Privacy Policy
Last updated: 26-10-2026
This Privacy Policy explains how Skillway Limited collects, uses, shares and protects personal data when you use the website https://skinchanger.me (the "Service"), a marketplace for Counter-Strike 2 and Dota 2 in-game items ("skins"). It applies to everyone who visits the website or signs in to it.
This Privacy Policy explains how Skillway Limited collects, uses, shares and protects personal data when you use the website https://skinchanger.me (the "Service"), a marketplace for Counter-Strike 2 and Dota 2 in-game items ("skins"). It applies to everyone who visits the website or signs in to it.
1. Who we are
The controller of your personal data is:
Skillway Limited, a company incorporated in the Republic of Cyprus
Registration number: HE494151
Registered address: Lapathou, 6, Strovolos, 2027, Nicosia, Cyprus
Email: support@skinchanger.me
Data protection contact / Data Protection Officer: dpo@skinchanger.me
In this policy "we", "us" and "our" mean Skillway Limited. "You" means the person using the Service.
2. Summary
3. The personal data we collect
3.1 Data we receive from Steam when you sign in
Sign-in works through Steam OpenID. When you sign in, Steam confirms your identity to us and we receive and store:
3.2 Data you give us
When you start a deposit, the payment processor requires a payer name, phone number and email address. We do not ask you for these. Instead we generate placeholder values derived from your account (your Steam nickname, your internal customer number and your Steam ID) and send them, together with your IP address, the amount and the currency. On the payment page you then enter your card details directly with the processor; they are not passed to us.
3.5 Data we do not collect
We do not ask for your real name, postal address, phone number or email address in the normal use of the Service, and we do not process special categories of personal data (such as health data). See section 3.6 for identity checks.
3.6 Identity and anti-fraud checks
Where required by law or where we have reasonable grounds to suspect fraud, money laundering or misuse, we may ask you for additional information or documents (for example proof of identity or of the source of funds) before processing a transaction or withdrawal.
4. Why we use your data and our legal bases
The controller of your personal data is:
Skillway Limited, a company incorporated in the Republic of Cyprus
Registration number: HE494151
Registered address: Lapathou, 6, Strovolos, 2027, Nicosia, Cyprus
Email: support@skinchanger.me
Data protection contact / Data Protection Officer: dpo@skinchanger.me
In this policy "we", "us" and "our" mean Skillway Limited. "You" means the person using the Service.
2. Summary
- You sign in only with your Steam account. We never see your Steam password.
- We keep the data needed to run your account, your balances and your trades, to prevent fraud and to meet our legal obligations.
- Card payments are handled by our payment processor. We do not receive or store your full card number.
- We share data only with the providers that make the Service work (Steam, the marketplaces and payment providers we use, hosting, security and analytics) and with authorities where the law requires it.
- You have rights over your data under the GDPR, including access, correction, erasure and objection, and you can complain to the Cyprus Commissioner for Personal Data Protection.
3. The personal data we collect
3.1 Data we receive from Steam when you sign in
Sign-in works through Steam OpenID. When you sign in, Steam confirms your identity to us and we receive and store:
- your Steam ID (SteamID64);
- your Steam nickname (persona name);
- the URL of your Steam avatar;
- the URL of your Steam profile.
3.2 Data you give us
- Date of birth. We ask for it right after your first sign-in to confirm that you are 18 or older. If you are under 18, we sign you out and do not store the date you entered.
- Steam trade URL. Needed to send and receive Steam trade offers. We check it with our marketplace partner before saving it.
- Preferred currency (USD or EUR) for displaying prices and balances.
- Payout details when you request a withdrawal (for example a card number or a wallet address, depending on the payout method). We store them encrypted and show only a masked version in your account.
- Messages and complaints you send us, including any information you choose to include.
- Deposits: amount, currency, payment method chosen, status, payment reference from the processor, timestamps, and the IP address from which you started the payment.
- Purchases (orders): items bought, prices, the seller-side marketplace references, trade offer status, and refunds of failed or declined purchases.
- Sales: items you sold to us, the price quote, the Steam trade offer and its status, the trade protection (hold) period and settlement or cancellation.
- Withdrawals: amount, currency, conversion rate, fee, payout method, masked payout destination, status, and a history of status changes (including who changed the status).
- Balance ledger: every change of your purchase balance and sales balance, with the reason and a reference to the deposit, order, sale or withdrawal it relates to.
- Provider request journal: a technical record of the requests our systems send to third-party providers (Steam, Waxpeer, Pay2Pro, Skinport) about your orders, payments, sales and trades, and the responses received. Secrets such as API keys are masked before they are written. This journal may contain your Steam ID, trade URL, item data and payment references.
- Technical data: IP address, browser and device information, session cookies, and server logs.
When you start a deposit, the payment processor requires a payer name, phone number and email address. We do not ask you for these. Instead we generate placeholder values derived from your account (your Steam nickname, your internal customer number and your Steam ID) and send them, together with your IP address, the amount and the currency. On the payment page you then enter your card details directly with the processor; they are not passed to us.
3.5 Data we do not collect
We do not ask for your real name, postal address, phone number or email address in the normal use of the Service, and we do not process special categories of personal data (such as health data). See section 3.6 for identity checks.
3.6 Identity and anti-fraud checks
Where required by law or where we have reasonable grounds to suspect fraud, money laundering or misuse, we may ask you for additional information or documents (for example proof of identity or of the source of funds) before processing a transaction or withdrawal.
4. Why we use your data and our legal bases
Where we rely on legitimate interests, we have balanced them against your rights. You can ask us for details and you can object (see section 8).
