This Privacy Policy explains how GEMSEED LTD collects and uses personal data when you visit penguinskins.com, create an account, buy Items or contact us, and what rights you have. We process personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where it applies to you, the EU General Data Protection Regulation (EU GDPR).
1. Who is responsible for your data
GEMSEED LTD (company number 17519702), First Floor Office, 3 Hornton Place, London, W8 4LZ, United Kingdom, is the controller of your personal data.
For any privacy question or request, email support@penguinskins.com with “Privacy” in the subject line, use the form on our Contacts page (topic “Privacy request”), or write to us at the address above.
2. The data we collect
- Identity and contact data: your name, email address, phone number, billing address and country, and your username if you create an account.
- Account data: your password (stored only in hashed form), account settings and your saved Steam Trade URL.
- Steam data: your Trade URL, which contains your Steam account ID and a trade token, and the public Steam profile information shown to us when we send a Trade Offer, such as your profile name and avatar.
- Order data: the Items you buy, prices, coupon codes, order and delivery status, and your communications about the order.
- Payment data: the payment method type, transaction references and payment status. Card and bank details are collected and processed by our payment providers; we do not receive or store full card numbers.
- Verification data: if we need to verify your identity or the source of funds to prevent fraud or meet legal obligations, the information and documents you provide.
- Communications: the messages you send us and, if you subscribe, your newsletter subscription and the record of your consent.
- Technical data: your IP address, browser and device type, operating system, pages visited, referring website and the date and time of requests. This appears in server logs and, for orders, in the order record.
- Cookie data: see our Cookie Policy.
We never ask for your Steam password, Steam Guard codes or Steam Web API key. We do not collect special categories of personal data.
3. Where the data comes from
- From you, when you fill in forms, check out, manage your account or email us.
- Automatically, when you use the Website (server logs and cookies).
- From Steam, when we send and complete Trade Offers.
- From payment providers, which confirm payments and may share fraud-prevention signals.
4. How we use your data and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Creating and managing your account | Performance of a contract |
| Processing your orders, taking payment and delivering Items through Steam | Performance of a contract |
| Sending service emails about your orders and account | Performance of a contract |
| Answering your messages and handling refunds and complaints | Performance of a contract; our legitimate interests in helping customers and resolving disputes |
| Preventing fraud, money laundering and abuse, and keeping the Website secure (for example by limiting repeated failed login attempts) | Our legitimate interests in protecting our customers and business; compliance with legal obligations |
| Keeping accounting and tax records and meeting other legal duties | Compliance with legal obligations |
| Sending our newsletter | Your consent, which you can withdraw at any time |
| Remembering your preferences on the Website and understanding which pages and sources lead to orders | Your consent, given in our cookie banner |
| Establishing, exercising or defending legal claims | Our legitimate interests |
Where we rely on legitimate interests, we have balanced them against your interests and rights; you can ask us for details. If you do not provide the data we need to perform our contract with you (such as your email address or Trade URL), we cannot process your order.
5. Who we share your data with
- Valve Corporation (Steam), to send and complete Trade Offers. Valve processes data under its own privacy policy.
- Payment providers, to process payments and refunds and to prevent fraud. They act as independent controllers for their own processing.
- Hosting and IT service providers that host the Website and our email, acting on our instructions.
- Google, which delivers the web fonts used by the Website. When a page loads, your browser connects to Google’s servers, which receive your IP address. Google does not set cookies for this service.
- Professional advisers, such as lawyers, accountants, auditors and insurers.
- Authorities, regulators, courts and law enforcement, where the law requires it or where it is necessary to protect rights or prevent fraud.
- A buyer or successor, if our business or its assets are transferred, who must use your data in line with this Policy.
We do not sell your personal data and do not share it for advertising.
6. International transfers
Some recipients, such as Valve and Google, are located in or process data in countries outside the UK and the European Economic Area, including the United States. When personal data is transferred outside the UK or EEA, we make sure it is protected by relying on adequacy regulations or decisions (including the UK Extension to the EU–US Data Privacy Framework where the recipient is certified) or by using the UK International Data Transfer Agreement, the UK Addendum or the EU Standard Contractual Clauses. Contact us if you would like more information.
7. How long we keep your data
| Data | Retention period |
|---|---|
| Account data | While your account is open. When you ask us to close it, we delete or anonymise it within 30 days, except data we must keep for the reasons below. |
| Orders, payments and related correspondence | 6 years after the end of the financial year in which the order was placed, to meet accounting, tax and legal requirements. |
| Messages and complaints | 2 years after the matter is closed. |
| Newsletter subscription | Until you unsubscribe. After that we keep only your email address on a suppression list so that we do not email you again. |
| Server and security logs | Up to 90 days, unless needed to investigate an incident. |
| Failed login records | 15 minutes. |
| Cookies | As listed in our Cookie Policy. |
8. How we protect your data
We use encrypted HTTPS connections, store passwords only as hashes, restrict access to staff who need it, limit repeated login attempts, keep regular backups and apply security updates. No method of transmission or storage is completely secure, but we work hard to protect your data and will notify you and the regulator of a personal data breach where the law requires.
9. Your rights
Subject to the conditions set by law, you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict how we use your data;
- receive your data in a portable format;
- object to processing based on our legitimate interests, and to direct marketing at any time;
- withdraw your consent at any time, without affecting processing that took place before; and
- not be subject to decisions based solely on automated processing that have legal or similarly significant effects.
To use your rights, contact us as described in section 1. We may ask you to confirm your identity. We respond within one month; for complex or numerous requests this may be extended by up to two further months, and we will tell you if so. There is no charge unless a request is manifestly unfounded or excessive.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at ico.org.uk or on 0303 123 1113, or, if you live or work in the EU or EEA, to your local data protection authority. We would appreciate the chance to deal with your concerns first.
10. Automated decisions
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Our payment providers may use automated fraud screening that can decline a payment; if this happens, contact us and we will review your order with you.
11. Marketing
We send our newsletter only if you have subscribed and given your consent. You can unsubscribe at any time using the link in any newsletter email or by contacting us. Service emails about your orders and account are not marketing and are sent regardless.
12. Children
The Website is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact us and we will delete it.
13. Links to other websites
The Website links to services such as Steam and to our social media pages. Those services have their own privacy policies, and we are not responsible for how they handle your data.
14. Changes to this Policy
We may update this Privacy Policy from time to time. The date at the top of this page shows when it was last updated. If we make significant changes, we will tell you on the Website or by email.