Legal

Privacy Policy

How EchoSkins and OTTVH MT collect, use and protect your personal data.

Last updated: 18 June 2026

EchoSkins is a brand operated by Online Transaction Technology Ventures Holding MT ("OTTVH MT", "we", "us", "our"), with its registered office at Suite 82, Regent House, Bisazza Street, Sliema, SLM 1640, Malta.

OTTVH MT is the data controller responsible for your personal data when you use EchoSkins (the "Service"). This policy explains what we collect, why, who we share it with, and the rights you have. It should be read together with our Cookie Policy.

1. Who we are

Controller: Online Transaction Technology Ventures Holding MT.

Registered office: Suite 82, Regent House, Bisazza Street, Sliema, SLM 1640, Malta.

Privacy contact: [email protected]. Data protection / DPO requests: [email protected].

2. Information we collect

We collect the following categories of personal data:

  • Account data — your email, display name and authentication identifiers (including your Steam ID and trade URL).
  • Transaction data — orders, items purchased, Platform Credit balance and movements, and delivery status.
  • Payment data — card type and the last four digits, billing country and the processor’s transaction reference. Full card numbers are handled by our payment processor and never stored by us.
  • Technical data — IP address, device and browser type, and cookie identifiers (see our Cookie Policy).
  • Communications — messages you send us through support or contact channels.

3. How we use your data and our legal bases

  • To provide the Service — create your account, process orders and deliver items to your Steam inventory. Legal basis: performance of a contract.
  • To take payment and prevent fraud — process card payments and detect abuse. Legal basis: contract and our legitimate interests in securing the Service.
  • To meet legal obligations — accounting, tax and anti-money-laundering record-keeping. Legal basis: legal obligation.
  • To improve and secure the Service — analytics and diagnostics. Legal basis: consent (for non-essential cookies) and legitimate interests.
  • To communicate with you — service messages and, where you have opted in, marketing. Legal basis: contract and consent.

4. Cookies

We use cookies and similar technologies as described in our Cookie Policy. Non-essential cookies are only set with your consent, which you can change at any time through the cookie settings on the site.

5. Who we share your data with

We do not sell your personal data. We share it only with the following categories of recipient, under appropriate contracts:

  • Payment processor — our contracted payment service provider, to authorise and settle card payments.
  • Fulfilment partner — Waxpeer, to source and deliver the items you purchase.
  • Steam / Valve Corporation — to the extent required to deliver items to your Steam inventory via trade offers.
  • Infrastructure providers — hosting and cloud services that operate the Service on our behalf.
  • Authorities and advisers — where required by law, or to establish, exercise or defend legal claims.

6. International transfers

Where data is transferred outside the Malta / EEA, we rely on adequacy decisions or Standard Contractual Clauses to ensure an equivalent level of protection.

7. How long we keep it

We keep personal data only as long as necessary for the purposes above. Account and transaction records are retained for the period required by applicable accounting and tax law (generally up to ten years), after which they are deleted or anonymised.

8. Your rights

Subject to applicable law, you have the right to:

  • Access the personal data we hold about you.
  • Rectify inaccurate or incomplete data.
  • Erase your data ("right to be forgotten") where it is no longer needed.
  • Restrict or object to certain processing.
  • Data portability — receive your data in a portable format.
  • Withdraw consent at any time, without affecting prior processing.

To exercise any of these rights, contact [email protected]. You also have the right to lodge a complaint with the Office of the Information and Data Protection Commissioner (IDPC), Malta.

9. Security

We use technical and organisational measures — including encryption in transit, access controls and a closed-loop credit design — to protect your data. No method of transmission is completely secure, but we work to protect your information and review our controls regularly.

10. Children

The Service is intended only for users aged 18 or over. We do not knowingly collect data from anyone under 18. If you believe a minor has provided us data, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. The "last updated" date below reflects the current version, and material changes will be notified through the Service.

12. Contact us

Online Transaction Technology Ventures Holding MT, Suite 82, Regent House, Bisazza Street, Sliema, SLM 1640, Malta. Email: [email protected].