Privacy Notice

This Notice explains how ANECIX LTD ("we", "us" or "the Company") collects, uses and safeguards personal data through outpostx.org (the "Site"). Our approach is built around the requirements of the UK GDPR and the Data Protection Act 2018. By continuing to use the Site once you have read this Notice, you confirm that you understand and accept how we handle your information as described below.

1. INFORMATION WE COLLECT

Depending on how you interact with the Site, we may collect and hold the following categories of personal data about you:

(a) Device and browsing data: your IP address, browser and operating system, device identifiers, session length and navigation activity, logged automatically whenever you access the Site.

(b) Identity and contact details: your name, email address and billing information, supplied when you set up an account or complete checkout.

(c) Steam account and trading data: your Steam username, SteamID, trade URL and trade history, obtained through Steam sign-in and needed to deliver items you have purchased.

(d) Order history: a record of each purchase, including the item concerned, the price paid, payment confirmation and fulfilment status.

(e) Payment-related data: handled exclusively by our PCI DSS-certified payment partner. The Company never receives, stores or has access to full card numbers, CVV codes or expiry dates.

(f) Identity verification records: proof-of-identity and proof-of-address documents, collected only where a compliance or KYC trigger applies.

(g) Support correspondence: a record of the messages you send us through our support or contact channels.

(h) Cookie-derived information: data gathered through cookies and similar technologies, as explained in our Cookie Notice.

2. WHERE THIS INFORMATION COMES FROM

(a) Through Steam, when you sign in to the Site using your Steam credentials.

(b) Directly from you, when you place an order, manage your account, or get in touch with support.

(c) Automatically, through server logs, analytics tools and cookies as you browse the Site.

(d) From trusted third parties, including our payment processor, fraud-prevention services and sanctions-screening providers.

3. WHY WE PROCESS YOUR DATA

We only process personal data where a valid legal basis exists under the UK GDPR. Grouped by the ground each one relies on, our main processing activities are:

(a) Legal obligation - meeting our AML/CTF and sanctions-screening obligations.

(b) Legal obligation - keeping tax, accounting and other statutory records.

(c) Performance of a contract - processing your order and delivering items through Steam.

(d) Performance of a contract - verifying your identity via Steam sign-in.

(e) Performance of a contract - responding to support requests and resolving disputes.

(f) Legitimate interests - detecting and preventing fraudulent activity.

(g) Legitimate interests - improving the Site through usage analytics.

(h) Consent - sending marketing messages you have opted in to receive.

4. HOW WE HANDLE PAYMENTS AND 3D SECURE

Every payment made on the Site is processed solely by our authorised, PCI DSS-certified payment partner. The Company has no access to raw cardholder data at any point in the process; sensitive payment details are handled entirely inside the payment partner's own secure systems.

Where required by the applicable card scheme or payment method, card payments go through 3D Secure (3DS) authentication, which confirms your identity with your card issuer before a transaction is approved. If a transaction is subject to automated risk scoring, you can request a manual review by emailing info@outpostx.org.

5. KEEPING YOUR DATA SECURE

We use proportionate technical and organisational measures to protect your information, including encryption of data in transit and at rest, role-based access controls, and regular review of our security practices. No method of transmitting data over the internet is completely risk-free, and you are responsible for keeping your own account credentials safe.

6. WHO WE SHARE YOUR DATA WITH

We never sell, rent or trade your personal data. It is shared only in the situations set out below:

(a) Valve Corporation (Steam), to the extent needed to deliver purchased items to you via trade offer.

(b) Payment processors and acquiring banks, for handling transactions, authentication and fraud checks.

(c) Regulators and law enforcement bodies, where we are required by law, regulation or court order to disclose information.

(d) Hosting, analytics and communications providers, engaged under data processing agreements that prevent them from using your data for their own purposes.

(e) Professional advisers, such as solicitors and accountants, who are themselves bound by duties of confidentiality.

7. INTERNATIONAL DATA TRANSFERS

Your data is processed mainly within the United Kingdom. Where a third-party partner operates internationally and your data is transferred outside the UK or EEA, that transfer is backed by appropriate legal safeguards, which may include a UK Government adequacy decision, an International Data Transfer Agreement (IDTA), or Standard Contractual Clauses. Email info@outpostx.org if you would like details of the safeguards used for a specific transfer.

8. HOW LONG WE KEEP YOUR DATA

(a) Order and financial records are kept for up to six (6) years, to meet our accounting and regulatory obligations.

(b) KYC and AML documentation is retained for a minimum of five (5) years from the end of the business relationship, as required by Regulation 40 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs 2017) and the Proceeds of Crime Act 2002.

(c) Support correspondence is kept for up to three (3) years, or longer if a related dispute or legal matter is still open.

(d) Cookie and analytics data is kept according to the retention cycle of the relevant tool, or until you clear it through your browser settings.

Once the applicable retention period ends, data is securely deleted or anonymised in line with our internal disposal procedures.

9. YOUR RIGHTS UNDER UK GDPR

You have the following rights over the personal data we hold about you. To exercise any of them, email info@outpostx.org; we will respond within one calendar month:

(a) Access - ask us for a copy of the personal data we hold about you.

(b) Rectification - ask us to correct data that is inaccurate or incomplete.

(c) Erasure - ask us to delete your data where there is no lawful basis for us to keep it.

(d) Objection - object to processing that is based on our legitimate interests.

(e) Restriction - ask us to limit how we use your data in specific circumstances.

(f) Portability - ask us to provide your data in a machine-readable format.

(g) Withdrawal of consent - withdraw consent at any time where processing relies on it, without affecting anything we did lawfully beforehand.

(h) Complaint - lodge a complaint with the Information Commissioner's Office at www.ico.org.uk.

The Site is intended for people aged 18 and over, and we do not knowingly collect or process data belonging to minors.

10. COOKIES AND CHANGES TO THIS NOTICE

Our use of cookies is set out in full in our Cookie Notice, available at Cookie Policy. We review this Privacy Notice from time to time; where we make a material change, we will publish it with a new effective date. Continuing to use the Site after such a change means you accept the updated version.

ANECIX LTD | outpostx.org | info@outpostx.org

Registered in England and Wales | Company No: 17436879