1. Who this is for
This agreement is for businesses that accept skins payments with SkinsFlow. When your customers pay you through a SkinsFlow checkout, we handle their data on your behalf: you are the controller and we are your processor.
Some processing is our own responsibility, such as verifying businesses, preventing fraud and money laundering, and keeping accounting records. Our Privacy Policy covers those.
2. How it is agreed
This agreement is part of our Terms of Service. When you accept the Terms for your business, you also conclude this agreement. No signature is needed, and it applies for as long as you use SkinsFlow.
3. What we process for you
- Purpose: running your checkouts, crediting payments to your balance, telling your shop about each payment, sending skins you buy to your customers, and support.
- People: your customers who pay through a checkout, and the members of your team.
- Data: Steam ID, trade link, public Steam name and avatar, the items and values of a payment, order references and details you send us, IP address and browser of checkout visitors, and your team members' names and email addresses.
- Duration: for as long as you use SkinsFlow, and afterwards only as described under "When you leave".
We do not process special categories of personal data for you, and we never use your customers' data for our own marketing.
4. Our commitments
- We process personal data only on your instructions: the Terms, your settings in the dashboard and the requests your shop sends us. If an instruction seems unlawful to us, we tell you.
- Everyone at SkinsFlow who can see personal data is bound to confidentiality.
- We protect the data with the measures in the annex below and keep them up to date.
- We help you answer your customers when they use their privacy rights, and with impact assessments where you need our input.
- We give you the information you need to show that this agreement is kept, and we support reasonable audits after a written request.
5. Sub-processors
You allow us to use the providers on our sub-processor list. We tell business customers about changes in advance, and you may object for well-founded data protection reasons. Every sub-processor must protect the data at least as well as this agreement requires.
6. International transfers
Some providers are based outside the European Economic Area. Where the law requires it, we rely on an adequacy decision or on the European Commission's standard contractual clauses.
7. If something goes wrong
If a security incident affects personal data we process for you, we tell you without undue delay and no later than 48 hours after we become aware of it, with what we know, what we are doing about it and who you can talk to. We keep you updated as we learn more.
8. When you leave
When your account closes, we delete your customers' personal data within 30 days or return it to you on request. Records the law requires us to keep, such as payment and anti-money-laundering records, are kept for the required period, protected, and used for nothing else.
9. Annex: security measures
- Encryption in transit: every page and every connection uses HTTPS.
- Encryption at rest for sensitive details such as payout details and connection secrets.
- Passwords and API keys stored only in a form that cannot be read back.
- Two-factor sign-in required for staff and for every payout request.
- Access by role: staff see only what their work needs, and access to verification documents is logged.
- Protection against bots, password guessing and abuse on our forms and connections.
- Test data kept apart from real payments and balances.
- A record of every balance change and of important account actions.
10. A signed copy
Need a copy signed by both sides for your records? Tell us your company name and address and we will send one over.
Questions about this document? Write to [email protected].
Other policies: Terms of Service · Privacy Policy · Cookie Policy · AML & KYC Policy · Acceptable Use Policy · Sub-processors · Company details