Adatvédelmi tájékoztató

A short extraction from the sections named in each point.

Who processes your data: Digital Traders sp. z o.o., Warsaw, KRS 0001253066. We buy Virtual Items from you in our own name and for our own account; we are not a marketplace and we do not hold your funds. privacy@sellyourskins.com (sec. 1).

What we collect and why: Steam, contact, transaction, payout, verification, technical, program, preference and communication data, to run your Account and pay you what is due, run our programs, prevent fraud, diagnose errors in the Website, verify every transaction before payout and screen sanctions lists, meet tax and accounting duties and, with your consent, send marketing e-mails and review invitations and load analytics tools (sec. 3 and 4).

Your country decides the payout methods available to you: the methods shown to you follow your country, which we take from your IP address and which you may change yourself on the sell page. The country you select is your own declaration, and an untrue declaration may cause the payout to be rejected. We aim to keep at least one method available in every supported country; availability also depends on the payment service providers. Currency and language proposals you can always override (sec. 4, rows 2a and 2b).

What is automatic and what is not: Quotes are generated automatically, and a payout above our limits, published or internal, is held automatically. Release of such a hold, and every refusal to conclude a Sale, cancellation, bonus withdrawal and Account block, is decided by our staff (sec. 5).

What is public: public Website statistics show a masked identifier, the item and the value. Your Steam display name and avatar appear only if you switch that on yourself (sec. 4, row 5).

Marketing: marketing e-mails, abandoned-sale reminders and Trustpilot invitations need your prior, separate consent, never your acceptance of the Terms of Service (sec. 4, rows 9 and 10).

Cookies and your device: analytics tools load only after you give consent, and rejecting is as easy as accepting. The referral code from a link you followed we store without asking for consent, because it is necessary to apply the code you request that way. Separately, to detect multi-accounting and abuse we compute, on our server side, signals of your browser and device from the data your browser itself sends with every request; you may object (sec. 10).

Who else sees your data: the payment service provider that executes the payout you chose, Valve (Steam) for login, inventory and trade offers, our support-chat and e-mail providers, and, only after you give consent, our analytics providers. We do not sell personal data (sec. 6).

Data outside the EEA: the providers executing your payouts are established in the EEA, with one exception, Payset in the United Kingdom, which is covered by a European Commission adequacy decision. Recipients in the United States are covered by the EU-U.S. Data Privacy Framework, with Standard Contractual Clauses as the fallback should certification lapse. The Steam connection relies on the contract-performance derogation in Art. 49(1)(b) GDPR (sec. 7). Our error monitoring runs on infrastructure inside the European Union (sec. 6.5).

How long we keep data: transaction and accounting records at least 5 years, verification and anti-fraud records 5 years, claims and audit files 6 years (sec. 8).

What deletion does and does not do: you delete your Account yourself. We erase or replace identifying data, delete the error reports tagged with your Steam ID, keep the records we must keep, and keep a keyed identifier so that an existing block and benefits you already used survive re-registration. What remains is pseudonymized, not anonymous (sec. 9.4).

Your rights: access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and a complaint to a supervisory authority in any EEA country (sec. 9 and 15).

1.1. From the Effective Date, the controller of personal data within the meaning of the GDPR for your personal data processed in connection with the website sellyourskins.com and its subpages (the "Website") and the services provided through it is Digital Traders spółka z ograniczoną odpowiedzialnością, seated in Warsaw (the "Administrator", "we", "us").

1.2. Our registration data: ul. Stefana Batorego 18/108, 02-591 Warszawa, Poland; District Court for the Capital City of Warsaw in Warsaw, XII Commercial Division, KRS 0001253066; NIP 7011322455; share capital PLN 5,000.00.

1.3. Write to us about personal data at privacy@sellyourskins.com or admin@digitaltraders.io, or by post to the address in section 1.2 marked "Personal data".

