Privacy Policy

At a glance

Skin.Club is operated by Moontain Limited, a Cyprus-incorporated company. We are the controller of your personal data. We collect data you give us (account, KYC, payment), data about how you use the platform (activity, device, location), and data from third parties (Steam, identity-verification providers). This Policy also applies to personal data processed in connection with the Skin Creators Contest, including Steam authentication, submission of Steam Workshop works, moderation, voting, giveaways, rankings, prize administration, and promotional use of submitted Works. We use this data to run the platform, verify your age and identity, prevent fraud, comply with anti-money-laundering law, and send you marketing where you have agreed to it. Identity verification involves a biometric liveness check carried out by our verification provider; we receive only your identity document and the verification result, not the biometric template. We use automated systems to support risk scoring and account decisions, but significant decisions about your account are made or reviewed by a person, and you can request human review. We share your data with service providers (hosting, analytics, advertising, identity verification) and in limited cases transfer it outside the EU/EEA under appropriate safeguards. You have the right to access, correct, delete, object to, restrict and port your data. You can exercise your rights through privacy@skin.club.

1. About this policy

This Privacy Policy describes how Moontain Limited (“Skin.Club”, “we”, “us”, “our”) collects, uses, shares and protects your personal data when you access or use the Skin.Club website at https://skin.club, the Skin.Club Community Portal at https://community.skin.club, the Skin Creators Contest service, and related services (collectively, the “Platform” and the “Services”).

We are the controller of your personal data. This means we decide what personal data is collected about you, why it is collected and how it is used. This policy is designed to comply with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), the Cyprus Personal Data Protection Law (Law 125(I)/2018), and applicable national rules implementing the ePrivacy Directive. If you do not agree with any part of this policy, please do not use the Platform.

2. Who we are and how to contact us

Controller: Moontain Limited, incorporated in the Republic of Cyprus under registration number HE410299, registered office at 13 Kypranoros Street, Office 205, 1061 Nicosia, Cyprus. General enquiries: help@skin.club Data Protection Officer: privacy@skin.club (or write to the registered office, marked FAO “Data Protection Officer”). EU/EEA matters: You may also contact the Cyprus Commissioner for Personal Data Protection (https://www.dataprotection.gov.cy).

3. The personal data we collect

Information you give us

Account information: Steam ID, username, display name, email address (optional for some flows), language preference, password credentials.
Contest and Submission information: Steam Workshop URLs, submitted Work titles, descriptions, images and other content or metadata available through Steam Workshop, creator or co-creator status, Steam profile information associated with a Submission, moderation status, voting activity, voting limits, Giveaway tickets, rankings, winner status, prize-claim information, and communications relating to the Contest.
Identity and age-verification information: full legal name, date of birth, nationality, government-issued identification document, a photograph of you with the document (“selfie”), and biometric data derived from a liveness check, collected through our identity-verification provider (see Section 5).
Payment information: limited payment card details (scheme, last four digits, expiry, token) or wallet identifier, required to process deposits. We do not store full card numbers.
Communications: the content of messages you send us through support chat, email or other channels.

Information we collect automatically

Device and technical information: IP address, device identifiers, browser type and version, operating system, language, time zone, screen resolution, device fingerprint.
Location information: approximate location derived from your IP address and, where you permit it, more precise location.
Platform activity: pages visited, features used, Contest participation, Submissions, moderation outcomes, votes, Giveaway tickets, rankings, prize-claim activity, cases opened, transaction history, win/loss records, session duration, clicks, scroll behaviour, referral source, and timestamps.
Cookies and similar technologies: see Section 11.
Security and fraud signals: login attempts, authentication events, device reputation signals, behavioural anomalies.

Information we receive from third parties

Steam: your Steam ID, Steam level, publicly visible profile information, Steam Workshop URLs and content, information about authorship or co-authorship of submitted Works, and information needed for Contest eligibility, voting, inventory, trade, or prize-delivery functionality.
Identity-verification provider: verification results, biometric liveness outcomes, sanctions/PEP screening results and related risk flags.
Where you access the Skin Creators Contest through the Community Portal or proceed to Skin.Club in connection with a Giveaway, deposit, or prize claim, we may link and use your account, Steam authentication, Contest participation, and related activity data across these services for authentication, eligibility verification, fraud prevention, Giveaway administration, prize administration, and compliance with applicable rules.
Fraud and device-intelligence providers: device reputation, bot-detection scores, anomaly signals.
Payment service providers: transaction authorisation results, fraud scores, chargeback data.
Advertising and analytics providers: attribution signals, advertising identifiers, conversion data.
Publicly available sources: sanctions lists, PEP lists, adverse-media databases (for AML screening).

4. How and why we use your personal data

The table below sets out each purpose, the data involved, the legal basis, and how long we keep the data. Where we rely on legitimate interests we have carried out a balancing test, and you have the right to object (Section 10).

