This Privacy Policy explains how Digital Axis s.r.o. (“CrystalSkins”, “we”, “us”) collects, uses and protects your personal data when you use crystalskins.store, and the rights you have under the EU General Data Protection Regulation (GDPR) and Czech data-protection law.
1. Data controller
The controller of your personal data is Digital Axis s.r.o., registration number C 452692, registered office Podskalská 1512/22, Nové Město, 128 00, Prague 2, Czech Republic. For any privacy matter you can contact us at support@crystalskins.store.
2. The personal data we collect
We collect only the data we need to operate the store and deliver your Items:
- Account and identity data — your Steam ID and public Steam profile information (username, avatar) when you sign in with Steam, and any email address you provide.
- Order and delivery data — the Items you buy, order value and history, and your Steam Trade URL, which is required to deliver Items to your inventory.
- Payment data — payments are processed by our payment providers; we receive confirmation of payment and limited details (such as the card type and last digits or a transaction reference). We do not store full card numbers.
- Communications — the content of messages you send us through the contact form, email or support channels.
- Technical and usage data — IP address, device and browser information, and information collected through cookies and similar technologies (see our Cookies Policy).
3. How and why we use your data
We process your personal data for the following purposes and on the following legal bases under Article 6 GDPR:
| Purpose | Legal basis |
|---|---|
| Creating and managing your account and authenticating you via Steam | Performance of a contract |
| Processing Orders, taking payment and delivering Items to your Trade URL | Performance of a contract |
| Providing customer support and handling complaints and refunds | Performance of a contract; legitimate interests |
| Preventing fraud, abuse and unauthorised transactions, and ensuring security | Legitimate interests; legal obligation |
| Keeping accounting and tax records | Legal obligation |
| Analytics, and (where applicable) marketing communications | Consent (which you may withdraw at any time) |
4. Cookies and similar technologies
We use cookies and similar technologies to run the store, remember your basket and preferences, keep the Service secure, and — with your consent — to measure usage. Full details, and how to manage your choices, are in our Cookies Policy.
5. Who we share your data with
We do not sell your personal data. We share it only with parties that help us run the Service, and only as necessary:
- Payment providers that process your payments securely;
- Valve Corporation / Steam, to the extent required to deliver Items to your Steam account;
- IT, hosting and infrastructure providers that host the Service and protect it (for example against bots and abuse);
- Professional advisers and authorities, where required by law, to comply with legal obligations, or to establish, exercise or defend legal claims.
These parties act as our processors under appropriate agreements, or as independent controllers where the law so provides.
6. International transfers
Where a provider processes data outside the European Economic Area, we ensure an adequate level of protection through an appropriate safeguard recognised under the GDPR, such as an adequacy decision of the European Commission or the European Commission’s Standard Contractual Clauses.
7. How long we keep your data
We keep your personal data only for as long as necessary for the purposes above. In general, account data is kept while your account is active; order, payment and accounting records are kept for the periods required by Czech tax and accounting law (generally up to 10 years); and support correspondence is kept for as long as needed to handle your request and any related claims. Data kept on the basis of consent is deleted when you withdraw consent, unless another basis applies.
8. Your rights
Subject to the conditions in the GDPR, you have the right to:
- Access the personal data we hold about you and receive a copy;
- Rectify inaccurate or incomplete data;
- Erase your data (“right to be forgotten”);
- Restrict or object to certain processing, including processing based on legitimate interests;
- Data portability — receive certain data in a structured, machine-readable format;
- Withdraw consent at any time, without affecting processing carried out before withdrawal.
To exercise any right, contact us at support@crystalskins.store. We will respond within the time limits set by the GDPR (normally one month). We may need to verify your identity first.
9. Automated decision-making
We do not make decisions producing legal or similarly significant effects about you based solely on automated processing. We do use automated checks to help detect fraud and abuse; where such a check affects an Order, you may contact us for a human review.
10. Security
We implement appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access, including encryption in transit, access controls and use of vetted providers. No method of transmission or storage is completely secure, but we work to protect your data and to respond promptly to any incident.
11. Children
The Service is intended for users aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
12. Changes to this Policy
We may update this Privacy Policy from time to time. The current version is the one published on this page, with the “Last updated” date shown above. Where changes are material, we will take reasonable steps to inform you.
13. Contact and supervisory authority
If you have any question or concern about how we handle your data, please contact us first at support@crystalskins.store. You also have the right to lodge a complaint with the Czech supervisory authority, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, www.uoou.cz, or with the supervisory authority in your country of residence.