Privacy Policy | SupplySkins

1. Controller

SupplySkins OÜ, Tallinn, Estonia, is the controller of personal data processed through the Service. Contact: [email protected].

2. What we collect

Application data: email, messenger handle, expected turnover, company details. Account data: Steam ID, trade URL, login history, two-factor status. Transaction data: orders, deposits, wallet addresses, IP addresses. Technical data: browser, device, request logs.

3. Why we process it

To verify your eligibility and prevent fraud (legitimate interest and legal obligation), to perform the contract (deliver Items, process payments), to secure accounts and to send service notices. We do not sell personal data and we do not use it for third-party advertising.

4. Sharing

We share data with infrastructure providers (hosting, email delivery), blockchain analytics providers for AML screening, and authorities when required by law. Steam receives your trade URL when we send an offer. All processors are bound by data processing agreements.

5. Retention

Application data: 12 months after a rejected application. Account and transaction data: 5 years after account closure, as required by anti-money-laundering rules. Request logs: 90 days.

6. Your rights

You may request access, correction, deletion, restriction, portability and object to processing based on legitimate interest. Write to [email protected]; we respond within 30 days. You may complain to the Estonian Data Protection Inspectorate.

7. Cookies and analytics

We use strictly necessary cookies for sign-in. Website analytics are cookieless and aggregate (Cloudflare Web Analytics); they do not identify you or track you across sites. No advertising cookies.

8. International transfers

Data is stored in the European Union. Where a processor is outside the EU we rely on the European Commission's Standard Contractual Clauses.

9. Security

Encryption in transit and at rest, mandatory two-factor authentication, key rotation, access logging and annual penetration testing. Report vulnerabilities to [email protected].

10. Changes

We may update this policy. Material changes are announced by email at least 14 days before they take effect.