This Extended Privacy Policy of LootX (the "Policy") describes what personal data and technical data Grenco Limited processes in the provision and operation of the LootX service, for what purposes and on what grounds such processing is carried out, to whom the data may be transferred, how long it is retained and what rights users have.
This Policy applies to the website https://lootx.space, its subdomains and related interfaces, as well as to registration and use of the Account, authorization via Steam, the acquisition and opening of loot boxes, the internal inventory, requests for the withdrawal of virtual game items through an external provider, payments, technical support, security, fraud prevention and other related processing of data (collectively, the "Service").
This Policy does not cancel the LootX Terms of Use and the LootX Terms of Sale. Capitalized terms not defined in this Policy are used with the meanings established in those documents.
1. Data Controller and Contacts
The controller of personal data in relation to the processing described in this Policy is Grenco Limited, a private company limited by shares, incorporated and operating under the law of the Hong Kong Special Administrative Region of the People's Republic of China ("Grenco Limited", "LootX", "Operator", "we", "us" or "our").
Details of the Operator: Business Registration No. 77682394; registered address: Room 5003, 5/F, Yau Lee Centre, 45 Hoi Yuen Road, Kwun Tong, Kowloon, Hong Kong; director: Abdulhai Amgad.
For questions regarding personal data, the exercise of rights, international data transfers, security, cookies or this Policy, you may contact us at lootx@overpay.io. To expedite the processing of a request, please state the subject "Privacy Request", the Account identifier or Steam ID, if available, and the substance of the request.
If a separate representative in the EEA, the United Kingdom, a DPO or another dedicated privacy contact is appointed in the future, their contact details will be published in the current version of this Policy.
2. Scope and Persons to Whom the Policy Applies
The Policy applies to visitors of the Website, registered and unregistered users, purchasers of Loot Boxes, persons authorizing via Steam, persons requesting the Withdrawal of Digital Items, persons contacting support, as well as other persons whose data we lawfully receive in connection with the operation of the Service.
The Service is intended exclusively for persons who have reached 18 years of age. It is not intended for children and adolescents under 18 years of age. By using the Service, creating an Account, using the Service or making a purchase, the User confirms that they have reached the specified age and are entitled to enter into a legally binding agreement.
3. Principles of Processing
We strive to process data lawfully, in good faith and transparently; to collect only the data necessary for the stated purposes; to keep data up to date where necessary; to retain it no longer than necessary; and to apply reasonable confidentiality and security measures.
We do not sell personal data as a standalone commodity. Transfer of data to third parties may be carried out only for the purposes described in this Policy, where there is a lawful basis and to the extent reasonably necessary for the relevant purpose.
4. Categories of Data Processed
The specific scope of data depends on the functions you use, the country, the method of authorization, the chosen payment method, the technical configuration and the necessary checks. We may process the following categories of data.
4.1. Account Data and Identifiers
LootX Account identifier, Steam ID, Steam username or nickname, information about the public Steam profile to the extent returned by the authorization integration or necessary for linking the account, session identifiers, date of Account creation, information about logins and Account settings.
We do not request and must not receive your Steam password. Authorization must be carried out through the official or technically provided Steam mechanism. Do not transfer Steam passwords or other access codes to employees, contractors or bots of LootX.
4.2. Order, Purchase and Performance Data
Name of the selected Loot Box, price, currency, amount, applicable fees, order identifier, date and time of placement, payment method, authorization and debit status, order status, refund information, payment transaction identifiers, records of user consents, electronic confirmation data and technical logs of performance.
We use this data to accept and perform the order, confirm the purchase, investigate errors, process refunds, resolve disputes and comply with accounting and other applicable legal obligations.
4.3. Opening and Inventory Data
Loot Box identifier, time, date and technical log of the Opening, applied version of the Loot Box mechanics/rules, randomly determined Digital Item, its identifier, name, category/rarity, crediting status, status of being in the Inventory, errors or adjustments, if any occurred.
Such records may be stored as evidence of the performance of a digital operation, the functioning of the random mechanics, the resolution of user requests, the rectification of technical errors and the prevention of fraud.
4.4. Payment Data
Payments are processed by independent payment service providers. Depending on the payment method, we may receive the transaction identifier, order identifier, date and time, amount, currency, payment method, transaction status, masked details, tokenized identifiers, information about a refusal, refund, dispute or chargeback.