Purpose	Data categories	Legal basis (EU GDPR)	Retention
Operating the Skin Creators Contest, including verifying eligibility, receiving and moderating Submissions, displaying Works, administering voting, Stage Giveaways and the Huge Giveaway, calculating rankings, contacting winners, and administering prizes	Steam ID, Steam profile information, Workshop URLs, Submission content and metadata, creator/co-creator status, moderation records, voting activity, Giveaway tickets, rankings, prize-claim information and communications	Article 6(1)(b) — performance of a contract; Article 6(1)(f) — legitimate interests in operating, securing, and protecting the integrity of the Contest	For the duration of the Contest and up to 12 months after its completion, unless a longer period is required for legal claims, fraud prevention, prize administration, or compliance obligations

Public Contest information. To operate and promote the Skin Creators Contest, we may publicly display your submitted Work, its title, images, description, Steam Workshop URL, creator display name, publicly available Steam profile information, moderation status, voting results, ranking, Finalist status, and winner status on the Community Portal, Skin.Club channels, and in Contest-related promotional materials. Where you are a Finalist, we may also use these materials for promotional purposes for up to one (1) year, as described in the Skin Creators Contest Official Rules.

5. Special categories of personal data (biometrics)

Biometric data — a short liveness-check image or video captured to confirm that the person presenting an identity document is a real, present human — is a special category of personal data under Article 9 GDPR. We only process biometric data where you initiate our identity-verification process, which is required to register on and use the Platform.

The biometric data is captured and processed by our identity-verification provider, SumSub, acting as our processor. It is used solely to assess whether the person on camera matches the photograph on the submitted identity document and is alive at the time of capture. We do not receive or retain the biometric template; we receive your identity document and the verification result (including confirmation that the face matched the document).

Legal basis. We rely on your explicit consent under Article 9(2)(a) GDPR, which you provide before the liveness check begins. We do not use biometric data for any purpose other than identity and age verification, and we do not sell or share it with advertisers, data brokers or other third parties.

6. Automated decision-making and profiling

We use automated systems to support decisions about your account, including detecting fraud, bot activity, multi-accounting and chargeback abuse; risk scoring that determines verification level, transaction limits or manual review; and profiling for marketing, where you have consented.

How decisions are made. Our systems apply pre-defined rules, statistical models and third-party risk signals to account, device, behavioural and transactional data. The models score and flag accounts, but decisions that have a legal or similarly significant effect on you are made or reviewed by a member of our compliance or trust-and-safety team. We do not take such decisions based solely on automated processing.

Your rights. Even though a person is involved in significant decisions, you can always ask us to review a decision about your account. You have the right to obtain human review, to express your point of view, and to contest the decision. Contact privacy@skin.club describing the decision; we will route your request to a reviewer who was not involved in the original decision.

7. Who we share your personal data with

We share your personal data with the following categories of recipient. In most cases these recipients act as our processors and handle your data only on our documented instructions, under a written data processing agreement.

Category of recipient	Examples / role	Why we share
Hosting and cloud infrastructure	AWS; content delivery network (Cloudflare); database and storage services	To run the Platform
Identity verification	SumSub	To verify your age and identity, screen for sanctions/PEP, and assess fraud risk
Payment processing	Card acquirers and payment service providers	To process your deposits and detect payment fraud
Fraud and device intelligence	FingerprintJS and similar vendors	To detect bots, multi-accounting and abuse
Customer support tooling	Zendesk and similar platforms	To respond to your enquiries
Analytics	Google Analytics; Amplitude; Microsoft Clarity	To understand how the Platform is used and improve it
Email and notifications	Mailgun; Customer.io; OneSignal; Novu	Account notifications and, where you have consented, marketing
Advertising partners	Meta, Google Ads, TikTok, Twitter/X, Amazon advertising	To show you relevant advertising on third-party platforms, where you have consented
Professional advisers	Lawyers, accountants, auditors	Where necessary to run the business or defend legal claims
Authorities and regulators	Law enforcement, tax authorities, data-protection and other regulators	Where required by law or to protect our rights and the safety of others
Corporate transactions	Prospective acquirers, investors and their advisers	In a merger, acquisition, reorganisation or financing, subject to confidentiality and data-protection safeguards

We do not sell your personal data. We do not share your personal data with third parties for their own independent marketing purposes, except where you have consented.

8. International data transfers

Some recipients in Section 7 are based, or process data, outside the European Economic Area (EEA), including in the United States. When we transfer personal data outside the EEA, we ensure one of the following safeguards is in place:

An adequacy decision of the European Commission covering the destination, including the EU-US Data Privacy Framework where the recipient is certified under it;
The European Commission’s Standard Contractual Clauses (SCCs), together with any additional measures required; or
Another safeguard recognised under applicable law, including binding corporate rules. Where a US recipient is not certified under the EU-US Data Privacy Framework, we rely on the SCCs. You can request a copy of the relevant safeguards by writing to privacy@skin.club.