1.4. We have appointed no Data Protection Officer; the contacts in section 1.3 handle every data-protection matter.

1.5. The change of operator of the Website affects your data as follows. 1.5.1. We operate the Website in our own name and under our own Terms of Service, and we are the controller of the personal data of that operation, in particular your Account data and the data of Sales concluded from 1 September 2026, 00:00. The delimitation is technical: it is decided by the transaction timestamp recorded in the service database. 1.5.2. The previous operator, SKINFINITY.GG (company registration number 386079755), performs and settles transactions concluded on or before 31 August 2026, on the terms in force then, and is the controller of its own settlement, accounting and compliance records of those transactions, under its Privacy Policy of 7 March 2024. Address requests about those transactions, data-protection requests included, to it, through the change-of-operator page of the Website. If you send such a request to us, we will tell you and, where possible, pass it on. 1.5.3. The service database holds records of transactions concluded before the Effective Date. We process them for four purposes of our own and no others:

a) showing you your own transaction history in your Account; the basis is Art. 6(1)(b) GDPR once you have accepted the Terms of Service and, until you do, Art. 6(1)(f), that is our and your legitimate interest in keeping your access to your history continuous;

b) reading, once, the Bonus Level, experience points and referral values recorded as at 31 August 2026, to set the starting values of our own new benefit program (Art. 6(1)(f));

c) enforcing a block in force (Art. 6(1)(f));

d) enforcing the one-time character of benefits already used (Art. 6(1)(f)).

Against each of the purposes based on Art. 6(1)(f) you may object under section 9.2, and you will receive a summary of our balancing test by writing to privacy@sellyourskins.com. 1.5.4. We and the previous operator are separate controllers. Each of us processes the records of transactions concluded before the Effective Date for its own purposes, described in sections 1.5.2 and 1.5.3 respectively, and neither of us processes those records on the other's behalf.

2.1. This Privacy Policy applies to every natural person whose personal data we process in connection with the Website, whether you browse it, hold an Account, sell Virtual Items to us, take part in our programs or prize giveaways, contact us, or reach us through a referral ("Users", "you").

2.2. Capitalized terms not defined in this Privacy Policy have the meaning given in the Terms of Service.

2.3. You need no personal data to view the public pages. Logging in, receiving Quotes, concluding Sales and receiving payouts require the data we mark as required. Without it we cannot provide the feature concerned.

3.1. Depending on how you use the Website, we process:

3.2. We do not knowingly process special categories of personal data (Art. 9 GDPR), and we ask you not to put such data in correspondence with us.

3.3. We collect identity-document copies only where they are strictly necessary, because a verification cannot be completed by less intrusive means.

3.4. We use verification data (category (e)) only for verification, sanctions compliance, fraud prevention, compliance with legal obligations and the defence of legal claims, never for marketing and never for the programs in section 4, rows 3 and 4.

4.1. We process your personal data for the following purposes and on the following legal bases. Article references are to the GDPR unless another act is named.

Where the basis is Art. 6(1)(f), you may object under section 9.2.

4.2. You give the marketing consent for rows 9 and 10 by ticking a box, unchecked by default, where you enter your e-mail address, or through the toggle in your Account profile. We never infer it from your acceptance of the Terms of Service or from your use of the Website. Abandoned-sale reminders count as marketing and we send them only where consent was given. We record the date and source of each consent and each withdrawal and, at the moment of acceptance, also the version of the documents shown to you (Art. 7(1) GDPR).

4.3. The invitation in row 10 works as follows. After a completed payout by selected methods we send Trustpilot your payout e-mail address and the fact of the transaction, so that it can send you one invitation to review the service. We send nothing further and no more than one invitation per transaction, and each invitation carries its own opt-out.

4.4. Service, legal and transactional messages, such as transaction and payout status e-mails, refund notices and notices of changes to the Terms of Service or to this Privacy Policy, are not marketing and need no marketing consent. We send them under Art. 6(1)(b) or Art. 6(1)(c) GDPR.

5.1. The following runs automatically. 5.1.1. Quotes for your Virtual Items are generated fully automatically, by comparing data from external price sources. 5.1.2. Automated systems raise fraud and manipulation flags, on the logic described in section 5.2, for the decisions taken with human involvement described in section 5.4. 5.1.3. Verification and payout data are screened automatically against the sanctions lists named in section 4.1, row 7. Our staff review the alerts. 5.1.4. Your country is detected from your IP address for the purposes in section 4.1, rows 2a and 2b, unless you select a country yourself on the sell page, in which case we use the country you selected. 5.1.5. A payout above the limits published on the Website, or above limits we apply internally for security reasons, is held automatically before release.

5.2. The detection logic compares the Quote against the cash market value of the item determined from independent price sources (Terms of Service, section 12.2), and analyses account relationships, transaction patterns (transactions between related Steam accounts, wash trading on reference markets, exploitation of price-feed outages, bots, multiple accounts) and technical signals, including device recognition. A flag or an automatic hold may lead to a measure under section 5.4: refusal to conclude a Sale, a temporary payout hold, cancellation of a Sale with full restitution, refusal or withdrawal of a bonus, or an Account block.

5.3. The generation of a Quote is not a decision within the meaning of Art. 22 GDPR. Quotes are produced identically for all Users, from the same price sources and under the same rules described in sections 5.1.1 and 5.2, and they contain no assessment of you as a person, of your characteristics or of your behaviour. If you disagree with a Quote, you do not have to accept it; you may also contest it through the complaint procedure provided in the Terms of Service (response within 14 days) or by writing to privacy@sellyourskins.com, and a member of our staff will then consider your case.

5.4. The measures below are not solely automated decisions. Every transaction undergoes verification during the Decision Period before the offer is accepted and, where applicable, before payout (Terms of Service, section 13.2), and that verification may include manual review. 5.4.1. A limit rule may impose a payout hold automatically (section 5.1.5). Whether the hold is released or maintained is always decided by a member of our staff. 5.4.2. The declining of a sale offer, cancellation of a concluded Sale, refusal or withdrawal of an earned bonus, and suspension or blocking of an Account are always taken or confirmed by a member of our staff, on the flag or alert and the logged evidence. They are not solely automated decisions within the meaning of Art. 22 GDPR. 5.4.3. We tell you of every such measure, its outcome, the reason for it, including the trigger relied on, and the complaint procedure open to you. Where the Terms of Service allow us to withhold detail, on the grounds and within the limits stated there (Terms of Service, section 14.3), we tell you as much as we lawfully can and preserve the full record for the competent authorities and courts.

5.5. Neither the detection of your country nor your own selection of it is an assessment of you personally. Payout-method availability depends on the payout country, for the reasons in section 4.1, row 2a, and we aim to keep at least one payout method available in every supported country; availability also depends on the payment service providers and sanctions law.

6.1. We do not sell personal data and we do not disclose it for anyone else's marketing purposes. We disclose it only as far as necessary, to the recipients named below. A processor acts only on our documented instructions and may not use your data for its own purposes. An independent controller decides for itself, within the law, how it uses what it receives, under its own privacy policy.

6.2. The table names the payment service providers we engage as at the date this Privacy Policy comes into force. We may engage further ones within the same category (Art. 13(1)(e) GDPR), and this does not change this Privacy Policy. Write to privacy@sellyourskins.com to learn the current membership of this or any other category named in the table.

6.3. The price- and market-data providers we use for Quotes supply us with item and market data; we send them no personal data.

6.4. Each of our processors is bound by a data processing agreement meeting the requirements of Art. 28 GDPR, concluded within the terms of service of that processor or separately.

6.5. Sentry monitors errors and performance for us, and the following applies to it. When the Website malfunctions, your browser sends an error report to Sentry, which processes it for us on infrastructure in the European Union (the ingest.de.sentry.io endpoint). Application logs generated as the Website runs also go to Sentry, under the same regime. The report contains your Steam ID as the user identifier, technical data about the session (browser, operating system, the address of the page concerned, and the trail of clicks that led to the error) and an approximate location, country and city, derived from your IP address at the moment the event is received. The IP address itself is not stored (the sendDefaultPii option is switched off). Because the Steam ID is attached, these reports are linked to you as the identified holder of the Account (basis: section 4.1, row 6a; retention: section 8.1; deletion: section 9.4.1). Session replay, meaning the recording of what happens on your screen, is not enabled in our monitoring.

6.6. When you open the support chat, Intercom receives your user identifier, your Steam ID, your e-mail address, your name and surname and the date your Account was created, together with an identity verification signature (HMAC) we compute, which stops anyone else opening a chat in your name. It also receives your Steam Trade URL. The Trade URL is not an ordinary identifier but a functional token that allows a trade offer to be sent to your Steam account.