Full bank card details are usually entered directly in the secure environment of the relevant payment provider and must not be transferred to us in clear form. The payment provider may process such data as an independent controller or other participant in the payment chain in accordance with its own documents.
4.5. Steam, Game and Withdrawal Data
To communicate with Steam, a compatible game or an External Provider, we may process Steam ID, Steam Trade URL, game or external account identifier, data about the Digital Item held, time and status of the Withdrawal request, transfer number/identifier, result of the Withdrawal attempt, reasons for technical refusal, trade hold, information about a restriction or confirmation of delivery.
We use this data to process the Withdrawal request, verify compatibility, resolve problems, prevent withdrawal to the wrong account, maintain a delivery log and consider claims.
4.6. Technical Data, Cookies and Usage Log
IP address, date and time of access, URLs, referral source, user agent, browser type and version, operating system, device type, language, time zone, screen resolution, network information, cookie and session identifiers, local storage identifiers, action logs, error logs, crash reports, security events and technical diagnostic data.
This data is used for the operation of the Website, maintaining the session, cybersecurity, protection against bots and attacks, determining the causes of errors, preventing unauthorized access, assessing GEO/sanctions risks, ensuring compatibility and analyzing performance.
4.7. Request and Communication Data
Email address, Telegram username, name or nickname, content of the request, data you voluntarily provide in the request, attachments, information about the order or Account, correspondence history and the results of consideration of the request. If you send us documents or other sensitive information, we use them only to the extent necessary to process your request, verify or comply with a legal obligation. Please do not send excessive documents and do not send passwords, 2FA codes or full payment card details.
4.8. Verification, Compliance and Anti-Fraud Data
Where there is a reasonable need, we may process information about age, country, IP/GEO, device, ownership of a Steam account, ownership of a payment instrument, results of age/KYC/AML/sanctions/fraud checks, risk score, results of document verification, signs of multiple Accounts, suspicious payments, chargeback and other security signals.
Such processing is applied, for example, to verify compliance with the 18+ requirement, territorial restrictions, prevent card testing, account takeover, use of another person's payment instrument, circumvention of restrictions, fraud and compliance with mandatory legal requirements.
5. Sources of Data
We receive data directly from you when you visit the Website, authorize, make a purchase, enter a Steam Trade URL, contact support or provide documents.
We may also receive data automatically through the browser, device, cookies, server logs and other technologies, as well as from Steam, the Payment Infrastructure, External Providers, providers of anti-fraud/security solutions, cloud and technical contractors, if this is necessary for the operation of the Service and permitted by law.
If you transfer data of another person to us, you confirm that you have a lawful basis for such transfer.
6. Purposes and Legal Bases
Depending on applicable law and the nature of the specific processing, we use data on one or more bases: performance of a contract; actions at your request prior to entering into a contract; compliance with a legal obligation; legitimate interests of the Operator, users or third parties; your consent; establishment, exercise or defense of legal claims.
6.1. Performance of the Contract and Pre-Contractual Actions
We use data to provide access to the Service, create and maintain the Account, authorize via Steam, process the order and payment, provide the Loot Box, Opening, credit the Digital Item to the Inventory, process the Withdrawal request, send confirmations and provide support under the contract.
If the data necessary for the performance of the contract is not provided, we may be unable to create an Account, process an order, credit an item, perform a Withdrawal or provide the relevant function.
6.2. Legal Obligations
We may use data to comply with applicable requirements of accounting, tax, consumer, sanctions, payment, financial, export, law enforcement and other legislation, as well as lawful requests of competent authorities.
The scope and duration of such processing depend on the specific obligation, the applicable GEO, the nature of the operation and the requirements of the competent authority.
6.3. Legitimate Interests
We may process data to ensure the security of the Service, prevent fraud, protect against bots, card testing, chargeback abuse, circumvention of GEO/age restrictions, multiple Accounts, unauthorized access and other abuses; to protect rights, investigate incidents, improve the stability and quality of the Service; for internal reporting and technical administration.
6.4. Consent
We rely on your consent where required by applicable law, in particular for certain non-essential cookies, analytical or marketing technologies, marketing messages or other types of processing that cannot lawfully be carried out without consent.
You may withdraw consent at any time through the available settings, the cookie banner or by contacting lootx@overpay.io. Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal and does not affect processing based on another legal basis.
