PRIVACY POLICY

This Privacy Policy (hereinafter the “Policy”) describes what personal data is collected through the website skindealer.trade and related services (hereinafter the “Website”), how it is processed, stored, transferred, and protected.

The Policy is drafted in compliance with Russian Federal Law No. 152-FZ “On Personal Data” (27.07.2006), and also takes into account the EU General Data Protection Regulation 2016/679 (GDPR) for users in the European Union and the California Consumer Privacy Act (CCPA) where applicable.

1. Personal Data Operator

The personal data operator and data controller is:

For any questions about personal data processing, contact us at the email above. Response time — up to 30 days.

2. What data we collect

2.1. Data when using the Website (collected automatically):

• IP address;
• browser and device data (User-Agent, language, screen resolution, operating system);
• cookies and similar technologies (see Section 10);
• usage data (page views, transitions, referrer, time on page).

2.2. Data upon Steam authorization (if you use the corresponding feature):

• SteamID64;
• public profile name (nickname);
• avatar URL and Steam profile link.

Data is provided by Steam through the official Steam OpenID mechanism. The Steam account password is not transmitted to the Website and is not processed by us.

2.3. Data upon subscription purchase (when subscription is active under the Public Offer):

• email address provided at checkout;
• transaction identifiers, status and amount of payment provided by the payment processor;
• subscription details (plan, term, activation status).

Full bank card details and other payment credentials are not collected or stored by us. They are processed by the payment provider in accordance with their privacy policy and PCI DSS requirements.

2.4. Data when contacting support:

• email address provided in the request;
• content of the request and correspondence.

3. Data we do NOT collect

We consciously do not collect or process:

• passwords to Steam accounts;
• full bank card and payment wallet details;
• phone numbers;
• passport data;
• biometric data;
• precise geolocation data (GPS);
• advertising device identifiers (IDFA, GAID).

4. Purposes of processing and legal bases

4.1. Provision of Website features. We process technical data, Steam authorization data, and subscription data to provide the User with access to the Website, its features, and paid services. Legal basis: performance of a contract (Public Offer).

4.2. Payment and subscription processing. We process email, transaction identifiers, and subscription details to activate, renew, and provide technical support for paid services. Legal basis: performance of a contract, legitimate interests.

4.3. Technical support. We process email and the content of the request to respond to User inquiries. Legal basis: performance of a contract / legitimate interests.

4.4. Security and prevention of abuse. We process IP address, device data, and usage data to protect the Website from unauthorized access, fraud, and abuse (including preventing the creation of multiple accounts). Legal basis: legitimate interests.

4.5. Analytics and Website improvement. We process anonymized usage data and technical browser data to analyze stability and improve the user experience. Legal basis: your revocable consent (given through the cookie banner or by continued use of the Website; may be withdrawn at any time).

4.6. Compliance with legal obligations. We may process the listed data to fulfill applicable legal requirements (including accounting, tax, and anti-fraud reporting). Legal basis: legal obligation.

5. Age restrictions

The Website and related services are intended exclusively for persons aged 18 and older. We do not knowingly collect personal data from individuals under 18 years of age. If we become aware that we have received data from a minor, such data will be deleted without delay. If you are a parent or legal guardian and believe your child has provided us with data, please contact us via the email in Section 1.

6. Retention periods and security

6.1. Retention periods:

• authorization and activity data — for the duration of Website use plus 1 year after cessation of use;
• subscription and payment data (transaction identifiers, amounts, statuses) — for the period required by Russian tax legislation (but not less than 5 years from the date of the transaction);
• support request data — 1 year after the last response;
• analytics and cookie data — in accordance with the policies of the analytics service providers (usually up to 26 months) or until you withdraw your consent.

6.2. Security measures: we apply technical and organizational measures to protect data from unauthorized access, loss, alteration, or destruction (TLS encryption in transit, access restriction, logging, regular updates). Access is granted only to the extent necessary to perform job duties.

7. Cross-border data transfers

Data may be processed on servers located both within and outside the Russian Federation. When transferring personal data of users from the European Economic Area (EEA) and other jurisdictions with similar requirements, the European Commission’s Standard Contractual Clauses (SCC) or other applicable safeguards are used.

8. Third parties (processors)

We do not sell personal data. Transfer to third parties occurs only in the following cases:

8.1. Payment providers. A payment provider is used to process subscription payments. The User’s full payment credentials are processed exclusively by the payment provider in accordance with their policy and the PCI DSS standard.

8.2. Infrastructure and analytics providers. Technical and usage data may be transferred to cloud and analytics service providers (e.g., for hosting, monitoring, web analytics). Processing is carried out on the basis of data processing agreements. The current list of processors is available upon request.

8.3. Government authorities. Only upon lawful request from competent authorities in accordance with applicable law.

9. Your rights

Depending on your jurisdiction, you may have the following rights:

• right of access — to know what data we process;
• right to rectification — to request correction of inaccurate data;
• right to erasure (“right to be forgotten”) — to request deletion of data;
• right to restriction of processing — under certain conditions;
• right to data portability — to receive data in a structured format;
• right to object — against processing based on legitimate interests;
• right to withdraw consent — at any time (for analytics and cookies);
• right to lodge a complaint — with the data protection authority of your country (for users in Russia — Roskomnadzor; for EU users — with the data protection authority of your Member State).

To exercise your rights, send a request to skindealer.trade@gmail.com with the subject “Personal Data Request”. We will respond within 30 days. In some cases, we may request proof of your identity to prevent unauthorized access to data.

For California residents (CCPA): we do not sell your personal data. You have the right to request disclosure of collected data (right to know), deletion (right to delete), and to opt out of sharing with third parties (right to opt-out of sharing) — at the same email.

10. Cookies

The Website uses cookies and similar technologies for:

• functionality (saving session, language settings) — strictly necessary cookies, no consent required;
• usage analytics — set only with your consent;
• security and fraud prevention.

You can manage cookies via your browser settings or the consent banner. Refusing analytics cookies does not affect the core Website functionality.

11. Changes to this Policy

We may update this Policy in connection with changes in legislation or Website functionality. The new version becomes effective from the moment it is published on the Website. Continued use of the Website after the update constitutes acceptance of the new version. We will notify you of significant changes via a banner on the Website.

12. Contact information

For all questions related to the processing of personal data, this Policy, or exercising your rights, contact the Operator: