This Privacy Policy explains how the relevant xplay entity collects, uses, discloses, stores and otherwise processes Personal Data when you visit https://xplay.gg/ (the “Website”), create or use an xplay account, use xplay game servers, features, integrations and other services (together, the “Services”), or otherwise interact with us.
This Privacy Policy is intended to satisfy applicable transparency requirements, including, where applicable, the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR, the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”), and other applicable privacy and data protection laws.
This Privacy Policy is a notice about our processing practices. It does not form a contract and does not replace the Terms of Use or any service-specific notice that we may provide at the point where Personal Data is collected.
The xplay Services are provided by different legal entities depending on the country or region in which you are located. The xplay entity that provides the Services to you under the Terms of Use applicable to your country or region is the controller responsible for the processing of your Personal Data in connection with those Services.
CS VIRTUAL TRADE LTD, a Cyprus private limited company, registration number HE 389299, with registered address and principal place of business at 705, Spyrou Araouzou & Koumantarias, Fayza House, 3036 Limassol, Cyprus.
G2G MARKETPLACE LIMITED, a Hong Kong limited liability company, registration number 3064044, with registered address and principal place of business at 8F, 30 Hollywood Road, Central, Hong Kong.
Each entity acts as an independent controller for the users to whom it provides the Services. References in this Privacy Policy to “xplay”, “we”, “us” or “our” mean the relevant xplay entity acting as controller for you.
If you are unsure which xplay entity provides the Services to you, please refer to the Terms of Use applicable to your country or region or contact us using the details below.
Privacy and data protection enquiries: [email protected]
Support: the online support chat available on the Website.
Where we have appointed a Data Protection Officer, you may contact the Data Protection Officer at [email protected]. You may also use this address to exercise your privacy rights.
“Personal Data” means information relating to an identified or identifiable individual. Depending on how you use the Services, we may process the following categories of Personal Data.
3.1 Account and Connected-Account Data
When you create or use an xplay account or connect a third-party account, we may process account identifiers and profile information. If you sign in or connect through Steam, this may include your Steam ID, username, profile picture and other Steam information made available to us through the permissions you grant and the relevant Steam functionality. We may also process your FACEIT level where this is used in connection with the Services. If you provide a Steam trade link to use virtual-item withdrawal or transfer functionality, we may store and process that trade link together with your connected Steam account information for the purpose of facilitating the relevant transaction.
3.2 Discord Integration Data
If you choose to link your Discord account to your xplay account through Discord OAuth2, we receive and store your Discord user ID. We use this identifier to link your accounts and to identify the linked Discord account in the official xplay.gg Discord server.
We may use the Discord API to determine whether the linked Discord account is a member of the official xplay.gg Discord server where membership is required to access a feature, benefit or community functionality. For this functionality, we do not read or store Discord message content and we do not track Discord user presence.
Discord API Data is used only as necessary for the stated xplay functionality. We do not use Discord API Data for advertising, advertising targeting, data-broker activities or profiling of Discord users or their relationships.
3.3 Device, Technical and Approximate Location Data
When you access the Website or Services, we may automatically collect technical information such as IP address, country or city inferred from IP address, device type, operating system, browser type and version, screen or display information, language, timestamps, identifiers used by cookies or similar technologies, and technical logs.
3.4 Usage and Service Activity Data
We may process information about how you use the Website and Services, including settings, searches, activity logs, subscriptions, Challenges, Battle Pass, SkillPass, rankings, rewards and progression, xcoins earning and spending activity, Store, Auction, inventory, drops, exchanges, withdrawals, subscription-only features, referral features, personal matches, and Skinchanger or other in-service customisation settings and saved presets.
3.5 Gameplay Data
We may process information generated through gameplay and game-server use, including Steam ID, FACEIT level, game activity logs, gameplay statistics and, where applicable, in-game or service chat records. Discord message content is not included in this category.
3.6 Rewards and Virtual Item Data
When you use reward, progression, Store, Auction or inventory functionality, we may process information about xcoins, rewards, challenge and Battle Pass progress, virtual items obtained or used through the Services, drops, exchanges, withdrawals, bids and related transaction history.
3.7 Referral Data
If you participate in the referral programme, we may process referral links or codes, referrals attributed to an account and rewards generated through the referral programme.
3.8 Personal Match and Customisation Data
If you create or join personal matches or use customisation features, we may process lobby and server configuration data, invitations, participation information and saved Skinchanger or other in-service customisation settings and presets.
