1. Introduction

This Privacy Policy explains how Magma Skins collects, uses, stores, and protects personal data when you visit or use the Magma Skins website and when you purchase digital Counter-Strike 2 cosmetic items through the service.

Magma Skins is operated by:

SUPERNOVA DONATIONS LTD
Company number: 15596785
Registered address: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Email: support@magmaskins.com

For the purposes of applicable UK data protection law, SUPERNOVA DONATIONS LTD is the controller of personal data processed in connection with Magma Skins, except where a third party independently determines the purposes and means of its own processing.

Magma Skins is an independent online store and reseller of digital Counter-Strike 2 cosmetic items. It is not affiliated with, sponsored by, or endorsed by Valve Corporation or Steam.

2. Scope of This Policy

This Privacy Policy applies to personal data collected or processed when you:

• visit or browse Magma Skins;
• create or use a Magma Skins account;
• connect or use your Steam account in connection with the service;
• place or manage an order;
• receive digital Products through the service;
• contact customer support;
• submit a complaint or request;
• interact with the website or its security features; or
• otherwise communicate with Magma Skins.

This Policy should be read together with the Terms and Conditions, Cookie Policy, Refund Policy, Delivery and Shipping Policy, Complaints and Warranty Policy, and Payment Policy.

3. Personal Data We Collect

The personal data we collect depends on how you use the service.

3.1 Account and Contact Information

We may collect information such as:

• email address;
• account identifier;
• username or display name;
• Steam account identifier, including SteamID/Steam64ID;
• information contained in your Steam public profile where necessary for order fulfilment; and
• other information you voluntarily provide to us.

We only request information reasonably necessary for operating the service, fulfilling orders, providing support, and complying with applicable legal obligations.

3.2 Steam and Delivery Information

Where digital delivery requires Steam information, we may process information necessary to identify the intended destination of an order.

This may include:

• SteamID;
• Steam profile information;
• Steam username or display name;
• Steam Trade URL;
• trade-related identifiers;
• information concerning the status of a digital transfer; and
• information necessary to verify successful delivery.

Magma Skins does not request or require your Steam password.

Where Steam authentication or integration is used, authentication is handled through the applicable Steam functionality. Magma Skins does not need your Steam password in order to identify the Steam account associated with an order.

3.3 Order and Transaction Information

We may process information relating to your orders, including:

• order ID;
• Products purchased;
• order date and time;
• order value;
• transaction status;
• refund information;
• delivery status;
• Steam delivery information;
• records of customer communications concerning an order; and
• information required to investigate disputes or payment-related issues.

We do not need to store full payment card numbers or CVV/security codes in order to administer an order where those credentials are handled by the relevant payment service infrastructure.

3.4 Technical and Usage Information

When you use the website, certain technical information may be collected automatically.

This may include:

• IP address;
• browser type and version;
• device type;
• operating system;
• language and regional settings;
• approximate location derived from technical information where applicable;
• pages visited;
• referring pages;
• access dates and times;
• session information;
• website interaction information;
• error and diagnostic information; and
• security-related technical information.

Some of this information may be collected through cookies or similar technologies. More information is provided in the Cookie Policy.

3.5 Customer Support and Communications

If you contact us, we may process:

• your name or account identifier;
• email address;
• order information;
• Steam identifier where relevant;
• the content of your communication;
• attachments or evidence you voluntarily provide; and
• information required to investigate and resolve your request.

We ask customers not to send passwords, full payment card numbers, CVV/security codes, or other unnecessary authentication credentials.

3.6 Security and Fraud-Prevention Information

We may process information necessary to protect Magma Skins, customers, payment processes, accounts, and digital Products from fraud, abuse, unauthorized access, and other prohibited activity.

This may include:

• IP address;
• account activity;
• order history;
• transaction information;
• Steam-related information;
• device and technical information;
• security events;
• unusual activity indicators; and
• information concerning suspected misuse of the service.

Magma Skins does not generally require identity verification as part of the standard customer purchasing process. However, additional identity, age, fraud-prevention or compliance verification may be requested in certain circumstances, including where required by our payment partners, applicable law, or where a transaction or account activity presents an elevated risk.

Such information is processed only where necessary for the relevant verification purpose and may be handled directly by a specialist verification provider acting under its own or our applicable data protection responsibilities.

3.7 Identity and Verification Information

Where additional verification is required, we or our verification service providers may process information necessary to complete identity, age, fraud-prevention, security, or compliance checks.

This may include:

• name;
• date of birth;
• government-issued identification document information;
• photographs or selfies, where required for verification;
• verification status and results; and
• other information reasonably necessary to complete the relevant verification check.

4. How We Use Personal Data

We use personal data only for legitimate and defined purposes.

These purposes may include:

4.1 Providing the Service

We process personal data to:

• operate Magma Skins;
• maintain customer accounts;
• provide access to the website;
• process orders;
• arrange digital delivery;
• identify the intended Steam account;
• provide customer support; and
• administer our contractual relationship with you.

The principal lawful basis is performance of a contract or taking steps at your request before entering into a contract.

