PRIVACY POLICY

NEXOR DIGITAL LTD (company number 17334707), of 82a James Carter Road, Mildenhall, IP28 7DE, United Kingdom, is the controller of personal data processed through SkinFlex (https://skinflex.space/). We follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 and collect only what we need to run the service. Privacy questions: [email protected].

You sign in only through Steam, so we do not run our own password system and never receive your Steam password or login credentials. Steam passes us a limited set of profile data — your Steam ID, display name, avatar, profile URL and account status — and the trade link you provide. In addition we hold: account data (securely stored session and account status, and the email address you give for contact or payouts); billing and payout data collected at checkout and when you sell to us (the details required to take a card payment and to pay you out, such as your name and payment-method details); identity and verification data where our checks require it (for example proof of identity, proof of account or payment-method ownership, and source-of-item information); order, sale and payout records (skins bought and sold, prices, the 5% commission, timestamps, payment and payout status, refund and reversal history); correspondence; technical data (IP address, device and browser details, logs and security events); and limited payment metadata from the gateway (payment status, masked card details, card brand, issuing country and transaction references). We never receive or store your full card number.

We use personal data to run your account and move skins to and from your Steam inventory; to take payments for purchases and to pay you for skins you sell; to operate our verification, anti-fraud and anti-money-laundering checks over the buy-back and payout side of the service; to provide support and handle refunds, reversals and complaints; and to meet our legal, accounting and regulatory obligations. Our legal bases are performance of our contract with you, compliance with legal obligations (including anti-money-laundering and tax-record duties), our legitimate interests in security and fraud prevention where these are not overridden by your rights, and consent where the law requires it, such as for non-essential cookies.

Your full card details are handled only by our PCI DSS-compliant payment gateway and never reach our systems, and data in transit is protected with TLS/SSL encryption, supported by access controls, logging, monitoring and data minimisation. We share personal data only where necessary — with our payment and payout providers, identity-verification and anti-fraud services, hosting and IT providers, professional advisers, and courts or authorities where the law requires. We do not sell personal data or share it for unrelated marketing. Where personal data is transferred outside the United Kingdom, we apply safeguards recognised under UK law, which may include UK adequacy regulations, the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

We keep account and Steam sign-in data while your account is active and for up to twelve months after closure, unless a longer period is needed for legal or fraud-prevention reasons. We keep billing, payout, order, sale and transaction records, and the identity and verification records tied to anti-money-laundering obligations, for six years to meet UK accounting, tax and anti-money-laundering duties. We keep support correspondence for up to thirty months after a matter is resolved, and technical and security logs for up to twelve months unless an incident or legal claim requires longer. Cookie-related data follows the periods in the Cookie Policy.

Under the UK GDPR you may ask us to give you access to your personal data, correct or erase it, restrict or object to certain processing, or provide it in a portable form, and you may withdraw consent where we rely on it; some data tied to anti-money-laundering or accounting duties we must keep for the periods above. Requests go to [email protected]; we may verify your identity first and will respond within one month, extending by up to two further months for complex or multiple requests. You may also complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or by post to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

We may update this Privacy Policy when our practices or the law change. An updated version takes effect once published on the Website. We do not send separate notifications of every change, so please review this Policy from time to time.

NEXOR DIGITAL LTD  ·  Reg. 17334707  ·  82a James Carter Road, Mildenhall, IP28 7DE, United Kingdom  ·  SkinFlex (https://skinflex.space/)  ·  [email protected]