数据处理政策

This data processing policy (the "Policy") explains how Witte Software LTD, registered address 128 City Road, London, United Kingdom, EC1V 2NX (the "Administration"), processes and protects the data of registered and unregistered users (the "user" or "you") of the mooncase.one website (the "Site").

By using the Site and providing your data you consent to its processing in accordance with this Policy. If you disagree with any provision of this Policy, you must stop using the Site.

1. Terms and definitions

1.1. Personal data — any information relating to a directly or indirectly identified or identifiable natural person (the data subject — the user).

1.2. Processing of personal data — any operation or set of operations performed on personal data, including collection, recording, organisation, accumulation, storage, updating and alteration, retrieval, use, transfer (dissemination, provision, access), blocking, erasure and destruction, whether or not by automated means.

1.3. Applicable law — the UK GDPR (UK General Data Protection Regulation) and the Data Protection Act 2018. The supervisory authority is the Information Commissioner's Office (ICO), United Kingdom.

2. Data processed

2.1. The Administration processes the minimum amount of data required to operate the Site:

2.1.1. The unique Steam account identifier (SteamID64), the public in-game name and the profile image link received when you sign in via Steam OpenID;

2.1.2. The Steam trade link, provided by the user voluntarily and solely to deliver items won on the Site;

2.1.3. Account data on the Site: internal balance, transaction history (case openings, games, deposits, item withdrawals) and interface preferences;

2.1.4. The referral code and campaign parameters (utm tags) recorded at the moment of registration.

2.2. The Administration does not request or process your name, email address, phone number, home address, identity document details, tax or social security numbers, photographs, biometric data, or any other information that directly identifies you as an individual.

2.3. The Steam identifier and public game profile data do not, on their own, allow the user to be identified as a specific individual, and the Administration holds no additional information that would enable such identification.

2.4. Where sign-in is performed through a third-party service, the Administration processes only the unique identifier and public profile data supplied by that service for technical authentication purposes. No other data is received from or requested of third-party services.

2.5. The Site automatically collects technical data: information stored in cookies, browser and browser settings data, the date and time of access, the addresses of requested pages, actions taken on the Site, device characteristics, the IP address and the country derived from it, and other similar data.

2.6. The Site uses only first-party cookies: a session cookie that keeps you signed in, a cookie storing your language choice, and referral and campaign cookies (the referral code and utm tags, stored for 30 days) that allow a partner who introduced you to be credited. No third-party advertising or analytics cookies are used. You may block or delete cookies in your browser settings; the session cookie is required for the account to function.

2.7. The Administration does not request, receive or store users' payment credentials (bank card, cryptocurrency or e-wallet details). All payments are executed by external payment providers; the Administration receives only the payment identifier, amount and status from them.

3. Purposes of processing

3.1. Data is processed in order to:

3.1.1. Allow the user to create an account, use the Site and carry out operations on it;

3.1.2. Credit deposits, maintain the internal balance and deliver items won;

3.1.3. Keep the Site stable and secure, and prevent fraud, abuse and multi-accounting;

3.1.4. Improve service quality, usability and customer support;

3.1.5. Comply with obligations imposed by applicable law.

3.2. The Steam identifier is processed solely for technical authentication and to link the account.

3.3. The Steam trade link is used solely to deliver items to the user and is disclosed to no one other than the partners performing that delivery.

3.4. Technical data is processed for fault diagnosis, security and protection of the Site.

4. Lawful bases

4.1. Processing is carried out on the following lawful bases under Article 6 of the UK GDPR:

4.1.1. Performance of a contract with the user — for account operation, transactions on the Site and item delivery;

4.1.2. Consent — given when you tick the confirmation boxes in the sign-in dialog before an account is created;

4.1.3. Legitimate interests of the Administration — for Site security, fraud prevention and crediting partner referrals;

4.1.4. Compliance with a legal obligation — where the law imposes duties on the Administration.

4.2. Consent is specific, informed, unambiguous and freely given, and is expressed by:

4.2.1. Ticking "I agree to the Terms of Service" in the sign-in dialog;

4.2.2. Ticking "I'm 18 years old or older" in the sign-in dialog;

4.2.3. Confirming authentication through Steam or another supported sign-in provider.

4.3. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

5. Conditions of processing

5.1. Data is processed until the purposes set out in this Policy are achieved, until the account is deleted, or until consent is withdrawn, unless a different retention period is required by law.

5.2. The Administration takes the necessary organisational and technical measures to protect user data against unlawful or accidental access, destruction, alteration, blocking, copying, dissemination and other unlawful acts by third parties.

5.3. Data is used only for the purposes stated in this Policy. It is disclosed to third parties strictly to the extent required to provide the service, namely:

5.3.1. To payment providers — to process deposits;

5.3.2. To partners delivering in-game items — the Steam trade link and the item details;

5.3.3. To infrastructure providers (hosting, data storage, monitoring) — as processors acting on the Administration's instructions;

5.3.4. To competent authorities — in cases expressly provided for by law.

5.4. Data is transferred outside the United Kingdom only where the safeguards required by the UK GDPR are in place.

5.5. Data submitted through the Site is transmitted in encrypted form over the HTTPS protocol.

6. Your rights

6.1. The user has the right to:

6.1.1. Be informed about, and obtain access to, the data processed by the Administration;

6.1.2. Request rectification, restriction of processing, blocking or erasure of their data;

6.1.3. Receive their data in a structured, machine-readable format and transmit it to another controller;

6.1.4. Object to processing carried out on the basis of legitimate interests;

6.1.5. Withdraw consent previously given;

6.1.6. Lodge a complaint about the Administration's acts or omissions with the Information Commissioner's Office (ICO) or before a court.

6.2. To exercise these rights the user may write to support@mooncase.one. A response is provided within one month of receiving the request.

7. Final provisions

7.1. The Administration may amend this Policy. The current version states the date of the last update. A new version takes effect once published on the Site, unless the version itself provides otherwise.

7.2. The parties agree that all notices, messages, agreements, documents and letters sent using the authorised email addresses and the Site account are deemed sent and signed by the parties, except where such a letter expressly states otherwise.

7.3. The authorised communication channels of the parties are:

7.3.1. For the Administration: support@mooncase.one;

7.3.2. For the user: the account on the Site and the email address from which the user contacted support.

7.4. The current version of this Policy is always published on this page of the Site.

7.5. This Policy takes effect on 26 July 2026 and remains in force until withdrawn or replaced by a new version.