1. Introduction

1.1 This Privacy Policy explains what personal data (we, us or our) collects when you use vantafloat.com (the Website), why we collect it, how we use and protect it, and what rights you have in relation to it.

1.2 is the controller of your personal data. We are a company registered in England and Wales under company number , with our registered office at , , , , , .

1.3 We handle personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1.4 By using the Website, you acknowledge that you have read this Policy and understand how your personal data will be handled.

2. Who this policy applies to

2.1 The Website is intended for adults aged 18 and over. We do not knowingly collect or use personal data relating to anyone under 18. If you believe that a minor has provided us with personal data, please contact us at [email protected].

3. The personal data we collect

The information we hold about you depends on how you interact with the Website. It falls into the groups described below.

3.1 Data you give us directly

(a) Identity and contact details, such as your name, email address and billing information, provided at checkout or when you set up or use your account.

(b) Messages and other correspondence you send to us through our support channels or contact forms.

(c) Verification documents, such as proof of identity and proof of address. We ask for these only when a compliance or know-your-customer (KYC) check is triggered.

3.2 Data from your Steam account

When you sign in with Steam, we receive your Steam username, Steam ID, trade URL and trade history. We need this information to deliver the items you buy.

3.3 Data about your orders

For each purchase, we keep a record of the item, the price, confirmation of payment and the delivery status.

3.4 Data collected automatically

(a) Technical information recorded when you visit the Website, including your IP address, browser type, operating system, device identifiers, the length of your session and the pages you view.

(b) Information gathered through cookies and similar technologies, as explained in our Cookie Policy.

3.5 Data from third parties

We may receive information about you from the payment processors, fraud prevention services and sanctions screening providers that we work with.

3.6 Payment card details

Card payments are handled entirely by our payment provider. We never receive, store or have access to your full card number, CVV code or card expiry date.

4. Why we use your data and our legal basis

4.1 We only use personal data where UK GDPR gives us a lawful basis to do so. Our main purposes, and the basis we rely on for each, are as follows:

(a) processing your orders and delivering items to you via Steam: necessary to perform our contract with you;

(b) allowing you to sign in with your Steam account: necessary to perform our contract with you;

(c) dealing with support requests and resolving disputes: necessary to perform our contract with you;

(d) detecting and preventing fraud: our legitimate interests;

(e) analysing and improving the Website: our legitimate interests;

(f) carrying out anti-money laundering and counter-terrorist financing checks and sanctions screening: compliance with a legal obligation;

(g) keeping tax, accounting and regulatory records: compliance with a legal obligation;

(h) sending you marketing messages, only if you have opted in to receive them: your consent.

5. Payment security and 3D Secure

5.1 Every payment made on the Website is processed solely by our authorised third-party payment service provider, which holds a current PCI DSS certification. Sensitive payment information is handled only within that provider's secure systems, and we have no access to it at any point.

5.2 Where the card scheme or payment method requires it, card payments go through 3D Secure authentication. This step allows your card issuer to confirm that you are the cardholder before the payment is approved.

5.3 If a payment has been assessed by an automated risk check, you can ask for it to be reviewed manually by emailing [email protected].

6. Who we share your data with

6.1 We never sell, rent or trade your personal data. We only share it in the following cases:

(a) with payment providers and acquiring banks, to process and authenticate transactions and to monitor for fraud;

(b) with Valve Corporation, which operates Steam, to the extent needed to deliver your items by trade offer;

(c) with service providers that support our hosting, analytics and customer communications. They act under data processing agreements and are not permitted to use your data for their own purposes;

(d) with regulators and law enforcement agencies, where the law, a regulation or a court order requires us to disclose it;

(e) with our professional advisers, such as lawyers and accountants, who are bound by duties of confidentiality.

7. International transfers

7.1 We mainly process your personal data in the United Kingdom.

7.2 Some of our partners operate internationally. If your data is transferred outside the UK or the European Economic Area, we make sure that appropriate legal safeguards are in place. These may include adequacy regulations made by the UK Government, International Data Transfer Agreements (IDTAs) or Standard Contractual Clauses.

7.3 To find out more about the safeguards that apply to a particular transfer, email [email protected].

8. How long we keep your data

8.1 We keep personal data only for as long as necessary, in line with the following periods:

(a) KYC and anti-money laundering records: at least five years after our business relationship with you ends, as required by Regulation 40 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 and the Proceeds of Crime Act 2002;

(b) order and financial records: up to six years, for accounting and regulatory purposes;

(c) support correspondence: up to three years, or longer if a dispute or legal matter is still open;

(d) cookie and analytics data: for the retention period of the relevant tool, or until you clear it using your browser settings.

8.2 When a retention period ends, we securely delete or anonymise the data in accordance with our internal procedures.

9. How we protect your data

9.1 We use technical and organisational measures appropriate to the risks involved, including encryption of data in transit and at rest, strict role-based access controls and regular security reviews.

9.2 No method of sending data over the internet is completely secure. You are responsible for keeping your own account login details safe.

10. Your rights

10.1 Under UK GDPR, you have the right to:

(a) access the personal data we hold about you and receive a copy of it;

(b) have inaccurate or incomplete data corrected;

(c) ask us to delete your data where we no longer have a lawful reason to keep it;

(d) ask us to restrict how we use your data in certain circumstances;

(e) receive your data in a machine-readable format (data portability);

(f) object to processing that is based on our legitimate interests;

(g) withdraw your consent at any time where we rely on consent, without affecting the lawfulness of any processing carried out before you withdrew it.

10.2 To exercise any of these rights, email [email protected]. We will reply within one calendar month.

10.3 You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at www.ico.org.uk.

11. Cookies

11.1 Details of how we use cookies and similar technologies are set out in our Cookie Policy.

12. Changes to this policy

12.1 We review this Policy regularly. When we make significant changes, we will publish the updated version on the Website with a new effective date.

12.2 If you continue to use the Website after an update has been published, the revised Policy will apply to you.

13. Contact us

Registered in England and Wales, company number

Registered office: , , , , ,

Email: [email protected]

Website: vantafloat.com