Skinsauna Privacy Policy

1. Introduction

Skinsauna.gg ("we", "us", "Skinsauna" or "Controller") is committed to protecting the privacy of users and visitors of the Skinsauna.gg website and services ("Service"). This Privacy Policy explains how we collect, use, disclose, retain and delete personal data relating to you. This Privacy Policy describes how and why we process your personal data. Processing is carried out on the legal bases set out in Section 6 below.

2. Controller and contact details

• Skinsauna Oy
• Business ID: 3602518-9
• Address: Kuuterseläntie 1b, 02130 Espoo, Finland

3. Updates to this notice

We may update this Privacy Policy at any time. You should check the Skinsauna.gg website for the current version. We will notify users of material changes through the website and, where appropriate, by email.

4. Categories of data processed

"Non-identifiable Data" means information that does not identify you and is not considered personal data under applicable law. This includes aggregated or anonymized data derived from Service usage. Examples include aggregated usage metrics, device/OS/browser distributions (in aggregated form), and other non-identifiable analytics data.

"Personal Data" means any information that identifies or can be used to identify you. We may collect and process the following categories:

• Account and user data: transaction history, usernames, profile data you provide.
• Contact details: name, postal address, email address, phone number.
• Payment and billing data: payment instrument identifiers, billing address (processed via payment providers).
• Communication data: messages between you and our support or other users, support tickets, correspondence.
• Technical and usage data: IP address, device identifiers, browser, operating system, timestamps, pages visited, referral data.
• KYC/identity data (where required): government ID, proof of address, date of birth, national ID numbers or other identity documents for AML/KYC purposes.
• Other data you provide when using the Service.

5. Data collection processes

We may collect data in several ways, including but not limited to:

• Directly: when you register, execute a transaction, contact support, submit documents for verification, or otherwise provide information.
• From third parties and public sources: payment processors, identity verification providers, analytics providers, public records and third-party services.
• Automatically: via cookies and other automated technologies when you visit or use the Service.

6. Purpose of processing data

We process personal data for the following purposes and legal bases:

• Providing the Service (performance of contract): to register and manage your account, process transactions, deliver purchased or exchanged Skins, and handle payments and refunds.
• Compliance with legal obligations (legal obligation): to comply with KYC/AML, tax, sanctions, accounting and other statutory obligations.
• Fraud prevention and security (legitimate interests / legal obligation): to detect, prevent and investigate fraud, abuse, security incidents and violations of our Terms.
• Customer support and communications (performance of contract / legitimate interests): to respond to inquiries, provide support and send service-related notices.
• Analytics and service improvement (legitimate interests): to analyze and improve the Service and user experience.
• Marketing and communications (consent or legitimate interests, as applicable): to send promotional messages if you have consented or were permitted by law; you may opt out.
• Legal claims and enforcement (legal obligation / legitimate interests): to establish, exercise or defend legal claims and cooperate with authorities.

We will indicate the legal basis for specific processing where required.

7. Recipients and data sharing

We may share personal data with:

• Service providers and subprocessors: payment processors, identity verification providers, hosting providers, analytics and security vendors.
• Affiliates and group companies.
• Third parties where necessary to complete a transaction (e.g., Valve/Steam where transfers involve platform interaction).
• Law enforcement, regulators or competent authorities when required by law or to protect rights and safety.
• In connection with corporate transactions: a sale, merger, reorganization or asset transfer (with appropriate safeguards).

All processors are contractually bound to process personal data only on our instructions and to implement appropriate security measures.

8. International transfers

We may transfer personal data outside the EU/EEA (for example, to service providers in the United States). Where transfers occur, we will ensure appropriate safeguards such as Standard Contractual Clauses, adequacy decisions, or other legal mechanisms.

9. Data retention

We retain personal data only as long as necessary for the purposes set out in this Policy, considering:

• the nature and sensitivity of the data;
• the purposes of processing;
• legal, tax, accounting and regulatory obligations;
• the need to detect and prevent abuse or fraud.

Typical retention examples include but are not limited to:

• Transaction records and billing data;
• KYC/identity documents;
• Support communications;
• Aggregated/anonymized data.

As a general guide, transaction records are retained for six years, KYC and AML records for five years from the end of the business relationship, and support correspondence for two years from the resolution of the matter.

10. Rights regarding personal data

If you are located in the EU/EEA, you have the following rights with respect to your personal data:

• Right of access: obtain confirmation whether we process your data and receive a copy.
• Right to rectification: correct inaccurate or incomplete data.
• Right to erasure: request deletion subject to legal retention obligations.
• Right to restriction: request limitation of processing in certain circumstances.
• Right to object: object to processing based on legitimate interests (including profiling) and to direct marketing.
• Right to data portability: receive a machine-readable copy of data you provided.
• Right to withdraw consent: where processing is based on consent.

To exercise these rights, contact support@skinsauna.gg. We may request information to verify your identity.

11. Deletion requests and account closure

You may request deletion by contacting support@skinsauna.gg. Routine deletion requests do not require a signed paper form. We may retain or restrict deletion where necessary to comply with legal obligations (e.g., tax/accounting), to detect/prevent fraud, to resolve disputes, or to enforce our Terms. Upon account closure we will delete or anonymize personal data in accordance with this Policy and applicable law, subject to the foregoing exceptions.

12. Security

We implement appropriate technical and organizational measures to protect personal data (e.g., access controls, encryption, monitoring). No transmission or storage system is completely secure; we cannot guarantee absolute security but take reasonable measures to protect data.

13. Data breach notification

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify affected individuals and the relevant supervisory authority as required by law.

14. Cookies and tracking

We use cookies and similar technologies for functionality, analytics and optional advertising.

15. Changes to this policy

This Policy may be updated. Material changes will be posted on the website and, where appropriate, notified by email. Check the website for the current version.

16. Contact

Contact for data subject requests and privacy inquiries: support@skinsauna.gg.