your name, email address, message, relevant order or sale references, and correspondence you send us.
• Technical and security information: session identifiers, IP address where processed, browser or device details, timestamps and logs used by the website or its hosting services. [VERIFY THE ACTUAL LOGGING, COOKIE AND ANALYTICS INVENTORY.]

Some information comes from you; other information comes from Steam, inventory and trade services, payment providers or the operation of the website. We do not receive your Steam password through Steam OpenID sign-in. Payment authentication takes place with the payment service; [VERIFY WHICH PAYMENT DETAILS THE WEBSITE AND PROVIDERS RECEIVE].

3. How and why we use information

We use relevant information to authenticate accounts, maintain sessions and carts, process purchases, arrange skin transfers, obtain sale quotations, monitor sales and settlement, administer merchant payouts, respond to support requests and protect the service against misuse.

Where EU or UK data protection law applies, the intended bases for review are:

• Performing a contract or taking steps at your request: account and transaction services needed to provide a purchase or sale.
• Legal obligations: [IDENTIFY APPLICABLE ACCOUNTING, TAX OR OTHER DUTIES AND THE DATA THEY REQUIRE].
• Legitimate interests: proportionate security, fraud prevention and service administration, subject to your rights. [IDENTIFY AND ASSESS EACH ACTUAL INTEREST.]
• Consent: [IDENTIFY OPTIONAL TECHNOLOGIES OR COMMUNICATIONS THAT ACTUALLY RELY ON CONSENT; REMOVE IF NOT APPLICABLE]. Consent may be withdrawn for future processing.

[CONFIRM THE PURPOSE, DATA AND LEGAL BASIS FOR EACH OPERATION UNDER THE APPLICABLE JURISDICTION.]

4. Who receives information

We share the information needed for the relevant operation with our hosting and infrastructure suppliers, Steam authentication and trading services, skin inventory or delivery providers, payment and payout providers, and support or professional advisers where used. We may disclose information to public authorities where legally required.

[INSERT THE ACTUAL PROVIDER NAMES, PURPOSES, COUNTRIES, POLICY LINKS AND WHETHER THEY ACT AS PROCESSORS OR INDEPENDENT CONTROLLERS. CURRENT INTEGRATIONS TO REVIEW INCLUDE STEAM/VALVE, WHITE.MARKET, CASH4SKIN AND ROCKA; THEIR INTEGRATION DOES NOT CONFIRM A PARTICULAR LEGAL ROLE.]

5. International transfers

[IDENTIFY ANY COUNTRIES OUTSIDE THE USER’S APPLICABLE DATA PROTECTION AREA THAT RECEIVE DATA, THE TRANSFER MECHANISM AND HOW A USER CAN REQUEST INFORMATION ABOUT THE SAFEGUARDS. IF THERE ARE NO SUCH TRANSFERS, STATE THIS ONLY AFTER VERIFICATION.]

6. How long we keep information

We keep information for the period needed for its purpose and any applicable legal requirements. The confirmed retention schedule is:

• Account records: [PERIOD OR SPECIFIC CRITERIA].
• Orders, sales and accounting records: [PERIOD AND APPLICABLE LEGAL REQUIREMENT].
• Trade URLs and inventory information: [PERIOD OR SPECIFIC CRITERIA].
• Support correspondence: [PERIOD].
• Technical and security logs: [PERIOD].
• Backups: [EXPIRY AND DELETION PROCESS].

Account closure may not immediately remove records we must retain for a transaction, legal obligation or dispute.

7. Your rights and choices

Depending on the law that applies and the processing involved, you may have rights to access, correct, delete or receive a portable copy of your personal data, restrict processing, object to processing, or withdraw consent. These rights have conditions and exceptions. Contact [PRIVACY EMAIL] to make a request. We may need to verify your identity before responding.

You may also complain to [NAME AND CONTACT/LINK OF THE COMPETENT DATA PROTECTION AUTHORITY]. [ADD THE APPLICABLE RESPONSE PERIOD AND ANY OTHER LOCAL RIGHTS.]

See our Cookie Policy at [COOKIE POLICY URL] for browser technologies and available preference controls.

8. Security, eligibility and automated decisions

We use access controls and other measures intended to protect personal data. No online service can guarantee absolute security. Do not send us your Steam password or authentication codes.

Eligibility to use the service is described in our Terms & Conditions. [CONFIRM THE MINIMUM AGE, HOW CHILDREN’S DATA IS HANDLED, AND ANY AUTOMATED DECISIONS OR PROFILING THAT REQUIRE DISCLOSURE.]

9. Contact and changes

For privacy questions, contact [PRIVACY EMAIL] or write to [REGISTERED ADDRESS]. We will update this policy when our processing changes and provide additional notice where required. The date above identifies the latest version.