Privacy Notice

DRAFT for review by qualified counsel. Bracketed placeholders must be filled with the registered company's real details before this site accepts real payments — a payment processor's business review will check that this accurately describes real data handling.

Last updated: [date]

1. Who we are

[Company legal name], company number [number], [registered address], is the data controller for personal data collected through this Site. Contact: [support email].

2. Data we collect

• Account data: email address, and if you sign in with Google, the name and email your Google account shares with us.
• Order data: first and last name, phone number, billing address, Steam Trade URL — collected at checkout to process your order, prevent fraud, and deliver the item.
• Payment data: handled entirely by our PCI DSS-compliant payment processor. We never receive or store your full card number, expiry date, or CVV — only a payment confirmation and, where applicable, the last 4 digits and card brand.
• Technical data: IP address, browser type, and basic request logs, collected automatically for security and fraud-prevention purposes.

3. Why we process it, and our legal basis

• Performance of a contract: account creation, processing your order, delivering the item.
• Legal obligation / legitimate interest: fraud prevention, chargeback defense, accounting and tax records.
• Consent: any optional marketing communications (we do not send these unless you opt in).

4. Who we share it with

• Our payment processor, to charge your card and confirm the transaction.
• Our item supply partner (DMarket), to source and deliver the purchased item.
• Our hosting and database providers, to run the Site securely.
• Authorities, where required by law.

We do not sell your personal data.

5. International transfers

Some of the providers above may process data outside your country of residence. Where this involves a transfer out of the UK/EEA, we rely on an adequacy decision or Standard Contractual Clauses.

6. How long we keep it

Order and payment records are kept for as long as required for accounting, tax, and fraud-defense purposes (typically up to [X] years), after which they are deleted or anonymized.

7. Your rights

Subject to applicable law (including UK/EU GDPR where it applies to you), you may have the right to access, correct, delete, or export your data, and to object to or restrict certain processing. To exercise these rights, email [support email]. If unsatisfied with our response, you may complain to your local data protection authority.

8. Security

We use encryption in transit (TLS), role-based access controls, and row-level database security so that your data is only ever accessible to your own account and to the limited server-side processes that need it (such as the payment confirmation webhook).

9. Children

This Site is not directed at anyone under 18 and we do not knowingly collect data from them.

10. Changes

We may update this Notice from time to time; the "Last updated" date above reflects the latest revision.