7.1. The payment service providers we engage to execute payouts are, with one exception stated in section 7.2, established in the European Economic Area: PayPal (Europe) S.a r.l. et Cie, S.C.A. in Luxembourg, Revolut Bank UAB in Lithuania, Wise Europe SA in Belgium, UAB ZEN.COM in Lithuania, and Payoneer Europe Limited in Ireland. Disclosure of data to these recipients is not a transfer outside the EEA. The PayPal and Payoneer corporate groups also process data in the United States; they do so as separate controllers, on the terms described in their privacy policies.

7.2. Pay Set Limited, seated in London (Payset), is the only payment service provider we engage established outside the EEA. The transfer basis is the adequacy decision of the European Commission for the United Kingdom.

7.3. Recipients in the United States, in particular Cloudflare, Inc., Twilio Inc. (SendGrid service), Microsoft Corporation, Google LLC and Intercom, Inc., receive data under the adequacy decision based on the EU-U.S. Data Privacy Framework, for a recipient certified under that framework at the time of the transfer. If the recipient's certification lapses or the decision ceases to apply, the transfer basis is the Standard Contractual Clauses adopted by the European Commission, supplemented where a transfer impact assessment identifies further technical and organizational measures as necessary.

7.4. For the data exchange inherent in the Steam login, in the reading of your inventory and in the trade offers you initiate, the disclosure takes place between us and Valve Corporation as two independent controllers, at your initiative and to perform the contract concluded at your request (Art. 49(1)(b) GDPR, where no other instrument covers the transfer).

7.5. For every other recipient outside the EEA we apply the Standard Contractual Clauses adopted by the European Commission.

7.6. Write to privacy@sellyourskins.com for a copy of the safeguards applicable to a given transfer, or for information on where they are available, and to learn the current transfer basis for a named recipient.

8.1. We keep personal data no longer than the purposes in section 4 require:

8.2. Where several periods apply to the same record, the longest controls. After it ends, we delete the data or remove its identifying elements.

9.1. You have the right to: 9.1.1. access your data and obtain a copy (Art. 15 GDPR); 9.1.2. rectification of inaccurate or incomplete data (Art. 16 GDPR); 9.1.3. erasure of data, to the extent Art. 17 GDPR allows it; 9.1.4. restriction of processing (Art. 18 GDPR); 9.1.5. data portability (Art. 20 GDPR); 9.1.6. withdraw consent at any time where processing rests on consent (section 4.1, rows 5, 9, 10 and 11), without affecting the lawfulness of processing carried out before the withdrawal.

9.2. You have the right to object under Art. 21 GDPR. Where we process your data on our legitimate interests, you may object at any time on grounds relating to your particular situation. This covers section 4.1, rows 2b, 3 (the anti-abuse limb), 5 (the masked public statistics), 6, 6a, 7 (the Art. 6(1)(f) limb) and 13. We then stop processing for that purpose unless we demonstrate compelling legitimate grounds for the processing overriding your interests, rights and freedoms, or the data is necessary to establish, exercise or defend legal claims.

9.3. If you object to direct marketing, you need give no reason and we always comply. You can also switch marketing e-mails off with the toggle in your Account profile or with the unsubscribe link included in every such e-mail. If you hold no Account and want your address excluded from review invitations, write to privacy@sellyourskins.com.

9.4. You can delete your Account yourself in your Account profile, with immediate effect, or ask us to delete it by e-mail. 9.4.1. On deletion we erase or replace with neutral values your SteamID, name and surname, avatar, Trade URL, e-mail address, IP data, country and similar identifying data. We delete push subscriptions, pending reminders, notifications and newsletter entries outright, and we deactivate referral codes. The deletion procedure also includes a clearing step in our error monitoring system: the error reports described in section 6.5 are tagged with your Steam ID as the user identifier, that identifier is what makes them findable, and we use it to delete them. Where the clearing step has not yet run through the provider's systems, the reports concerned are deleted promptly, in accordance with section 8.1. 9.4.2. We keep the records section 8 requires or entitles us to keep, in particular transaction and accounting records. They must identify the transaction and its counterparty to serve the accounting and tax obligations they exist for, so the identifying data in them stays as long as those obligations run. 9.4.3. If an Account block is in force, we keep a record of the block and the keyed identifier in section 3.1(k), so that the block and the one-time character of benefits already used stay effective despite re-registration. 9.4.4. What remains after deletion is pseudonymized, not anonymous. We keep a keyed identifier that lets us recognize a returning blocked Account, so the GDPR keeps applying to those records and your rights keep applying to you, within the limits following from section 8 and Art. 17(3) GDPR. 9.4.5. Your right to erasure does not depend on the state of your Wallet. Nothing is forfeited: before deletion we pay out any remaining balance, including amounts below the minimum payout, and any transaction in progress is settled in accordance with the Terms of Service; the Account is deleted once that settlement is complete. On deletion you may complete a short exit survey; we store it with no link to you and use it only as aggregate statistics, so please do not enter personal data in its free-text field.