9. How long we keep your personal data

We keep your personal data only for as long as necessary for the purposes for which it was collected, including to comply with legal, regulatory, tax, accounting or reporting obligations and to defend legal claims. The specific period for each purpose is in the Section 4 table. In summary:

Active account data: duration of your account plus 5 years after closure.
KYC, AML and transaction records: 5 years after the end of the customer relationship.
Fraud and security records: 12 months (longer where needed to defend a claim).
Marketing: until you withdraw consent, plus a 3-year suppression record for evidential purposes.
Legal-claims records: the applicable limitation period (ordinarily 6 years in Cyprus for contractual claims).
Contest records, including Submissions, moderation records, votes, Giveaway tickets, rankings, and prize-claim records: for the duration of the Contest and up to 12 months after its completion, unless a longer period is required for legal claims, fraud prevention, prize administration, or compliance obligations. When we no longer need your personal data, we delete or anonymise it.

10. Your rights

Subject to applicable law, you have the following rights in relation to your personal data.

Right	What it means
Right of access	Obtain a copy of the personal data we hold about you and information about how we process it.
Right to rectification	Ask us to correct inaccurate or incomplete personal data.
Right to erasure (“right to be forgotten”)	Ask us to delete your personal data in certain circumstances. This is not absolute: we may need to keep certain data to meet legal obligations (including AML record-keeping) or defend legal claims.
Right to restriction of processing	Ask us to temporarily stop processing your personal data, e.g. while we look into a rectification or objection request.
Right to object	Object to processing based on legitimate interests, or to direct marketing. Where you object to direct marketing, we will stop.
Right to data portability	Receive the personal data you provided to us in a structured, commonly used, machine-readable format, where processing is based on consent or contract and carried out by automated means.
Rights relating to automated decision-making	See Section 6.
Right to withdraw consent	Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
Right to lodge a complaint	Lodge a complaint with your supervisory authority. See Section 16.

How to exercise your rights. Write to privacy@skin.club, or use the in-platform data request form or the support chat in your account. You can request erasure by any of these channels. We may ask you to verify your identity before we respond; because erasure is permanent, we take additional steps to confirm your identity before carrying it out.

Response time. We respond within one month, which we may extend by up to two further months for complex or numerous requests, telling you within the first month.

No charge. Exercising your rights is free. If a request is manifestly unfounded or excessive we may charge a reasonable fee or refuse it, with a clear explanation.

11. Cookies and similar technologies

We use cookies, pixels, local storage and similar technologies to run the Platform, remember your preferences, understand how the Platform is used, and (with your consent) show you relevant advertising. Non-essential cookies are only set after you consent through our cookie banner. You can change your preferences at any time through the “Cookie settings” link in the Platform footer. Full details are in our Cookie Policy at https://skin.club/en/cookie-policy.

12. Children

The Platform is for adults only. You must be at least 18 to register and use it. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we will close the account

and delete the data without undue delay, subject to legal-retention obligations. If you believe we have collected data from a minor, contact privacy@skin.club immediately.

13. How we protect your personal data

We use technical and organisational measures to protect your personal data against unauthorised access, loss, alteration or disclosure, including:

Encryption of data in transit (TLS) and, for sensitive data, at rest.
Role-based access controls and least privilege.
Multi-factor authentication for staff access to systems processing personal data.
Vulnerability management, including periodic penetration testing.
Security monitoring, logging and alerting.
Confidentiality and data-protection commitments from staff and service providers.
Security-awareness training for staff who handle personal data.
An incident-response plan for personal-data breaches. No system is completely secure. While we take security seriously, we cannot guarantee that personal data will never be accessed, disclosed or altered without authorisation. If you believe your account has been compromised, contact us immediately.

14. Changes to this policy

We may update this policy from time to time to reflect changes in our processing, in applicable law, or in our business. For material changes we will notify you in the Platform and, where appropriate, by email before they take effect. The date at the top shows when it was last updated.

15. Country-specific information

Our lead supervisory authority in the EEA is the Cyprus Commissioner for Personal Data Protection. You may also lodge a complaint with the supervisory authority of the EU member state where you live, work, or where the alleged infringement took place. Where other privacy laws apply to our processing, we will honour rights granted to you under those laws; contact privacy@skin.club for more information.

16. Contact and complaints

If you have any questions, concerns or complaints about how we handle your personal data, please contact us first so we can address them:

Email: privacy@skin.club
Post: Moontain Limited, FAO Data Protection Officer, 13 Kypranoros Street, Office 205, 1061

Nicosia, Cyprus

You also have the right to lodge a complaint with a supervisory authority. Details of the Cyprus Commissioner for Personal Data Protection are at https://www.dataprotection.gov.cy.