Privacy Policy
How SPROXT FIELD LTD collects, uses and protects personal data under EU GDPR, UK GDPR and CCPA.
Operator: SPROXT FIELD LTD, company number HE 486059, Vasileos Georgiou 13, Stala Court, Flat/Office 3, Germasogeia 4040, Limassol, Cyprus.
1. Controller
The data controller is SPROXT FIELD LTD, Vasileos Georgiou 13, Stala Court, Flat/Office 3, Germasogeia 4040, Limassol, Cyprus. Privacy requests: [email protected].
2. Data we collect
| Category | Examples | Purpose / legal basis |
|---|---|---|
| Order data | Email address, name and billing address (from the payment page), items, prices, order number, timestamps | Perform the contract; legal obligation (tax and accounting records) |
| Payment data | Payment reference, card scheme, last four digits, authorisation result, decline reason, country of the card | Perform the contract; fraud prevention (legitimate interest) |
| Cardholder data | Not collected. Full card numbers, expiry dates and security codes are entered only on Stripe's PCI DSS certified page and never stored by us. | — |
| Account access | Email address, sign-in link timestamps, session cookie | Provide order history and receipts (contract) |
| Support data | Messages, attachments, order references | Answer your request (contract / legitimate interest) |
| Technical data | IP address, device and browser details, pages visited, errors; analytics only with consent | Security and service integrity (legitimate interest); analytics (consent) |
3. Who we share data with and why
- Stripe (payment processing, fraud screening, 3-D Secure) — receives your card and billing details directly.
- Waxpeer and the seller of your item (fulfilment) — receive your Steam trade URL so the item can be sent to you.
- Steam (Valve) — handles sign-in through Steam and carries the trade offer.
- Email delivery provider — sends receipts, sign-in links and support replies.
- Hosting and database providers — store order records under contract.
- Professional advisers and authorities — where required by law, for tax records or to respond to a lawful request or chargeback.
We never sell personal data. Customer card data is not sold, shared or disclosed to third parties by Oasis Skins.
4. How we protect data
TLS encryption on every page, encrypted storage, access limited to staff with a role-based permission, audit logs of administrative actions, and a payment integration in which card data never touches our systems.
5. Retention
Order and receipt records are kept for at least 120 days for your access and for 6 years for tax and accounting law. Support messages are kept for 2 years. Technical logs are kept for up to 12 months.
6. Your rights
You can access, correct, delete, restrict or port your personal data and object to processing based on legitimate interests. To exercise a right, email [email protected] or use the contact form (topic: Privacy request). We answer within one month. You may complain to the Cyprus Commissioner for Personal Data Protection (dataprotection.gov.cy) or your local supervisory authority. California residents have the rights to know, delete, correct and opt out of sale/sharing; we do not sell or share personal information.
7. International transfers
Our providers may process data outside the UK/EEA (for example Stripe in the United States) under adequacy decisions or standard contractual clauses.
8. Cookies
See the Cookie Policy. Optional cookies are only set after you accept them in the cookie banner, which you can reopen from the footer.