9.5. Send requests to privacy@sellyourskins.com, or by post to the address in section 1.2 marked "Personal data". We answer without undue delay, and no later than one month from receiving the request. For complex or numerous requests we may extend that period by two months, and we tell you within the first month, with reasons.

9.6. If we have reasonable doubts about the identity of the person making a request, we may ask for information to confirm it, for example confirmation from the e-mail address linked to the Account or a login through Steam.

9.7. Exercising your rights is free. If requests are manifestly unfounded or excessive, in particular because of their repetitive character, we may charge a reasonable fee or refuse to act, giving reasons.

10.1. The Website stores information on your device and accesses information already stored there, using cookies (small text files) and similar technologies, such as sessionStorage entries. Under art. 399 of the Act of 12 July 2024, Electronic Communications Law (PKE), we do this without your consent only where it is necessary to transmit a communication or to deliver a service you explicitly requested; sections 10.4 and 10.5 list every such item. Everything else, analytics included, happens only with your consent, given to the standard art. 400 PKE requires, which is the GDPR standard of consent.

10.2. On your first visit, and whenever new consent is needed, the Website shows a consent banner. It asks before anything happens: no consent-based cookie is set and no consent-based script is loaded until you give consent, and continued browsing, scrolling or inaction is never consent. 10.2.1. You accept or reject each category separately, and rejecting is as easy as accepting, with the reject option at the same level as the accept option. 10.2.2. The cookie-settings link in the footer of the Website reopens the banner at any time, where you withdraw or change your choices as easily as you made them. Refusing consent to storage other than necessary does not block access to the Website.

10.3. The consent banner distinguishes the necessary category (sections 10.4 and 10.5) from the categories requiring your consent: analytics and marketing.

10.3.1. The analytics category covers the following tools.

Google Consent Mode v2 defaults all consent signals to "denied". Google tags receive consent signals only after you give consent and only to its extent. In session recordings, form fields are masked and recording is disabled on the payout and verification screens, so payout details, identity-document data and national identification numbers are never captured.

10.4. The support chat loads only at your request. The Intercom chat does not load with the page. It loads when you open it, and opening it is your request for that service, so the storage needed to run it is exempt from consent under art. 399 PKE. Intercom then sets its own cookies (names beginning with intercom-, for example intercom-id-*, intercom-session-*, intercom-device-id-*, with a lifetime of up to 9 months) to keep your conversation continuous. If you never open the chat, no Intercom cookie is set.

10.5. We use the storage below without your consent, as art. 399 ust. 3 PKE permits:

We write ref_code when you follow a referral link or apply a code. It stores the Bonus Code or the referral code so that the code can be applied to your Sale and, for a referral code, so that the commission can be attributed to the Referrer. This is information necessary to deliver a service you explicitly request by following a link carrying a code or by applying a code (art. 399 PKE), so we do not ask for consent to write it. If you do not want the code applied, you can delete this cookie in your browser settings or simply not use the referral link.

10.6. Device recognition works as follows. To detect multi-accounting, bot activity and abuse of the bonus and referral programs, we compute a technical device identifier on our server side, from the data your browser itself sends with every request: request headers, including user-agent data and language settings, and network-level attributes. We run no script in your browser that reads device characteristics, and we do not access information stored in your device for this purpose. We never use these signals for advertising, marketing profiles or audience measurement. The processing rests on Art. 6(1)(f) GDPR (section 4.1, row 6), and you may object under section 9.2.

