Privacy Policy

Controller

The data controller is DSTF OÜ, Keskväljak 4, Jõhvi, Ida-Viru maakond 41531, Estonia (registry code 17574053). For any privacy question or to exercise your rights, email info@dropple.shop.

What we collect

• Account data: email address, display name, password (stored only as a salted hash), and your Steam profile ID and avatar when you sign in with Steam.
• Delivery data: your Steam trade URL.
• Billing data: the name and address you give us at checkout, used to issue your invoice.
• Order data: items purchased, amounts, payment method and payment reference.
• Support data: messages you send us and our replies.
• Technical data: IP address and basic request logs, kept for security and fraud prevention.

Why we process it

• To perform the contract: taking payment and delivering the item you bought.
• To comply with legal obligations: accounting records, tax, and anti-money-laundering duties.
• For our legitimate interests: preventing fraud, securing the service, and improving it.
• With your consent: optional marketing email, which you can withdraw at any time.

Who we share it with

We share the minimum necessary with our payment providers, our email provider, our hosting and database providers, and our accountant. We do not sell personal data to anyone.

Where a provider is outside the EEA, transfers are made under an approved safeguard such as the European Commission's standard contractual clauses.

How long we keep it

Order and accounting records are kept for the period required by Estonian accounting law (currently seven years). Account data is kept while your account exists. Support correspondence is kept for two years.

Your rights

• Access a copy of your data.
• Correct inaccurate data.
• Delete your data, where we have no overriding legal obligation to keep it.
• Restrict or object to processing.
• Receive your data in a portable format.
• Complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), or to your local supervisory authority.