Privacy Policy

This explains what GTAMarket does with information about you, why, on what legal basis, how long we keep it, and what you can make us do about it.

---

1. Who is responsible

The controller of your personal data is:

• [TO BE COMPLETED: registered company name], registration number [TO BE COMPLETED: company registration number]
• [TO BE COMPLETED: registered office address], [TO BE COMPLETED: country of incorporation]
• privacy@gtamarket.store

Data Protection Officer: [TO BE COMPLETED: Data Protection Officer] — privacy@gtamarket.store

Representative in the European Union (GDPR Article 27): [TO BE COMPLETED: GDPR Art. 27 representative, or 'Not required — established in the EEA'], [TO BE COMPLETED: EU_REPRESENTATIVE_ADDRESS]

Representative in the United Kingdom (UK GDPR Article 27): [TO BE COMPLETED: UK GDPR Art. 27 representative, or 'Not required — established in the UK'], [TO BE COMPLETED: UK_REPRESENTATIVE_ADDRESS]

2. What we collect

You give us:

• Email address, username, password (stored only as a hash we cannot reverse)
• Date of birth
• Your trader-or-private declaration and, if you are a trader, the identification, registration and contact details listed in Section 3.5 of the Terms of Service
• Payout addresses and the network they belong to
• Listing text and images, messages, dispute evidence, reviews, support tickets
• Identity documents and a photograph of you holding one, where a verification check is triggered
• Your language and notification preferences

We collect as you use the service:

• IP address, with a timestamp
• Device and browser characteristics, and a device identifier used to detect duplicate accounts and account takeover
• Pages viewed, searches run, listings opened, orders placed
• Login times, session records, two-factor events
• Timestamps and outcomes of every ledger entry against your balance

We get from others:

• Deposit and withdrawal confirmations from [TO BE COMPLETED: licensed payment processor of record]
• Blockchain address risk scores from our screening provider
• Sanctions, politically-exposed-person and adverse-media matches from our screening provider
• The outcome of an identity check from our verification provider. We receive the outcome and the extracted data fields. We do not receive or store biometric templates.
• Public blockchain data about addresses you deposit from or withdraw to

We do not collect payment card numbers, bank details, or your game account credentials. Nobody here needs your game password. Anyone who asks for it is not us.

3. Why we use it, and on what legal basis

What for	Legal basis	Notes
Creating your account, logging you in, keeping the session	Contract (Art. 6(1)(b))
Publishing listings, matching orders, running escrow, confirming delivery, paying out	Contract for your own order	For data about the person on the other side of your order, our basis is legitimate interests — running a marketplace where the two sides can identify each other
Deciding disputes	Legitimate interests (Art. 6(1)(f))	Interest: a marketplace where an order can be resolved. Assessed and documented.
Fraud prevention — duplicate-account detection, device signals, velocity checks, risk scoring	Legitimate interests	Named in the GDPR itself as a legitimate interest. Device identification also relies on Section 8.
Identity verification, sanctions and politically-exposed-person screening, transaction monitoring	Legitimate interests, or legal obligation where one applies to us	[TO BE COMPLETED: registered company name] is [TO BE COMPLETED: either 'a registered obliged entity under the named law' or 'not a licensed or registered financial institution; the standards below are applied voluntarily']. We do not claim a legal obligation we do not have.
Passing your details to a receiving provider on a withdrawal	Legal obligation where transfer-of-funds rules apply, otherwise legitimate interests	See Section 6
Service emails — order updates, dispute notices, security alerts	Contract	You cannot switch these off while you have an account
Marketing emails	Consent, withdrawable in one click
Analytics, and any advertising measurement	Consent	See the Cookie Policy
Keeping records, defending claims, tax and accounting	Legal obligation and legitimate interests
Improving the service, debugging, capacity planning	Legitimate interests	Aggregated wherever it can be

4. Automated decisions

Some decisions here start automatically. The ones that matter to you are:

• Risk scoring on an order or a withdrawal, which can hold it for review.
• Duplicate-account detection, which can suspend linked accounts.
• Address screening, which can refuse a withdrawal to a particular address.
• Seller rank, recalculated from your completed volume, rating and dispute record — it sets your fee and your payout hold.

What goes into them: how new the account is; how the order compares to your history in size and speed; device and network signals shared with other accounts; the risk score of a blockchain address and its counterparties; dispute rate; delivery-deadline record.

What you are entitled to. Where an automated decision freezes your balance, refuses a payout or closes your account, you can demand that a person reviews it. Ask, tell us what you want considered, and a human being will look at it and answer. That is a right, not a courtesy. You may also contest the outcome. Section 12.3 of the Terms of Service describes the route.