4.2 Order Administration

We use order and account information to:

• process and administer orders;
• confirm payment status;
• arrange digital delivery;
• maintain order records;
• investigate delivery problems;
• process refunds where applicable; and
• communicate with customers about their orders.

The principal lawful basis is performance of a contract.

4.3 Security and Fraud Prevention

We may process information to:

• prevent fraudulent transactions;
• detect unauthorized activity;
• protect customer accounts;
• protect our systems;
• investigate suspected abuse;
• enforce our Terms and Conditions; and
• protect the integrity and security of the service.

The lawful basis may be legitimate interests, where the processing is necessary for these purposes and our interests are not overridden by your rights and interests.

Our legitimate interests include maintaining a secure online service, preventing fraud and abuse, protecting customers and the business, and enforcing contractual rules.

4.4 Legal and Regulatory Compliance

We may process personal data where necessary to:

• comply with applicable legal obligations;
• maintain accounting and business records;
• respond to lawful requests from competent authorities;
• establish, exercise, or defend legal claims; and
• comply with court orders or other legal requirements.

The relevant lawful basis may be legal obligation or legitimate interests, depending on the circumstances.

4.5 Customer Support and Complaints

We use personal data to:

• respond to questions;
• investigate complaints;
• resolve delivery problems;
• investigate refunds;
• resolve disputes;
• maintain records of customer communications; and
• improve the quality and security of customer support.

Depending on the circumstances, the lawful basis may be performance of a contract, legitimate interests, or legal obligation.

4.6 Website Improvement

We may use technical and usage information to understand how the website operates, identify errors, maintain functionality, and improve the service.

Where consent is required for a particular cookie or similar technology, we will seek consent in accordance with applicable law and our Cookie Policy.

5. Lawful Bases for Processing

Under UK data protection law, we rely on one or more lawful bases depending on the purpose of the processing.

These may include:

• Contract — where processing is necessary to provide the service or fulfil an order.
• Legal obligation — where processing is necessary to comply with a legal requirement.
• Legitimate interests — where processing is necessary for legitimate business interests such as security, fraud prevention, service administration, and protection of legal rights, provided those interests are not overridden by your rights and freedoms.
• Consent — where consent is required, including for certain optional cookies, marketing communications, or other processing where consent is the appropriate lawful basis.

Where we rely on consent, you may withdraw your consent at any time. Withdrawal of consent does not affect processing that took place before consent was withdrawn.

We determine and document the applicable lawful basis before carrying out processing for a particular purpose.

6. Cookies and Similar Technologies

Magma Skins uses cookies and similar technologies to operate the website, maintain sessions, support security, remember preferences, and, where applicable, analyse website usage.

The use of non-essential cookies and similar technologies is handled in accordance with applicable UK privacy and data protection requirements.

Further information is provided in the Cookie Policy.

7. Sharing Personal Data

We may share personal data where reasonably necessary for the purposes described in this Policy.

Depending on the circumstances, recipients may include:

• service providers that host or maintain our website and infrastructure;
• providers supporting website security and fraud prevention;
• providers supporting order administration or digital delivery;
• payment-processing infrastructure, where necessary to confirm or administer a transaction;
• professional advisers;
• accountants, auditors, insurers, or legal advisers;
• competent authorities where disclosure is required or permitted by law; and
• other service providers acting on our documented instructions.

We do not sell personal data to third parties.

We only disclose personal data to third parties where there is a lawful basis for doing so and where the disclosure is necessary and proportionate to the relevant purpose.

8. Steam and Valve

Magma Skins is an independent service and is not affiliated with or endorsed by Valve Corporation or Steam.

Where Steam-related information is processed, it is used only to the extent reasonably necessary for purposes such as:

• identifying the intended customer account;
• facilitating digital delivery;
• confirming delivery;
• preventing fraud or abuse; and
• providing customer support.

Steam and Valve may independently process information under their own terms and privacy policies. Their processing is not controlled by Magma Skins.

9. Third-Party Websites and Services

The Magma Skins website may contain links or integrations involving third-party websites or services.

If you access a third-party service, that service may process personal data under its own privacy policy and terms.

Magma Skins is not responsible for the privacy practices of independent third parties that operate outside our control.

10. International Transfers

Some service providers or recipients used in connection with Magma Skins may process personal data outside the United Kingdom.

Where personal data is transferred internationally, we will take appropriate steps required by applicable UK data protection law.

Depending on the destination and circumstances, this may include:

• a UK adequacy decision or applicable regulations;
• appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum to EU Standard Contractual Clauses;
• applicable transfer risk assessments; or
• another lawful transfer mechanism permitted under UK data protection law.

Where required, information about the applicable safeguards will be made available upon request.

11. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected.

The retention period depends on the type of information and the reason for processing.

