PRIVACY POLICY

1.1  DIGITAL NOXEN LIMITED (company number 17413307), of 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, England, is the controller of personal data processed through SkinPlug (https://skinplug.cc/). We follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 and collect only what we need to run the service. Privacy questions: [email protected].

2.1  The Member signs in only through Steam, so we do not run our own password system and never receive the Member’s Steam password or login credentials. Steam passes us a limited set of profile data — Steam ID, display name, avatar, profile URL and account status — and the trade link the Member provides.

2.2  We also process the contact email entered at checkout, which is used for order confirmations, receipts, support and refund enquiries rather than Steam sign-in; order, sale and payout records, including item descriptions, prices, the 3% commission, dates, transaction references and status; the name and details necessary for billing and payouts; limited payment information supplied by payment processors, such as the card brand, masked card details, issuer country and payment status; communications with support; technical and security information including IP address, browser and device data and relevant logs; and, where proportionate verification is needed, identity documents or verification results, evidence of control over the Steam account or payout method, and information about the source of skins. We do not receive or store complete payment-card numbers or card security codes.

3.1  We use personal data to run the account and move skins to and from the Member’s Steam inventory; to take payments for purchases and to pay the Member for skins sold; to operate our verification, anti-fraud and anti-money-laundering checks over the buy-back and payout side of the service; to provide support and handle refunds, reversals and complaints; and to meet our legal, accounting and regulatory obligations.

3.2  We rely on the lawful basis appropriate to each activity under the UK GDPR: contract performance for Steam-linked account access, orders, delivery and payouts; legal obligation for accounting, tax, regulatory responses and screening duties where applicable; legitimate interests for account security, fraud prevention, protection against unlawful transactions, dispute handling and proportionate voluntary verification, balanced against Members' rights; and consent where required for optional cookies or similar technologies. We do not rely on consent merely because a Member signs in through Steam.

3.3  Our processing purposes and data categories are linked as follows: Steam IDs, profile details and trade links are used to authenticate the Member and deliver or receive items (contract); checkout email and order data are used for transaction notices, customer support and refund handling (contract and legitimate interests, as appropriate); payout-method data and sale records are used to calculate and transfer the net amount owed (contract and applicable legal duties); identity and source-of-item information is used for proportionate ownership, sanctions and financial-crime checks (legitimate interests and, only where applicable, legal obligation); accounting records are used to meet legal retention and reporting duties (legal obligation); optional analytics and preference technologies are used in line with the choices explained in the Cookie Policy (consent where required).

4.1  Full card details are handled only by our PCI DSS-compliant payment gateway and never reach our systems; data in transit is protected with TLS/SSL encryption, supported by access controls, logging, monitoring and data minimisation.

4.2  For purchases and payouts, relevant information may be shared with authorised payment gateways, card schemes, payout processors and their banking partners to authorise payments, confirm a payout method, process refunds and detect fraud. Where checks are needed, identity-verification and anti-fraud providers may receive the minimum identity, Steam-account or transaction information required to carry them out and return a result. We may also share relevant information with Steam/Valve to execute or verify trade offers, hosting and IT-security vendors to operate the Platform, legal and accounting advisers, and competent courts, regulators or law-enforcement agencies where lawfully required. Appropriate confidentiality, contractual and security safeguards apply; we do not sell personal data or disclose it for unrelated advertising.

4.3  Where personal data is transferred outside the United Kingdom, we apply safeguards recognised under UK law, which may include UK adequacy regulations, the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

4.4  Before requesting a full identity document, we consider whether a less intrusive check is sufficient. Access to identity records and payout details is restricted to authorised personnel and relevant service providers. If verification does not succeed, we may retain a limited record of the result or reason for refusal for a proportionate period to prevent fraud or deal with a complaint, subject to applicable data-protection requirements.

5.1  We keep account and Steam sign-in data while the account is active and for up to twelve months after closure, unless a longer period is needed for legal or fraud-prevention reasons.

5.2  Accounting, purchase, sale and payout records are normally retained for up to six years, subject to applicable tax, company-record and legal-claim requirements. Identity documents, source-of-item evidence and verification results are retained only for as long as necessary for a relevant legal obligation or properly justified fraud-prevention and dispute purpose; where a statutory retention duty applies we follow that duty, and otherwise we seek to delete the underlying documents earlier when a limited verification result will suffice. A general six-year retention rule does not automatically apply to every identity document. We may preserve relevant records for longer where a legal hold or active claim requires it and review them when that reason ends.

5.3  We keep support correspondence for up to thirty months after a matter is resolved, and technical and security logs for up to twelve months unless an incident or legal claim requires longer. Cookie-related data follows the periods in the Cookie Policy.

5.4  Where a verification provider retains records independently for its own legal obligations, that provider may apply its own statutory retention periods and privacy notice. We identify the relevant provider or provide details on request where we can lawfully do so. We periodically review retention periods and securely erase or anonymise data that is no longer needed.

6.1  Under the UK GDPR the Member may request access to their personal data, correction, erasure, restriction of or objection to processing, or portability, and may withdraw consent where we rely on it; some data tied to anti-money-laundering or accounting duties we must keep for the periods above. Requests go to [email protected]; we may verify identity first and will respond within one month, extending by up to two further months for complex or multiple requests.

6.2  The Member may raise a data-protection complaint directly with us at [email protected], and may also complain to the UK Information Commissioner's Office (ICO) via ico.org.uk/make-a-complaint or by post to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We encourage Members to contact us first so we can investigate, but this does not restrict their right to contact the ICO.

6.3  We maintain a procedure for privacy complaints. We acknowledge a data-protection complaint within 30 calendar days of receipt, make appropriate enquiries without undue delay, keep the Member reasonably informed and communicate the outcome without undue delay. A complaint may be sent to the same support email used for privacy requests.

6.4  We may update this Privacy Policy when our practices or the law change. We will publish the updated version with its revision date and draw attention to material changes where appropriate; new processing requiring consent will not begin without obtaining the required consent.