3.9 Payment, Purchase and Billing Data
When you make a purchase, purchase a subscription, use a paid marketplace feature or request a refund, payment credentials are generally provided directly to the relevant payment service provider. We may receive limited payment or transaction information from that provider, such as transaction status, payment method information, a masked or partial payment-card number, card issuer information and billing email, as necessary to process or reconcile the transaction. Where a digital asset payment method is available, we may also receive and process information relating to the relevant blockchain transaction, such as the transaction hash, blockchain network, wallet address or other transaction metadata, to the extent such information is provided to us by the payment service provider or is otherwise processed by us in connection with the transaction.
3.10 Communications and Support Data
We process information you provide when you contact support, submit a complaint or request, participate in surveys or reviews, or otherwise communicate with us, together with records necessary to respond to and manage those communications.
3.11 Cookies and Similar Technologies
We and our service providers may use cookies, pixels, SDKs and similar technologies to operate the Website, remember settings, measure performance, understand use of the Services and, where permitted, provide or measure advertising. Where applicable law requires consent for non-essential technologies, we rely on consent and provide controls through our cookie-management mechanism. Further information is available in our Cookie Policy.
We obtain Personal Data from the following sources:
· directly from you, including when you create an account, use the Services, make purchases, contact support or participate in a referral programme;
· automatically from your device and your use of the Website, game servers and Services;
· from third-party services that you choose to connect to xplay, including Steam, FACEIT and Discord, subject to the permissions and functionality of those services;
· from payment service providers in connection with purchases, subscriptions, refunds and payment verification;
· from other service providers that support security, fraud prevention, analytics, hosting, customer support and similar operational functions; and
· where permitted by law, from publicly available or commercially available sources where necessary for security, fraud prevention or legal compliance.
Where the GDPR or UK GDPR applies, we process Personal Data only where we have a lawful basis. The principal purposes and legal bases are set out below. A particular activity may rely on more than one legal basis where appropriate.
Where we rely on legitimate interests, we consider the nature and impact of the processing and balance our interests against your rights and freedoms. Our relevant interests include maintaining secure and reliable Services, preventing fraud and abuse, supporting users, improving and developing the Services, operating and planning our business, promoting the Services where permitted, and establishing, exercising or defending legal claims. You may object to processing based on legitimate interests as described in Section 13.
Certain Personal Data is necessary for us to enter into or perform our contract with you or to provide a feature you request. For example, account identifiers are required to create and maintain an account, payment-related information is required to complete a paid transaction, and a Discord user ID is required if you choose to link Discord and use functionality that depends on that connection. If you do not provide data that is necessary for a requested Service, we may be unable to provide that Service or particular feature.
Where we request Personal Data to comply with a legal obligation, we will indicate this where appropriate. Unless otherwise stated, providing data used solely for optional marketing or non-essential analytics is voluntary.
We do not sell Personal Data in the ordinary meaning of the term. We may disclose Personal Data to the following recipients where necessary:
Discord API Data is not disclosed to advertising networks, data brokers or other advertising or monetisation services. We disclose Discord API Data only as permitted by Discord's developer terms and applicable law, including to service providers acting on our behalf where necessary to operate the integration, where required by law, or where the user expressly directs the disclosure.
Depending on your country or region, the controller responsible for your Personal Data may be established inside or outside the European Economic Area (“EEA”) or the United Kingdom. We may also transfer Personal Data to service providers, group entities and other recipients located in other countries.
Where the GDPR or UK GDPR applies and Personal Data is transferred to a country that is not covered by an applicable adequacy decision, we use an appropriate transfer mechanism as required by law, which may include the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, and supplementary measures where appropriate.
You may contact [email protected] for further information about the transfer mechanism applicable to your Personal Data and, where available, to request a copy of the relevant safeguard, subject to appropriate redactions for confidential or commercially sensitive information.
We retain Personal Data only for as long as necessary for the purposes described in this Privacy Policy, taking into account the nature of the data, the Service involved, legal and regulatory requirements, applicable limitation periods, security and fraud-prevention needs, and the need to resolve disputes or enforce agreements.
When Personal Data is no longer required, we delete or anonymise it, unless continued retention is required or permitted by applicable law. Deletion from active systems may be followed by a limited period during which data remains in secure backups before being overwritten in the ordinary course.
We implement appropriate technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. The measures we apply are selected having regard to the nature, scope, context and purposes of processing and the risks to individuals. We review and update security measures as appropriate.
Where third-party platform data is processed, including Discord API Data, we apply the additional security and handling requirements imposed by the relevant platform and applicable law.
We may use automated tools to support service functionality, security, fraud and abuse detection, analytics and moderation. Unless we provide a separate notice stating otherwise, we do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR or equivalent applicable law.