We do not make decisions that produce legal effects about you based solely on automated processing. Automated checks (for example balance checks, quote expiry, trade status checks) only apply the rules of the Service; if a transaction is blocked for suspected fraud, a member of our staff reviews it.
5. Who we share your data with
We share personal data only where needed for the purposes above:
We do not make decisions that produce legal effects about you based solely on automated processing. Automated checks (for example balance checks, quote expiry, trade status checks) only apply the rules of the Service; if a transaction is blocked for suspected fraud, a member of our staff reviews it.
5. Who we share your data with
We share personal data only where needed for the purposes above:
We do not sell your personal data.
6. International transfers
Some recipients are located outside the European Economic Area (EEA), in particular Valve (USA), Cloudflare (USA) and Google (USA). When we transfer data outside the EEA we rely on:
7. How long we keep your data
6. International transfers
Some recipients are located outside the European Economic Area (EEA), in particular Valve (USA), Cloudflare (USA) and Google (USA). When we transfer data outside the EEA we rely on:
- an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for recipients certified under it); or
- Standard Contractual Clauses approved by the European Commission, with additional safeguards where needed; or
- where none of these is available, a derogation under Article 49 GDPR, for example where the transfer is necessary to perform our contract with you (such as sending a trade offer through Steam).
7. How long we keep your data
We may keep data longer where needed to establish, exercise or defend legal claims or where the law requires it. When data is no longer needed, we delete or anonymise it.
8. Your rights
Under the GDPR you have the right to:
Some data cannot be erased immediately: transaction and ledger records that we must keep for accounting, tax or anti-money-laundering reasons are kept for the required period and then deleted.
Right to complain
You can complain to the supervisory authority in Cyprus:
Office of the Commissioner for Personal Data ProtectionIasonos 1, 1082 Nicosia, Cyprus (postal: P.O. Box 23378, 1682 Nicosia)
Website: www.dataprotection.gov.cyEmail: commissionerdataprotection@dataprotection.gov.cy
You can also complain to the supervisory authority in the EU country where you live or work. We would appreciate the chance to deal with your concern first, so please contact us.
9. Cookies and similar technologies
We use:
10. Security
We protect personal data with measures appropriate to the risk, including encrypted connections (HTTPS), encryption of payout details and of credentials we hold, masking of secrets in technical logs, access controls for staff, and separate administrator accounts. No system is completely secure; if a personal data breach is likely to result in a high risk to you, we will inform you without undue delay.
11. Children
The Service is only for people aged 18 or over. We ask for your date of birth after your first sign-in. If you are under 18 we sign you out and do not store the date you entered. If you believe a minor is using the Service, contact us and we will close the account.
12. Third-party websites
The Service links to Steam, payment pages and other third-party sites. Their own privacy policies apply when you use them. In particular, your Steam account is governed by Valve's Privacy Policy, and card payments by the payment processor's privacy policy.
13. Changes to this policy
We may update this policy. We will publish the new version on this page with a new "Last updated" date and, for significant changes, notify you on the website.
14. Contact
Skillway Limited, HE494151
Lapathou, 6, Strovolos, 2027, Nicosia, Cyprus
Email: support@skinchanger.me
Data protection contact: dpo@skinchanger.me
8. Your rights
Under the GDPR you have the right to:
- access your personal data and receive a copy;
- rectify inaccurate data;
- erase your data ("right to be forgotten"), where there is no legal reason for us to keep it;
- restrict processing in certain cases;
- data portability: receive data you gave us in a structured, machine-readable format, or have it sent to another controller;
- object to processing based on our legitimate interests;
- withdraw consent at any time, where processing is based on consent (for example analytics cookies), without affecting earlier processing.
Some data cannot be erased immediately: transaction and ledger records that we must keep for accounting, tax or anti-money-laundering reasons are kept for the required period and then deleted.
Right to complain
You can complain to the supervisory authority in Cyprus:
Office of the Commissioner for Personal Data ProtectionIasonos 1, 1082 Nicosia, Cyprus (postal: P.O. Box 23378, 1682 Nicosia)
Website: www.dataprotection.gov.cyEmail: commissionerdataprotection@dataprotection.gov.cy
You can also complain to the supervisory authority in the EU country where you live or work. We would appreciate the chance to deal with your concern first, so please contact us.
9. Cookies and similar technologies
We use:
- Strictly necessary cookies: a session cookie that keeps you signed in and remembers your selections (for example your game, cart and sale selection), and a security (CSRF) cookie. These are required for the Service and do not need consent.
- Analytics and measurement cookies: set through Google Tag Manager, which may load Google Analytics or other tags. We use these only with your consent, which you can give or withdraw at any time through.
10. Security
We protect personal data with measures appropriate to the risk, including encrypted connections (HTTPS), encryption of payout details and of credentials we hold, masking of secrets in technical logs, access controls for staff, and separate administrator accounts. No system is completely secure; if a personal data breach is likely to result in a high risk to you, we will inform you without undue delay.
11. Children
The Service is only for people aged 18 or over. We ask for your date of birth after your first sign-in. If you are under 18 we sign you out and do not store the date you entered. If you believe a minor is using the Service, contact us and we will close the account.
12. Third-party websites
The Service links to Steam, payment pages and other third-party sites. Their own privacy policies apply when you use them. In particular, your Steam account is governed by Valve's Privacy Policy, and card payments by the payment processor's privacy policy.
13. Changes to this policy
We may update this policy. We will publish the new version on this page with a new "Last updated" date and, for significant changes, notify you on the website.
14. Contact
Skillway Limited, HE494151
Lapathou, 6, Strovolos, 2027, Nicosia, Cyprus
Email: support@skinchanger.me
Data protection contact: dpo@skinchanger.me