Polityka prywatności — RODO & GDPR

1. Who We Are

BuyAccount ("we", "our", "us") is operated by BUYACCOUNT LTD, a company registered in England and Wales (company number 17471215), registered office Suite 11238, 5 Brayford Square, London E1 0SG, United Kingdom. We are the controller of the personal data described in this policy.

This policy explains what data we collect, why we use it, who we share it with, how long we keep it and what rights you have. For any privacy question or request, email support@buyaccount.gg.

2. Information We Collect

We collect the following information:

Account information: your email address and username. We do not use passwords: you sign in with a one-time code sent to your email (valid for 10 minutes) or with Google. If you use Google, we receive your Google account's email address, name and profile picture.
Profile information: an avatar, bio, timezone and any other details you choose to add.
Orders and payments: your purchases, wallet balance and wallet transactions, refunds and disputes. Card details are entered on Stripe's payment page and crypto payments are made through Cryptomus, so we never receive or store your full card number; we receive the payment status and the amount.
Messages: your chats with sellers, live support chats and support tickets, including any images you send.
Purchased account details: the login details of a game account you buy are stored so that you can see them on your Orders page. Only you, the seller and our support staff can access them.
Technical data: IP address, browser and device type, pages visited and timestamps, used for security, fraud prevention and, with your consent, analytics.
Newsletter: your email address, if you subscribe.

3. How We Use Your Information

We use your information for these purposes, each with its legal basis under the UK GDPR:

To provide the service (your account, orders, delivery, refunds, messages and support), and to send the emails it needs, such as login codes, order confirmations and message notifications: performance of our contract with you.
To keep the Platform safe: detecting and preventing fraud, abuse and security threats. Automated checks flag unusual payments or refund patterns; a person reviews every flag before any action is taken. Legal basis: our legitimate interests.
To measure and improve the Platform with analytics and advertising measurement: your consent, given through the cookie banner.
To send our newsletter: your consent. You can unsubscribe at any time with the link in our newsletter emails.
To meet legal obligations, such as accounting and tax records and requests from authorities: legal obligation.

4. Who We Share It With

We do not sell your personal data. We share it only as needed to run the Platform:

Other users: your username, public profile and the messages you send in an order chat are visible to the other party.
Stripe: card payments, including Apple Pay and Google Pay.
Cryptomus: cryptocurrency payments.
Resend: sending our emails (login codes, order and message emails), using Amazon Web Services servers in the EU.
Cloudflare: delivering and protecting the website, DNS, and receiving emails sent to our addresses.
Google: Sign in with Google and, only if you accept analytics and advertising cookies, Google Analytics and Google Ads measurement through Google Tag Manager.
Telegram: internal notifications to our staff about new orders, refunds, payment problems and new support chats. These can include order and user numbers, usernames, amounts and the first part of a support message or refund reason.
Our hosting provider: the servers that run the Platform and store its data.
Authorities: when the law requires it, or to protect the rights and safety of our users.

Our live support chat runs on our own systems; no third-party chat provider is involved. Service providers process data only on our instructions.

5. International Transfers

Some of these providers process data outside the UK, for example in the European Union or the United States. Where they do, the transfer relies on UK adequacy regulations or on the safeguards the providers offer, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

6. Cookies

We use cookies and browser local storage that the Platform needs to work: keeping you signed in, remembering your language and currency, and linking the live chat to you. These are always on.

Analytics and advertising cookies (Google) stay off until you click Accept in the cookie banner, and stay off if you click Reject. Your choice is saved in your browser; to change it, clear this site's data in your browser settings and the banner will ask again.

7. Data Retention

We keep your data only as long as we need it:

Account and profile data: while your account is open.
Order, payment, wallet and refund records: for as long as UK accounting and tax law requires (normally six years), and longer only while a dispute or chargeback is open.
Messages and purchased account details: while your account is open, as they are part of your order history.
Technical logs: only as long as needed for security, fraud prevention and troubleshooting.
Newsletter: until you unsubscribe.

If you ask us to delete your account, we delete or anonymise your personal data within 30 days, except the records we must keep by law or to resolve an open dispute.

8. Security

We protect your data with HTTPS encryption, access controls and login codes that expire after 10 minutes. Card details never reach our servers; they are handled by Stripe. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.

9. Your Rights

Under the UK GDPR you have the right to:

access the personal data we hold about you and get a copy of it;
have inaccurate data corrected;
have your data deleted;
restrict or object to how we use your data, including for marketing;
receive your data in a portable format;
withdraw your consent at any time, without affecting what we did before.

To use any of these rights, email support@buyaccount.gg. We answer within one month. You can also complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

10. Children's Privacy

Our Platform is not directed at children under 18. We do not knowingly collect personal information from minors. If we become aware that a minor has registered, we will delete the account.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of significant changes via the Platform. The date at the top shows when it last changed.

12. Contact Us

For questions about this policy or your data, email support@buyaccount.gg or write to BUYACCOUNT LTD, Suite 11238, 5 Brayford Square, London E1 0SG, United Kingdom.