5. Who we share it with

• [TO BE COMPLETED: licensed payment processor of record] — deposits and withdrawals
• Our identity verification provider — when a check is triggered
• Our screening provider — sanctions, PEP and blockchain address screening
• Our email provider — to deliver service and marketing email
• Our hosting, storage and error-monitoring providers
• The other party to your order — your username, your rank, your review history, and the messages and evidence you post on that order. Not your email, your real name, your address or your payout details.
• Buyers, publicly — if you sell as a trader, the law requires us to publish your name, address, telephone number and email on your listings. This is the direct consequence of trading as a business; it is why Section 3.4 of the Terms of Service asks you to declare honestly.
• A receiving crypto-asset service provider — on a withdrawal, where rules on transfers of funds require us to send identifying information with it
• Authorities — where we are legally required, or where we report a suspicion we are obliged to report. In some cases the law forbids us from telling you we have done so.
• A buyer of the business — if this company is ever sold, on notice to you and with your rights carried over

We do not sell your personal data. We do not share it for anyone else's advertising.

6. Where your data goes

We use providers outside your country. Where the law requires a transfer mechanism, we use the European Commission's Standard Contractual Clauses, or the UK International Data Transfer Agreement or Addendum, together with a documented assessment of the destination and the technical measures in Section 9.

Where you give information directly to us and we are outside your country, that is not itself a transfer needing those clauses; the clauses cover what we pass on to our providers. The list of providers and their locations is available on request at privacy@gtamarket.store.

7. How long we keep it

What	How long
Account and profile	Life of the account, then 30 days, then deleted or anonymised
Orders, ledger entries, escrow records, invoices	7 years — accounting and tax law
Identity verification records and screening results	5 years from the end of the relationship
Trader identification file published under marketplace rules	Duration of the contract plus 6 months, then deleted
Fraud and abuse case files, ban records	3 years; longer for confirmed fraud, so the same person cannot simply register again
Dispute files and the evidence in them	3 years from the decision
Support tickets and chat	2 years
Security and access logs	12 months
Marketing consent records	While consent lasts, plus 2 years after it is withdrawn
Anything under a legal hold or in a live dispute	Until it ends, plus the limitation period

Two of these pull in opposite directions on the same data — trader identification is deleted at contract plus six months, while anti-money-laundering records are kept for five years. We hold them as separate records on separate bases, and deleting one does not delete the other.

8. Cookies, storage and device identification

Covered in full by the Cookie Policy.

One point belongs here too, because it is easy to bury. Our fraud prevention reads characteristics of your device and browser to recognise when one person is running several accounts or when someone else has got into yours. That reading of your device is not exempt from the rules that govern cookies simply because we use it for security. We describe it, we tell you what it does, and where consent is required for it we ask.

9. How we protect it

Passwords hashed with Argon2id. Two-factor authentication available on every account, and required for staff. Sensitive stored values — two-factor secrets, verification data — encrypted at rest under keys we rotate. Encryption in transit everywhere. Staff access limited to what a role needs, logged, and reviewed. An append-only ledger that cannot be edited, only added to. Regular backups, and a restore procedure we test rather than assume.

If a breach happens that puts you at risk, we will tell you, and the relevant authority, within the time the law allows — and we will tell you what we know rather than waiting until we know everything.

10. Your rights

You can ask us to: give you a copy of your data; correct it; delete it; restrict what we do with it; give it to you in a portable form; or stop a particular use. You can object to direct marketing at any time and we must stop — there is nothing to weigh. You can withdraw a consent whenever you like, and doing so does not undo what was lawful before.

Some of it we cannot delete on request: ledger entries, order records and anti-money-laundering files are kept for the periods in Section 7 because the law says so. We will tell you exactly what we are keeping and why.

How to ask: privacy@gtamarket.store, or from your account settings. We answer within one month, and can extend by two more for a complex request, in which case we tell you inside the first month. It is free unless a request is clearly excessive or repetitive.

If we get it wrong, complain to us first at privacy@gtamarket.store. We acknowledge a privacy complaint within 30 days and answer it in full without undue delay. You can also complain to a data protection authority — in the EU, the one where you live, work or where the problem happened; in the UK, the Information Commissioner's Office. You do not have to come to us first, but it is usually faster.

11. If you are in the United States

Depending on where you live, you may have the right to know what we collect and why, to get a copy, to correct it, to delete it, to opt out of any sale or sharing of it, and to limit what we do with sensitive information — and not to be treated worse for exercising any of that.

We do not sell your personal information and we do not share it for cross-context behavioural advertising. If that ever changes we will publish it here first, add the opt-out link the law requires, and honour Global Privacy Control signals from your browser.

To exercise a right, write to privacy@gtamarket.store. An authorised agent may act for you with written proof.

12. Children

This service is for adults. You must be 18. We do not knowingly collect anything about anyone under 18, and when we find out we have, we close the account, remove its listings, delete the data we are not required to keep, and return any balance to where it came from rather than paying it out.

Parents and guardians: privacy@gtamarket.store.

13. Changes

We will post a new version here and, for a change that affects your rights, tell you by email at least 15 days before it takes effect.