If we introduce processing that is subject to specific legal requirements for automated decision-making, we will provide the information and rights required by applicable law, including any required information about the logic involved and the significance and consequences of the processing.
Depending on the law that applies to you, you may have the following rights:
Access: to obtain confirmation whether we process your Personal Data and a copy of the Personal Data, together with information about the processing.
Rectification: to have inaccurate Personal Data corrected and incomplete Personal Data completed.
Erasure: to request deletion of Personal Data where the legal conditions for erasure are met.
Restriction: to request restriction of processing in the circumstances provided by applicable law.
Data portability: to receive Personal Data you provided to us in a structured, commonly used and machine-readable format, and to transmit it to another controller where the legal conditions apply.
Objection: to object, on grounds relating to your particular situation, to processing based on legitimate interests. You may object at any time to processing for direct marketing.
Withdraw consent: to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
Automated decision-making: where applicable, not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects, subject to the exceptions and safeguards provided by law.
Complaint: to lodge a complaint with a competent data-protection supervisory authority, including an authority in the EEA Member State or UK jurisdiction of your habitual residence, place of work or the alleged infringement, where applicable.
To exercise a privacy right, contact [email protected] or use the available support channel. We may request information reasonably necessary to verify your identity and authority to make the request. We will respond within the period required by applicable law. Some rights are subject to legal conditions and exceptions, and we may retain information where required or permitted by law.
The Services are not intended for persons who do not meet the minimum age requirements set out in the applicable Terms of Use or applicable law. We do not knowingly use Discord API Data concerning persons below 13 years of age or the higher minimum age required by law in their jurisdiction.
Where we rely on consent to process Personal Data in connection with an information-society service offered directly to a child, we obtain parental or guardian authorisation where required by applicable law. If you believe that a child has provided Personal Data to us contrary to these requirements, please contact [email protected].
This Section 15 applies only to California residents where the relevant xplay controller is subject to the CCPA. It supplements the other sections of this Privacy Policy and, where applicable, serves as a Notice at Collection.
15.1 Categories of Personal Information
In the preceding 12 months, we may have collected the following CCPA categories of personal information: identifiers; customer-record information; commercial information; internet or other electronic network activity; approximate geolocation information; and inferences or preferences derived from use of the Services. The specific data elements, sources and purposes are described in Sections 3 to 5 above.
We do not intentionally collect sensitive personal information for purposes that would require a right to limit its use or disclosure under the CCPA, unless we provide a separate notice.
15.2 Disclosure, Sale and Sharing
We may disclose personal information for business purposes to the recipient categories described in Section 8. Depending on the technologies deployed on the Website and the applicable legal definition, disclosure of identifiers or internet activity to certain advertising or analytics partners may constitute a “sale” or “sharing” under the CCPA even where no money is exchanged.
Where we engage in CCPA-defined sale or sharing, California residents may opt out through the privacy-choice mechanism made available on the Website. Where required, we also process recognised opt-out preference signals, including Global Privacy Control, in accordance with applicable law.
We do not sell or share Discord API Data for cross-context behavioural advertising or other advertising or monetisation purposes.
15.3 California Rights
Subject to applicable conditions and exceptions, California residents may have the right to:
· know the categories and specific pieces of personal information we have collected about them, the sources, purposes and categories of recipients;
· request deletion of personal information;
· request correction of inaccurate personal information;
· opt out of the sale or sharing of personal information, where applicable;
· limit the use and disclosure of sensitive personal information, where the right applies;
· receive information and exercise rights relating to covered automated decision-making technology where required by applicable CCPA regulations; and
· not receive discriminatory treatment for exercising CCPA rights.
California requests may be submitted through [email protected] or the privacy controls made available on the Website. We may verify requests as permitted by law and may allow an authorised agent to submit a request where the applicable requirements are satisfied.
If a Personal Data breach occurs, we will assess the incident and notify the competent supervisory authority and affected individuals where notification is required by applicable law. We also comply with incident-notification obligations imposed by third-party platforms where relevant.
We may update this Privacy Policy from time to time to reflect changes to the Services, our processing activities, legal requirements or third-party platform requirements. The “Last updated” date at the beginning of this Privacy Policy indicates when it was most recently revised.
Where changes are material, we will provide appropriate notice through the Website, the Services, email or another appropriate channel as required by applicable law. Where a change requires consent, we will request consent rather than treating continued use of the Services as consent.
Third-party services, including Steam, FACEIT, Discord and payment providers, process Personal Data under their own terms and privacy notices when acting as independent controllers. We encourage you to review those notices before connecting or using a third-party service.
If there is a conflict between this Privacy Policy and a mandatory requirement of applicable data-protection law, the mandatory legal requirement prevails.