10.7. We load embedded third-party components, such as the Trustpilot review widget, so that they store nothing on your device before you interact with them. Where such a component would store or read more than the strictly necessary, we ask for your consent first.

10.8. You can also manage, delete or block cookies in your browser settings; some features of the Website may then stop working correctly.

11.1. The Website is intended only for persons at least 18 years old. We do not knowingly process children's personal data and we do not knowingly direct any service or any communication to them.

11.2. The date of birth collected during verification (section 3.1(e)) also confirms that you meet the age requirement.

11.3. If we establish that an Account belongs to a person under 18, we act under the Terms of Service. While the Account is suspended we process the minor's data only to maintain the Account, to settle the items held and the amounts owed, to document the case and to prevent the Account being recreated, and we send no marketing messages or reminders. Settlement may require the involvement of a parent or another statutory representative, whose contact and identification data we then process for that purpose alone, on Art. 6(1)(c) and Art. 6(1)(f) GDPR.

11.4. If you believe a person under 18 has given us personal data, write to privacy@sellyourskins.com and we will act without undue delay.

12.1. If you reached us through someone's referral link or someone's code, this section 12 is our Art. 14 GDPR notice on the referral relation.

12.2. We process the code, the fact and time of your visit and, once you log in, the link between your Account and the Referrer's Account, to attribute your Sales, calculate the Referrer's commission and determine your eligibility for the Welcome Bonus (section 4.1, row 3). The source of the referral relation is the Referrer, who shared the link or code with you. All other information about you reaches us from you.

12.3. We inform you at first contact: a banner tells you that a referral code is pending, and this Privacy Policy is available to you before you log in.

12.4. Referrers do not see your identity. A Referrer sees only masked identifiers of referred Users, for example a partially hidden nickname and SteamID, with commission amounts.

13.1. We obtain personal data: 13.1.1. directly from you, when you use the Website, apply codes, enter payout details, change settings or contact us; 13.1.2. from Steam (Valve) and, at your request, from steamwebapi.com, your profile and inventory data, publicly accessible on Steam, retrieved when you log in through Steam and use the Website; 13.1.3. from the payment service providers we engage, confirmations and statuses of the payouts they execute for you; 13.1.4. from Neutrino API, the brand, type, issuer country and issuer currency of your payout card, derived from its first digits; 13.1.5. from Twilio Inc. (SendGrid), the delivery, bounce and spam-report status of e-mails sent to you; 13.1.6. from infrastructure providers, the country derived from your IP address (Cloudflare, with ipinfo.io as fallback); 13.1.7. from Referrers, the referral relation described in section 12; 13.1.8. from the service database maintained before the Effective Date, the records of transactions concluded before 1 September 2026 and the program values recorded as at 31 August 2026, which we process only for the purposes and on the bases stated in section 1.5.3.

13.2. For section 13.1.8, the categories concerned are those in section 3.1(a), (c) and (g), and the recipients, retention periods and rights are those set out in sections 6, 8 and 9. We informed you of the change of operator by e-mail on 18 August 2026 and on the change-of-operator page of the Website.

14.1. We apply technical and organizational measures appropriate to the risk: encryption in transit (TLS), access limited to personnel who need it for their tasks, network-level protections, separation of environments, event logging and monitoring, backups, and contractual security obligations imposed on our processors.

14.2. We document every personal data breach and, where Art. 33 GDPR so requires, notify it to the President of the Personal Data Protection Office. Where the breach is likely to result in a high risk to your rights and freedoms, we notify you as well and tell you what you can do to limit its effects (Art. 34 GDPR).

15.1. If you consider that our processing infringes the GDPR, you may lodge a complaint with a supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (President of the Personal Data Protection Office), ul. Stawki 2, 00-193 Warszawa, Poland, www.uodo.gov.pl.

15.2. If you live or work in another country of the European Economic Area, or the infringement took place in such a country, you may lodge the complaint with that country's supervisory authority (Art. 77(1) GDPR).

16.1. The current version is always available at an unchanged address on the Website, showing the date from which it is in force. Previous versions are published alongside it, each showing the dates between which it applied.

16.2. We inform you of material changes, in particular those concerning purposes, legal bases, recipients or your rights, by e-mail to the address linked to your Account or by a clear notice on the Website, before the changes take effect.