Privacy Policy

1. Who we are (data controller)

The data controller for personal data collected through csskinforge.com is LOOT FORGE LTD, a company registered in England and Wales under company number 17323859, with its registered office at Piccadilly Business Centre, Unit C, Aldow Enterprise Park, Blackett Street, Manchester M12 6AE, United Kingdom.

We process personal data in accordance with the UK GDPR and the Data Protection Act 2018, and — where we offer our services to customers in the European Economic Area — with the EU GDPR.

For any privacy question, request or complaint, contact us at info@csskinforge.com or write to the registered office address above, marking your letter "Data Protection". We respond to privacy requests within one month.

2. What data we collect

Account data. Your email address, username, password (stored only as a salted hash), account preferences, display currency and marketing preferences.

Steam data. Your Steam ID, public profile name and avatar, trade URL, trade eligibility status and the trade history between our bots and your account. We obtain this through Steam's official OpenID login and public Web API. We never receive or ask for your Steam password, and you should never give it to anyone claiming to represent us.

Order and transaction data. The items you buy, prices, currency, order and invoice numbers, delivery status, trade offer IDs, refund and dispute records.

Payment-related data. Cardholder name, billing address, country, the last four digits and card brand, and the authorisation result. See section 4.

Verification data. Where our AML & KYC Policy requires it, identity documents, proof of address, date of birth, and source-of-funds information.

Technical and usage data. IP address, approximate location derived from IP, device type, browser and operating system, referring page, pages viewed, session timestamps, and cookie or similar identifiers. See our Cookie Policy.

Communications. Emails, contact form submissions and support tickets, including their content and attachments.

3. Why we process it (legal bases)

Where we rely on legitimate interests, we have assessed that our interest in operating a secure, lawful shop does not override your rights and freedoms. You can object to that processing at any time — see section 9.

Marketing consent is separate from your purchase: you can buy from us without subscribing, and unsubscribing does not affect your orders. Every marketing email contains a one-click unsubscribe link.

4. Payment data

Card payments are processed by our regulated payment service provider and acquiring bank. Your full card number, expiry date and CVV are entered directly into the payment provider's PCI DSS compliant environment and are never transmitted to, seen by, or stored on our systems.

We receive and retain only what we need to run the shop and meet our legal obligations: the cardholder name, billing address and country, the card brand, the last four digits, the authorisation or decline result, the transaction reference and the amount.

Our payment provider acts as an independent controller for its own fraud prevention, regulatory and record-keeping purposes, and processes your data under its own privacy notice. Payments may be subject to Strong Customer Authentication (3-D Secure), which involves your card issuer verifying you directly.

We retain transaction records for six years after the end of the relevant financial year, as required by UK tax and company law, and for the period required by our AML obligations.

5. Steam account data

To deliver items we need to interact with your Steam account. When you sign in with Steam, Valve confirms your identity to us through OpenID and shares your Steam ID; we then read publicly available profile information, your trade URL as you have provided it, and your inventory state as needed to complete a trade.

We use this data solely to check delivery eligibility (trade holds, Steam Guard status, inventory visibility), to send and track the trade offer, to resolve delivery failures, and to detect fraud and multi-account abuse.

Valve Corporation is an independent controller for the data it holds about your Steam account, and your use of Steam is governed by Valve's own privacy policy and the Steam Subscriber Agreement. We have no access to your Steam password, payment methods on Steam, private messages, or any part of your account beyond what is described above.

You can remove your trade URL from your CS Skin Forge profile at any time; doing so will prevent us from delivering future orders.

6. Cookies

We use cookies and similar technologies to keep you signed in, to remember your cart and display currency, to protect against fraud and abuse, and — with your consent — to understand how the shop is used.

Non-essential cookies are set only after you consent through our cookie banner. You can change or withdraw your choices at any time using the "Cookie settings" link in the site footer.

A full list of the cookies we set, their purpose and their lifetime is in our Cookie Policy.

7. How long we keep data

When a retention period ends we delete the data or irreversibly anonymise it. We may keep data longer where it is needed for an ongoing legal claim, investigation or regulatory request.

8. Who we share it with

We do not sell your personal data and we do not share it for third-party advertising.

We share data with service providers acting on our instructions under written data processing agreements: our payment service provider and acquiring bank, cloud hosting and content delivery providers, email delivery and support-desk providers, analytics providers (where you have consented), and identity verification and sanctions-screening providers.

We share data with Valve Corporation to the extent necessary to complete a Steam trade.

We may disclose data to law enforcement, regulators, tax authorities, our bank or our professional advisers where we are legally required to do so, where it is necessary to prevent or investigate fraud or financial crime, or to establish or defend a legal claim. Where a chargeback is raised, we provide the relevant order, delivery and communication records to the card scheme and issuing bank as evidence.

Some providers operate outside the UK or EEA. Where that happens, transfers are made under UK adequacy regulations, the UK International Data Transfer Addendum, or EU Standard Contractual Clauses, together with appropriate technical and organisational safeguards. You can ask us for details of the safeguards used.

9. Your rights

Under the UK GDPR and EU GDPR you have the right to:

• Access — get a copy of the personal data we hold about you
• Rectification — have inaccurate or incomplete data corrected
• Erasure — have data deleted where we no longer have grounds to keep it
• Restriction — have processing paused while a dispute is resolved
• Portability — receive the data you gave us in a machine-readable format
• Object — object to processing based on legitimate interests, and to direct marketing at any time
• Withdraw consent — for analytics or marketing, at any time and without affecting past lawful processing
• Not be subject to solely automated decisions producing legal or similarly significant effects — where our fraud and AML checks flag a transaction, a member of our team reviews it before an account is closed or an order is refused, and you can contest the outcome

To exercise any right, email info@csskinforge.com from the address registered to your account. We may ask for proof of identity before acting. We respond within one month, extendable by two further months for complex requests, and we will tell you if an extension applies. There is no charge unless a request is manifestly unfounded or excessive.

Some rights are limited. We cannot delete records we are legally required to keep — for example transaction and AML records — and we may retain data needed to prevent fraud or to defend a legal claim.

If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, by phone on 0303 123 1113, or to the supervisory authority in your EU country of residence. We would appreciate the chance to resolve the matter first.

10. Contact

LOOT FORGE LTD Piccadilly Business Centre, Unit C, Aldow Enterprise Park Blackett Street, Manchester M12 6AE, United Kingdom Company number 17323859 (England and Wales)

Email: info@csskinforge.com Phone: +44 7577 018239 Support hours: Monday to Friday, 10:00–18:00 UTC

We update this policy when our processing changes. The current version and its date are always published on this page; where a change is material we will notify registered users by email or by notice on the Site.