Privacy Notice

1.1 The controller of your personal data is ZORORYXA CO LIMITED, a private company limited by shares incorporated in England and Wales on 7 October 2026 under company number 17504711, with its registered office at 50-54 St Paul's Square, Birmingham, United Kingdom, B3 1QS ("we", "us"). We operate CS Market at https://cs-market.co.

1.2 For any question about this notice or your personal data, contact us at [email protected]. We have not appointed a Data Protection Officer because we are not required to do so under Article 37 of the UK GDPR.

• Steam data: Steam ID, profile name and avatar, Trade URL and the public inventory data needed to price, deliver and verify Items. We sign you in through Steam OpenID and never receive your Steam password.
• Contact data: your e-mail address if you give it to us (for example, for support, notifications or the newsletter).
• Transaction data: Orders, quotes, Market listings and sales, Balance entries, holding periods, payout requests, refunds, reversals and chargebacks.
• Payment data: card type, masked card number, payment and payout references and status. Full card details are entered on the hosted payment page of our payment service provider and are not received or stored by us.
• Verification data: where verification is required, your name, date of birth, identity document, selfie and verification result.
• Technical data: IP address, device and browser information, session identifiers, log data and fraud-prevention signals.
• Communications: messages you send to support and records of disputes and complaints.

• To provide the Website (sign-in, Orders, delivery, Instant Sell, the Market, Balance and payouts): performance of a contract (Article 6(1)(b) UK GDPR).
• To verify identity, prevent fraud and comply with anti-money-laundering, sanctions, tax and accounting obligations: legal obligation (Article 6(1)(c)) and our legitimate interest in preventing fraud and misuse (Article 6(1)(f)). Biometric comparison of a selfie with an identity document is carried out only with your explicit consent or where otherwise permitted by law.
• To secure the Website, handle disputes and chargebacks, and improve our services: legitimate interests (Article 6(1)(f)).
• To send newsletters and use non-essential cookies: consent (Article 6(1)(a)), which you may withdraw at any time.

3.1 We use automated checks (for example, verification of Item receipt and fraud signals) to operate the Website. Decisions that significantly affect you, such as declining a payout, are reviewed by a member of staff.

• our payment service provider and card schemes, to process payments, refunds and payouts and to prevent fraud;
• identity-verification and fraud-prevention providers, where verification is required;
• Valve Corporation (Steam), to the extent necessary to send, receive and verify trades;
• hosting, cloud, e-mail, analytics and customer-support providers acting on our instructions as processors;
• professional advisers, auditors and insurers under a duty of confidentiality;
• law-enforcement authorities, courts, regulators and other competent authorities where required by law;
• a purchaser or successor of our business, subject to equivalent protection of your data.

4.1 We do not sell your personal data.

5.1 Some of our providers, including Valve Corporation, process data outside the United Kingdom. Where we transfer personal data outside the United Kingdom, we rely on UK adequacy regulations, the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism. You may ask us for more information.

• account, transaction, Balance and payout records: for the life of your account and 6 years after closure, for accounting, tax and legal-claims purposes;
• identity documents and selfies: deleted once verification is completed, while we keep a record of the verification result, the verified name and the document type and number for as long as needed to meet our legal obligations and defend legal claims;
• dispute and chargeback evidence: for at least 18 months after the transaction, or longer if a claim is ongoing;
• server and security logs: usually 90 days, unless needed to investigate an incident;
• newsletter data: until you unsubscribe.

7.1 We use appropriate technical and organisational measures, including encryption in transit, access controls based on job role, logging and regular review of access. If a personal data breach is likely to result in a risk to you, we will notify the Information Commissioner's Office and, where required, you.

8.1 You have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, to data portability and to withdraw consent at any time. These rights are subject to conditions and exemptions in law. To exercise them, contact [email protected]. We reply within one month, which may be extended by two further months for complex requests.

8.2 You may complain to the Information Commissioner's Office (ico.org.uk) or to the data-protection authority in your country. We would appreciate the chance to deal with your concern first.

9.1 The Website is intended only for persons aged 18 or over. We do not knowingly collect data about children and delete it if we learn that we have done so.

10.1 We use cookies as described in the Cookie Policy. We may update this notice and will show the date of the latest version at the top. Material changes will be notified on the Website or by e-mail.

10.2 Registered details: ZORORYXA CO LIMITED, company number 17504711, registered office: 50-54 St Paul's Square, Birmingham, United Kingdom, B3 1QS. Contact: [email protected].