Privacy Policy

2.1 Account and contact data

We may process your email address, internal account identifier, account status, authentication records, registration date, settings and communications preferences.

2.2 Steam data

When you use Steam Login or connect a Steam account, we may process your Steam ID, profile name, avatar, profile URL, Trade URL, public inventory information, trade eligibility, trade offer identifiers and other information made available through Steam according to your Steam settings and the functionality you use.

2.3 Order and transaction data

We process order numbers, purchased Items and their characteristics, prices, selected currency, applicable tax information, invoices, timestamps, payment status, delivery status, Steam trade records, refunds, cancellations, disputes and fraud-prevention signals.

2.4 Payment data

Payment card information is processed through an authorised third-party payment service provider. Floatline may receive limited transaction information such as payer details, billing country, masked card information, card type, payment reference, authentication result, payment status and fraud or risk indicators. Do not send full card numbers or card security codes to us by email.

2.5 Technical and usage data

We may process IP address, approximate location derived from IP, browser and device information, operating system, language, referring page, access times, pages and features used, cookie identifiers, session records, error logs and security events.

2.6 Support and compliance data

If you contact us or if verification is reasonably required, we may process the content of your request, correspondence, attachments and information needed to verify account ownership, payment authorisation, age, location or transaction legitimacy.

We obtain personal data directly from you, from your use of the Service, from Steam when you use Steam Login or delivery functions, from payment and fraud-prevention providers, from fulfilment providers involved in an order, and from public or lawful compliance sources where necessary.

We process personal data for the following purposes and legal bases:

• Account creation, authentication, order acceptance, invoicing, payment administration and delivery: performance of a contract or steps requested before entering a contract.
• Customer support, complaints, refunds and dispute handling: performance of a contract, compliance with legal obligations and legitimate interests in resolving claims.
• Fraud prevention, account security, service integrity and abuse detection: legitimate interests and, where applicable, compliance with legal obligations.
• Accounting, taxation, sanctions screening and responses to authorities: compliance with legal obligations.
• Service measurement, troubleshooting and improvement: legitimate interests; consent where non-essential cookies or similar technologies require it.
• Marketing messages: consent where consent is required. You may unsubscribe at any time without affecting service messages.
• Establishing, exercising or defending legal claims: legitimate interests and applicable legal obligations.

Where we rely on legitimate interests, we consider the necessity and proportionality of processing and the impact on your rights.

Steam Login is used to authenticate or connect your Steam account and support delivery. Steam independently processes information under its own privacy terms. Floatline does not receive your Steam password through the Steam Login process.

We may disclose personal data only as reasonably necessary to:

• payment processing, card authentication and fraud-prevention providers;
• confidential inventory and fulfilment providers that arrange or complete delivery;
• hosting, cloud, email, security, logging and customer-support providers;
• analytics or advertising providers where enabled and lawfully consented to;
• professional advisers, auditors, insurers and accounting providers;
• banks, card networks and dispute-resolution participants;
• courts, regulators, law-enforcement bodies or other authorities where disclosure is legally required; and
• a buyer, successor or adviser in connection with a merger, restructuring or business transfer, subject to appropriate safeguards.

We do not sell personal data for monetary consideration.

Some recipients may process data outside Estonia or the European Economic Area. Where required, we use a lawful transfer mechanism such as an adequacy decision, standard contractual clauses or another safeguard recognised under applicable data protection law. Information about relevant safeguards may be requested at info@csfloatline.com.

We retain personal data only for as long as necessary for the stated purpose, legal compliance, security and dispute resolution. In general:

• account data is retained while the account is active and normally for up to three years after closure, unless a longer period is justified;
• order, invoice, accounting and transaction records are retained for seven years from the end of the relevant financial year where required by Estonian accounting or tax law;
• support and complaint records are normally retained for three years after closure of the matter;
• ordinary technical and usage logs are normally retained for up to twelve months; and
• security, fraud and dispute records may be retained for longer where necessary to investigate abuse, enforce rights or comply with law.

Data may be anonymised and retained in a form that no longer identifies you.

Automated tools may help identify payment, location, security or fraud risks. We do not make a solely automated decision producing legal or similarly significant effects unless permitted by law and accompanied by required safeguards. You may contact us to request human review where applicable.

Subject to applicable conditions and exceptions, you may request:

• access to personal data and information about its processing;
• correction of inaccurate or incomplete data;
• deletion of data;
• restriction of processing;
• data portability;
• objection to processing based on legitimate interests or direct marketing; and
• withdrawal of consent at any time, without affecting prior lawful processing.

We may need to verify your identity before acting on a request. We normally respond within one month, subject to extensions permitted by law.

Please contact info@csfloatline.com first so we can address your concern. You also have the right to complain to the Estonian Data Protection Inspectorate at https://www.aki.ee/en or to the competent supervisory authority in your country of residence.

We use appropriate organisational and technical measures designed to protect personal data against unauthorised access, alteration, disclosure, loss or destruction. No online system is completely risk-free, and you must protect your own email and Steam credentials.

The Service is intended only for persons aged 18 or older. We do not knowingly provide the Service to children. If you believe a person under 18 has supplied personal data, contact us.

We may update this Policy when our processing, providers, Service or legal obligations change. The current version will be published with its effective date. Material changes will be communicated where required.