Privacy Policy

01Data controller

The controller responsible for your personal data is:

For any privacy-related request, contact privacy@bulletskins.store.

02Data we collect

We collect the following categories of personal data:

• Account data — email address, username, password (stored in hashed form), and account preferences.
• Steam & delivery data — your Steam ID, Steam Trade URL, and related public Steam profile information needed to deliver Digital Items.
• Order & transaction data — items purchased, amounts, currency, timestamps, and order history.
• Payment data — processed by our payment providers. We receive confirmation of payment and limited details (such as card type and last four digits); we do not store full card numbers or security codes.
• Technical & usage data — IP address, device and browser type, pages viewed, referring URLs, and similar diagnostic data collected via cookies and logs.
• Communications — messages you send to support and our responses.

03How and why we use your data

We process your personal data for the following purposes and on the following legal bases under Article 6 GDPR:

• To perform our contract with you (Art. 6(1)(b)) — creating your account, processing Orders, delivering Digital Items, and providing support.
• To comply with legal obligations (Art. 6(1)(c)) — accounting, tax, and anti-fraud requirements.
• For our legitimate interests (Art. 6(1)(f)) — securing the Store, preventing fraud and abuse, improving our services, and basic analytics.
• With your consent (Art. 6(1)(a)) — non-essential cookies, analytics, and marketing communications, where applicable. You can withdraw consent at any time.

Ticking the Privacy Policy box at checkout confirms that you have read and understood this Policy. Your order data is processed because this is necessary to perform our contract with you (Art. 6(1)(b)), not on the basis of that tick-box.

04Cookies and similar technologies

We use cookies and similar technologies to keep your session secure, remember your cart, understand how the Store is used, and — only with your consent — for analytics and marketing. Strictly necessary cookies are always active because the Store cannot function without them.

05Payment processing

Payments via Visa, Mastercard, Apple Pay and Google Pay are handled by regulated third-party payment service providers that act as independent controllers or processors for the payment transaction. These providers process your payment data in line with PCI-DSS standards and their own privacy policies. We do not have access to, and do not store, your full payment card details.

06Who we share data with

We share personal data only where necessary, and only the minimum each recipient needs:

• Hosting & e-mail — Contabo GmbH (Munich, Germany). Hosts the Store, its database and our e-mail on servers located in the European Union, acting as our processor under a data-processing agreement.
• Valve Corporation — Steam (Bellevue, Washington, USA). Handles sign-in with Steam and the Steam trade offers through which your items are delivered. Valve acts as an independent controller of your Steam account.
• Delivery partners — service providers that send the Steam trade offer for your purchase on our behalf. They receive only your Steam Trade URL and the details of the item ordered.
• Payment service provider and payment networks — our payment service provider processes your payment; the card schemes (Visa, Mastercard) and wallet providers (Apple Pay, Google Pay) process the transaction data they need to authorise it.
• Content delivery networks — cdnjs (Cloudflare, Inc.) and jsDelivr deliver animation scripts on some pages and receive your IP address and browser details when those pages load.
• Authorities and professional advisers — tax authorities, courts, law-enforcement bodies, accountants and lawyers, where required by law or to establish, exercise or defend legal claims.

We do not sell your personal data. At the date of this Policy, the Store uses no third-party analytics or advertising trackers; if we add any, they will run only with your consent and we will list them here before using them.

07International transfers

We store your data on servers in the European Union. Some of the recipients listed in section 06 are located, or process data, outside the European Economic Area (EEA). When this happens, we transfer only the data each recipient needs and rely on a safeguard under Chapter V of the GDPR:

If any of our processors, including our payment service provider, processes your data outside the EEA, we put the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914) in place or rely on an adequacy decision. You can request a copy of the safeguards that apply to your data at privacy@bulletskins.store.

08How long we keep your data

We keep personal data only for as long as we need it for the purposes described in this Policy, or for as long as the law requires:

If data is needed to establish, exercise or defend a legal claim, we keep it until that matter is finally resolved. When a retention period ends, we delete the data or irreversibly anonymise it.

09Your rights

Subject to applicable law, you have the right to:

• access the personal data we hold about you;
• request rectification of inaccurate or incomplete data;
• request erasure ("right to be forgotten");
• request restriction of processing;
• object to processing based on legitimate interests or for direct marketing;
• data portability — to receive your data in a structured, machine-readable format;
• withdraw consent at any time, without affecting prior lawful processing.

How to make a request

Send your request to privacy@bulletskins.store or by post to Atlas Interactive Sp. z o.o., Półwiejska Street 17/26, 61-888 Poznań, Poland. You can also update most account details yourself in My Account.

Our response times

To protect your data, we may ask for information to confirm your identity before we act on a request, for example that you write from the e-mail address linked to your account. If we decide not to act on your request, we will tell you why within 30 days and inform you of your right to lodge a complaint and to seek a judicial remedy.

Complaints to a supervisory authority

You have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl, or with the data-protection authority of the EU country where you live, work or where the alleged infringement took place.

10Data security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit (HTTPS), hashed passwords, access controls, and regular security maintenance. No method of transmission or storage is completely secure, but we work continuously to safeguard your information.

11Children

The Store is intended for adults and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact us and we will delete it.

12Third-party links

The Store may contain links to third-party websites and services, including Steam. We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies.

13Changes to this Policy

We may update this Privacy Policy from time to time. The current version, with its "last updated" date, is always published on this page. Where changes are significant, we will take reasonable steps to inform you.

14Contact us

For any question about this Privacy Policy or your personal data, please reach out: