GDPR POLICY

How we meet the UK GDPR and, where it applies to you, the EU GDPR

Last updated: 10.11.2026

1. DATA CONTROLLER

The controller of your personal data is:

MOXIE SKINS LTD

Company number: 16553071

Registered address: Academy House, 11 Dunraven Place, Bridgend CF31 1JF, United Kingdom

Email: support@skins.deals

2. YOUR RIGHTS

Under the UK GDPR (and the EU GDPR where it applies to you, for example if you live in the EU), you have the right to:

Access: request a copy of your personal data
Rectification: have inaccurate data corrected
Erasure: have your data deleted, except what the law requires us to keep
Restriction: limit how we process your data
Portability: receive your data in a structured format
Object: object to processing based on legitimate interests
Withdraw consent: switch Analytics cookies off at any time
Complain: to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk, or, if you live in the EU, to the data protection authority in your country

3. DATA WE COLLECT

The same list as in our Privacy Policy:

What: Steam ID, Steam display name and avatar
When we collect it: Steam sign‑in
Why: Creating your account and signing you in

What: Steam trade URL
When we collect it: Confirm‑details pop‑up and Settings (required to deliver)
Why: Sending your items to your Steam account

What: Email address, and the one‑time code that confirms it
When we collect it: Checkout in the cart (required there), or earlier in the confirm‑details pop‑up (optional)
Why: Contacting you about your orders

What: Card number, expiry, CVV and cardholder name
When we collect it: Card payment form (top‑up or checkout)
Why: Authorising the payment. Passed through our server to the payment processor and not stored; we keep the last 4 digits and a transaction reference

What: Billing address (street, city, state, postcode, country), and saved addresses you label
When we collect it: Card payment form
Why: Card checks, refusing cards from sanctioned countries, filling the form next time

What: IP address, browser user agent and the country the IP resolves to
When we collect it: Automatic, at sign‑up and at payment
Why: Refusing sign-ups from sanctioned countries; fraud prevention (sent to the payment processor with a payment)

What: Wallet balance, top‑ups, orders and refunds
When we collect it: Using the site
Why: Running your wallet, delivering orders, refunds and accounting

What: Name, email address, subject and message
When we collect it: Contact form
Why: Answering your message

What: Identity details and documents we ask for, such as your full name, date of birth, a photo ID and proof of address
When we collect it: Only if we ask you to verify your identity before completing a high‑value transaction (see our AML Policy)
Why: Meeting our anti-money-laundering duties

What: Saved items (favourites)
When we collect it: Items you save
Why: Showing your saved items

What: Pages viewed and features used
When we collect it: Only if you accept Analytics cookies
Why: Improving the site

What	When we collect it	Why
Steam ID, Steam display name and avatar	Steam sign‑in	Creating your account and signing you in
Steam trade URL	Confirm‑details pop‑up and Settings (required to deliver)	Sending your items to your Steam account
Email address, and the one‑time code that confirms it	Checkout in the cart (required there), or earlier in the confirm‑details pop‑up (optional)	Contacting you about your orders
Card number, expiry, CVV and cardholder name	Card payment form (top‑up or checkout)	Authorising the payment. Passed through our server to the payment processor and not stored; we keep the last 4 digits and a transaction reference
Billing address (street, city, state, postcode, country), and saved addresses you label	Card payment form	Card checks, refusing cards from sanctioned countries, filling the form next time
IP address, browser user agent and the country the IP resolves to	Automatic, at sign‑up and at payment	Refusing sign-ups from sanctioned countries; fraud prevention (sent to the payment processor with a payment)
Wallet balance, top‑ups, orders and refunds	Using the site	Running your wallet, delivering orders, refunds and accounting
Name, email address, subject and message	Contact form	Answering your message
Identity details and documents we ask for, such as your full name, date of birth, a photo ID and proof of address	Only if we ask you to verify your identity before completing a high‑value transaction (see our AML Policy)	Meeting our anti-money-laundering duties
Saved items (favourites)	Items you save	Showing your saved items
Pages viewed and features used	Only if you accept Analytics cookies	Improving the site

4. LAWFUL BASIS

Contract: your account, payments, wallet, orders and support
Legal obligation: accounting, sanctions and anti-money-laundering requirements
Legitimate interests: fraud prevention and security
Consent: Analytics cookies

5. RETENTION

Account data: while your account is open; deleted on request or when the account is closed, except what we must keep below
Transaction records: 7 years after the transaction (accounting and anti-money-laundering records)
Support messages: 2 years after the conversation ends
Identity verification data: 7 years after the transaction it was requested for (anti-money-laundering records)

6. SHARING & TRANSFERS

Valve / Steam, to sign you in and to deliver trades
Independent Steam item trading platforms we buy your item from, which receive your Steam trade URL so the seller can send the item
Our payment processor, for card payments and fraud checks
Our hosting and database providers, which run the site
Our email delivery provider, for order and verification emails
An IP-location service, which receives your IP address to tell us its country
Our product analytics provider, only if you accept Analytics cookies
Authorities, when the law requires it

Some of these recipients process data outside the UK/EEA, including in the United States. Where they do, we rely on UK adequacy regulations or standard contractual clauses.

7. SECURITY

HTTPS (TLS) encryption for all data in transit
Access controls and authentication
Card details are passed to the payment processor and are not stored; we keep the last 4 digits and a transaction reference

8. DATA BREACHES

We assess the risk to the people affected
We notify the ICO within 72 hours where the law requires it
We tell affected users without undue delay where the risk to them is high
We record every breach internally

9. CHILDREN

Our services are not for anyone under 18. We do not knowingly collect personal data from children, and we delete it if we learn that we have.

10. AUTOMATED DECISIONS

We refuse sign-ups and card payments from sanctioned countries automatically, based on your IP address and billing country. You can ask for a person to review any such decision by emailing support@skins.deals.

11. EXERCISING YOUR RIGHTS

Email support@skins.deals from the address on your account, or with your Steam ID
Say which right you want to use
We reply within 30 days (we may extend this by up to two further months for complex requests, and will tell you if we do)
No fee for most requests

12. UPDATES TO THIS POLICY

We may update this document. The "Last updated" date at the top shows the current version. We announce a material change on this site, and by email if you gave us an address, at least 30 days before it takes effect. Orders and top-ups made before a change keep the terms that applied when you made them.