6.5. Legal Claims and Disputes
We may store and use data to prevent, establish, exercise or defend legal claims, settle claims, chargeback, disputes, investigations, law enforcement requests and other similar purposes.
7. Cookies and Similar Technologies
We use or may use cookies, pixels, SDKs, local storage, session identifiers, device identifiers, server logs and other technologies that allow information to be stored on or retrieved from a device, recognize the browser, maintain the session, remember settings, protect the Service and measure its technical performance.
Strictly necessary technologies may be used for authorization, maintaining the session, security, fraud prevention, load balancing, preserving technical preferences and ensuring core functionality. Disabling them may cause the Website or individual functions to operate incorrectly.
Functional, analytical, advertising and other non-essential technologies are implemented only if they are actually used and in the manner required by applicable law. Where consent is required, such technologies must not be launched before it is obtained.
You can manage cookies in your browser settings and, where the relevant function is available, through the consent interface on the Website. Deleting or blocking cookies may affect the preservation of settings and the availability of certain functions.
8. Automated Checks, Risk Scoring and Decisions
To ensure security and prevent abuse, we may use automated tools and rules that evaluate operations and user actions. They may take into account IP/GEO, device signals, browser information, history of logins, transactions, Openings and Withdrawals, payment status, chargeback, number of Accounts, risk signals of the Payment Infrastructure, data inconsistencies and other relevant factors.
Such processing may result in additional verification, a temporary delay of payment or Withdrawal, a request for supporting documents, restriction of certain functions, rejection of payment or blocking where there are significant fraud/security/legal indicators.
We do not intend to make decisions that entail legal consequences or similarly significantly affect the user solely automatically, except where permitted by law and the required safeguards are applied. If applicable law grants you such a right, you may request human review, express your position and contest the decision by sending a request to lootx@overpay.io.
9. Recipients and Categories of Recipients
We transfer data only on a need-to-know basis and to the extent proportionate to the purpose of processing. The recipients may be the following categories of persons.
9.1. Payment Infrastructure
Payment service providers, banks, acquirers, issuers, payment aggregators, processing centers and other participants in the payment chain may receive data for authorization, debiting, refunding a payment, risk assessment, consideration of a dispute or chargeback and compliance with applicable requirements.
9.2. Steam, Game Platforms and External Providers
For authorization, verification of linking, requesting or performing a Withdrawal, we may transfer the necessary data to Steam, Valve, an External Provider, the publisher or developer of the game, the relevant game platform and other compatible services.
9.3. Technical and Service Contractors
Hosting providers, cloud services, CDNs, domain and network infrastructure providers, monitoring and error reporting tools, providers of email, messengers, CRM, support services, cybersecurity, backup, analytics, anti-fraud and other IT solutions may process data on our behalf or as independent parties, depending on the specific service.
9.4. Consultants and Affiliates
Lawyers, auditors, accountants, insurers, banks, professional consultants, affiliates and contractors may receive data if this is necessary for corporate governance, compliance, incident investigation, protection of rights or the conduct of the Operator's business.
9.5. Authorities and Corporate Transactions
We may disclose data to competent courts, regulators, tax, law enforcement or other state authorities if this is provided by law, a mandatory request or necessary to protect rights. In the event of reorganization, merger, investment, sale of business, transfer of assets or another corporate transaction, data may be transferred to the relevant party subject to proper confidentiality measures and compliance with law.
10. Independent Controllers and External Sites
Steam, Valve, banks, payment providers, External Providers, game platforms, publishers and game developers, Telegram and other independent services may independently determine the purposes and means of data processing. In such cases, they are independent controllers or other independent participants in processing in accordance with their own documents.
This Policy does not govern the processing of data by third-party sites and services. Before using an external service, it is recommended to review its terms and privacy policy.
11. International Transfers
Grenco Limited is registered in Hong Kong. Depending on the architecture of the Service and the providers used, data may be processed or accessible in Hong Kong, countries where servers are located, countries where technical contractors, the Payment Infrastructure, Steam/Valve, the External Provider or other recipients are located.
If a special mechanism is required for the transfer of data from the EEA, the United Kingdom or another territory, we apply the available and applicable lawful safeguards, including adequacy decisions, standard contractual clauses, additional technical and organizational measures, contractual obligations or another basis provided by applicable law.
To the extent permitted by law, you may request information about the international transfer mechanism by contacting lootx@overpay.io.