For example:

• Account and service information may be retained while your account is active and for a reasonable period afterwards where necessary for security, dispute resolution, legal claims, or other legitimate purposes.
• Order and transaction records may be retained for the period necessary to meet accounting, tax, legal, contractual, and dispute-resolution requirements.
• Customer support and complaint records may be retained for as long as reasonably necessary to resolve the matter and establish, exercise, or defend legal claims.
• Security and fraud-prevention records may be retained for a reasonable period appropriate to the security risk and the purpose for which the information was collected.
• Consent records may be retained for as long as necessary to demonstrate compliance with applicable legal requirements.
• Marketing information processed on the basis of consent will be retained until consent is withdrawn, subject to any information that we are lawfully required or entitled to retain for another purpose.

When personal data is no longer required, we will securely delete it or anonymise it where appropriate.

Where a precise retention period cannot reasonably be specified, we use the criteria described above to determine how long the relevant personal data should be retained.

12. Your Data Protection Rights

Subject to applicable legal conditions and exemptions, you may have the right to:

• request access to your personal data;
• request correction of inaccurate or incomplete personal data;
• request deletion of your personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• object to direct marketing;
• request portability of certain personal data;
• withdraw consent where processing is based on consent; and
• make a complaint to the relevant supervisory authority.

Not all rights apply in every circumstance, and some rights are subject to statutory conditions or exemptions.

For example, the right to erasure is not absolute where we have a legal obligation or another lawful reason to retain information.

You also have an absolute right to object to the use of your personal data for direct marketing.

13. How to Exercise Your Rights

To exercise a data protection right, contact:

support@magmaskins.com

Please provide sufficient information to allow us to identify you and understand your request.

We may request reasonable additional information where necessary to verify your identity and protect personal data against unauthorized disclosure.

We will normally respond to a valid data protection request within the period required by applicable law.

We will not charge a fee for ordinary data protection requests unless applicable law permits us to do so.

14. Right to Complain

If you are concerned about how we process your personal data, we encourage you to contact us first so that we can investigate the issue.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent supervisory authority for data protection.

Information about the ICO and its complaint procedures is available through the ICO's official website.

15. Automated Decision-Making and Profiling

Magma Skins may use automated technical processes for purposes such as website security, fraud prevention, abuse detection, and service administration.

We do not intend to make decisions based solely on automated processing that produce legal or similarly significant effects on individuals unless permitted by applicable law and appropriate safeguards are provided.

Where UK data protection law gives you rights in relation to solely automated decision-making or profiling, those rights will apply in accordance with the applicable legal requirements.

16. Data Security

We use appropriate technical and organisational measures designed to protect personal data against:

• unauthorized access;
• accidental loss;
• destruction;
• alteration;
• unauthorized disclosure; and
• other unlawful or unauthorized processing.

Security measures may include access controls, authentication mechanisms, encryption where appropriate, monitoring, security procedures, and restricted access to personal data.

No internet-based service can guarantee absolute security. However, we take reasonable measures appropriate to the nature and risks of the personal data we process.

17. Data Breaches

Where a personal data breach occurs, we will assess the breach and take appropriate action in accordance with applicable UK data protection law.

Where notification to the ICO or affected individuals is legally required, we will make the relevant notification within the applicable statutory timeframe.

18. Children's Privacy

Magma Skins is intended for users who are 18 years of age or older.

We do not knowingly provide the service to children under 18 or intentionally collect personal data from children for the purpose of providing the service.

If you believe that a person under 18 has provided personal data to us, please contact us at:

support@magmaskins.com

We will assess the circumstances and take appropriate action where required by applicable law.

19. Personal Data Received from Other Sources

In some circumstances, we may receive personal data from sources other than the individual concerned.

For example, information may be received through:

• Steam or Steam-related functionality;
• service providers supporting the operation of the website;
• fraud-prevention or security systems;
• payment-processing infrastructure;
• customer communications; or
• another party involved in an order or dispute.

Where applicable law requires additional privacy information when personal data is obtained from another source, we will provide that information in accordance with the applicable requirements.

The UK GDPR generally requires privacy information to be provided when data is collected directly and, where obtained from another source, within the applicable statutory period.

20. Business Transfers

If SUPERNOVA DONATIONS LTD is involved in a merger, acquisition, restructuring, sale of assets, or similar corporate transaction, personal data may be transferred where necessary as part of that transaction.

Any such transfer will be carried out in accordance with applicable data protection law.

Where required, affected individuals will receive appropriate information about material changes to the controller or processing.

21. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes to our services;
• changes to how we process personal data;
• changes to legal or regulatory requirements;
• changes to our service providers or infrastructure; or
• improvements to our privacy practices.

The updated version will be published on the Magma Skins website with a revised effective date.

Where changes are material and applicable law requires additional notice, we will provide appropriate notice.

22. Contact

For privacy and data protection questions, requests, or complaints, please contact:

SUPERNOVA DONATIONS LTD
Magma Skins
71–75 Shelton Street
Covent Garden
London WC2H 9JQ
United Kingdom

Email: support@magmaskins.com

We recommend using the subject line “Privacy / Data Protection Request” when submitting a data protection request.

23. Applicable Law

This Privacy Policy is intended to comply with applicable UK data protection and privacy law, including the UK GDPR and the Data Protection Act 2018, as applicable.

Nothing in this Privacy Policy is intended to exclude or restrict any data protection right that cannot lawfully be excluded or restricted.