Privacy policy

Personal data covered by this policy is controlled by HIGHER MARGINS LTD, trading as Veltskins. For customers in the United Kingdom that control is exercised under the UK GDPR together with the Data Protection Act 2018; for customers in the European Union it is exercised under the EU General Data Protection Regulation.

Seller

HIGHER MARGINS LTD, trading as Veltskins

Company number

15605091

Registered office

20 Wenlock Road, London, England, N1 7GU

Email

info@veltskins.com

Support hours

Mon–Fri, 09:00–18:00 (GMT)

Questions about your data, and requests to exercise a right over it, go to info@veltskins.com.

• Registration: forename and surname, email address, telephone number, date of birth, street, city, postcode, country, and your password, which is retained purely as a one-way hash.
• Steam identity: your SteamID64, with the display name, avatar and profile link published on your Steam profile. Signing in through Steam means Steam vouches for your Steam ID to us; your Steam password is never visible to us.
• Trade URL: the Steam trade URL stored against your account, which carries your Steam account number and a trade token. Its only use is sending you trade offers for lots you have bought.
• Purchases: the lots bought, the address billed, the contact details given, your instruction to deliver immediately, how each trade offer ended, and the payment outcome and transaction reference our payment provider returns to us.
• Correspondence: whatever you write to us by email or through the contact form, any order number in it, and in the case of the form the IP address it came from.
• Saved lots: the lots you have kept against your account.
• Newsletter: an email address, where you asked to receive it.
• Technical: IP address, browser and device type and the pages requested, as written to our server logs. Anything held in your browser is covered by the Cookie policy.

A full card number is something we neither hold nor handle. Card processing is carried out in its entirety by our PCI DSS compliant payment provider.

The form you type your card into is hosted by that provider and does not sit on our site. 3-D Secure and Strong Customer Authentication (SCA) guard the payment, which is why your bank may want you to approve it, often from inside its app. What comes back to us is the outcome and a transaction reference, nothing more.

Beyond our own staff, personal data goes only to service providers acting on our instructions as processors, and each receives no more of it than its task requires:

• Card payments: handles card payments on a hosted page of its own and carries out the 3-D Secure checks.
• Item delivery partner: obtains the item you bought and dispatches the Steam trade offer to your account from your Steam ID and trade URL.
• Steam (Valve Corporation) (Valve Corporation): authenticates you whenever you pick Steam sign-in, and conveys the trade offer into your account.
• Website hosting and database: keeps the shop running and holds the account and order records.
• Email delivery: dispatches the order, account and support email.

Disclosure may also be compelled by law — to a tax authority or the police, for instance — or needed by a card issuer investigating a disputed payment. Personal data is never sold, and advertisers are never given access to it.

Valve Corporation runs Steam from the United States, so signing in through Steam and the trade offers themselves are processed there, governed by Valve’s own privacy policy. The partner that delivers your lots is given your Steam ID and trade token in order to send the offer. Whenever a provider handles data beyond the United Kingdom or the European Economic Area, the transfer rests either on an adequacy decision or on standard contractual clauses, with the UK International Data Transfer Addendum added for data from the UK.

• Records of orders, payments and refunds are held for 6 years from the order, as accounting and tax law requires.
• An account lasts until you ask for it to be closed, or lapses after 3 years with no sign-in and no order; the order records behind it are then retained on the basis above.
• Correspondence and complaints are held for 24 months from the close of the conversation.
• Newsletter data is held until you unsubscribe.

The law entitles you to:

• a copy of the personal data we hold on you;
• correction of anything inaccurate in it;
• erasure where the need for it has passed or no lawful basis supports keeping it;
• a restriction on how we use it, or an objection to our using it at all, legitimate interests included;
• the data you supplied, handed back in a portable format;
• withdrawal of a consent at any moment — unsubscribing from the newsletter or revisiting your cookie settings, for example.

Write to info@veltskins.com to exercise any of them. Our answer comes inside one month. Expect to be asked to prove who you are before we act.

A supervisory authority is also open to you: the Information Commissioner’s Office (ico.org.uk) in the United Kingdom, or in the European Union the data protection authority for the country you live or work in. We would rather you let us try to put the matter right first.

Nothing is served over anything but HTTPS. Passwords exist only as one-way hashes. Customer records are reachable solely by the people whose job is filling orders and answering messages. Card numbers, Steam passwords and Steam Guard codes never enter our systems at all.

No decision carrying legal or comparably significant consequences for you is taken here by automated means on its own. Automated fraud screening does run at your card issuer and at our payment provider, and either may refuse a payment. Tell us when that happens and we will review the order.

This is an adults’ shop. Data is not knowingly gathered from anyone below 18. Should you have reason to think an account belongs to someone under 18, write to info@veltskins.com and we will remove it.

Whenever our handling of personal data changes, this policy is revised to match. The date at the head of the page identifies the current version.