12. Retention Periods and Deletion
We retain data no longer than necessary for the purposes of collection and processing, unless longer retention is required or permitted by law. In determining the period, account is taken of the nature of the data, the purpose of processing, Account activity, accounting and tax obligations, limitation periods, requirements of the Payment Infrastructure, the need to prevent fraud and protect legal claims.
Account, order, payment, Opening, Inventory and Withdrawal data may be retained for the duration of the Account and thereafter for the period necessary to comply with legal obligations, consider refunds, chargeback, claims, disputes, investigations and prevent repeated fraud.
Technical logs, security signals and anti-fraud data are retained for a limited period justified by security, incident investigation, error rectification and applicable obligations. Data processed solely on the basis of consent ceases to be used for that purpose after withdrawal of consent, unless further retention is required on another legal basis.
After the expiry of the applicable period, we delete, anonymize or otherwise securely destroy the data, except in cases where it is lawfully necessary to continue retaining it.
13. Security
We apply reasonable technical and organizational measures to protect data from unauthorized access, unlawful disclosure, alteration, loss, destruction and other improper processing. Measures may include role-based access restriction, protected connections, logging, monitoring, backup, personnel verification procedures, contractor checks and contractual confidentiality obligations.
Despite the measures taken, the transfer of data over the internet and storage in digital systems cannot be absolutely secure. The User must independently ensure the security of their Steam account, email, devices, browser, passwords, two-factor authentication codes and payment instruments.
14. Your Rights
Depending on applicable law, the country of your residence, the legal basis and the circumstances of processing, you may have the following rights:
14.1. Access and Information
You may request confirmation of the processing of your data and obtain access to it, as well as to information about the purposes, categories, recipients, retention periods and other circumstances of processing, to the extent provided by law.
14.2. Rectification and Updating
You may request the rectification of inaccurate or the completion of incomplete data. Some information may be changed through the Account or Steam profile interface; other information may be changed by contacting support.
14.3. Deletion
You may request the deletion of data if the grounds for processing are absent, the data is no longer necessary for the stated purpose, consent has been withdrawn and there is no other basis, or in other cases provided by law. Deletion may be limited by retention obligations, the need to protect rights, prevent fraud and other lawful grounds.
14.4. Restriction, Objection and Portability
In cases provided by law, you may request restriction of processing, object to processing based on legitimate interests, or receive data in a structured, commonly used and machine-readable format for transfer to another controller.
14.5. Withdrawal of Consent and Complaint
If processing is based on consent, you may withdraw it at any time. You may also lodge a complaint with a competent data protection authority or another competent authority if you believe that the processing violates applicable law.
15. Procedure for Exercising Rights
Send a request to lootx@overpay.io. State which right you wish to exercise, the available Account/order identifiers, the country of residence and the substance of the request. We may request reasonable additional information to confirm identity and prevent disclosure of data to an unauthorized person.
We will consider the request within the periods required by applicable law. In certain cases, we may fully or partially refuse to fulfill the request or restrict it, if this is permitted by law, for example to comply with a legal obligation, protect legal claims, prevent fraud, ensure security or protect the rights and freedoms of others.
16. Data of Persons Under 18 Years of Age
The Service is not intended for persons under 18 years of age, and we do not knowingly collect their data for the provision of the Service. If we receive reliable information that a user has not reached 18 years of age, we will take reasonable measures to terminate access to the Service and delete or anonymize the relevant data, unless retention is required by law. If you believe that a person under 18 years of age has provided us with data, please contact lootx@overpay.io.
17. Changes to This Policy
We may amend this Policy in connection with changes in legislation, requirements of regulators, the architecture of the Service, the list of providers, security measures, anti-fraud procedures or the Operator's business processes.
The new version of the Policy is posted on the Website with the effective date and the last updated date. Material changes, if required by applicable law, are brought to the User's attention in advance through the Service, Account, email or another available communication channel.
Continued use of the Service after the effective date of the new version may constitute acceptance of the amended Policy to the extent permitted by applicable law. If you do not agree with the amendments, you must stop using the Service, unless applicable law provides otherwise.
18. Contact Details of the Operator
Grenco Limited
Private company limited by shares
Business Registration No.: 77682394
Registered address: Room 5003, 5/F, Yau Lee Centre, 45 Hoi Yuen Road, Kwun Tong, Kowloon, Hong Kong
Director: Abdulhai Amgad
Email: lootx@overpay.io
Telegram: @lootxspacebot