Privacy Policy

1. Introduction

This Privacy Policy explains how EXTERIAN LTD (“Company”, “we”, “us”, or “our”) collects, uses, stores, and shares personal data when you use Bravopoint (the “Website” or “Platform”).

Bravopoint allows registered users to add funds, receive internal credits called Bravo Credits (BC), purchase digital in-game cosmetic items for Counter-Strike 2, Dota 2, and Rust, and receive those items through Steam.

This Privacy Policy applies when you:

• visit or use the Platform;

• create or manage an Account;

• add funds or receive BC;

• submit an Order;

• receive Digital Items through Steam;

• request support or a refund;

• dispute a payment; or

• otherwise interact with us.

This Privacy Policy should be read together with our Terms & Conditions, Refund Info, Payment & Delivery rules, and cookie information.

2. Data Controller

The controller responsible for your personal data is:

• Legal entity: Exterian LTD

• Company registration number: 17272464

• Registered address: 27 Old Gloucester Street, London, United Kingdom, WC1N 3AX

• Customer support contact: helpme@bravopoint.gg

3. Personal Data We Collect

3.1 Account and Contact Data

When you create or manage an Account, we may collect:

• first name;

• last name;

• email address;

• telephone number;

• country of residence;

• physical address;

• password;

• email verification status;

• Account creation date; and

• Account status.

3.2 Steam and Delivery Data

To process and deliver Orders, we may collect:

• Steam Trade Link;

• Steam Account or trade identifiers associated with that link;

• Steam Trade Offer identifiers;

• Digital Item and Order details;

• delivery status;

• trade acceptance, rejection, cancellation, expiry, or reversal status; and

• information about trade bans, holds, cooldowns, or other delivery restrictions where available.

A public Steam inventory is not normally required unless we request it for a specific technical or verification purpose.

3.3 Payment, Balance, and Order Data

When you add funds, acquire BC, or purchase a Digital Item, we may process:

• Top-up amount;

• payment currency;

• quantity of BC credited;

• applicable exchange rate;

• applicable fees and taxes;

• payment date and status;

• Payment Processor transaction identifier;

• card type or card network;

• limited payment details provided by the Payment Processor;

• BC Balance and Balance adjustments;

• Order history;

• Digital Items purchased;

• refunds and cancellations;

• chargeback information; and

• Steam trade reversal records.

Card payments are processed by third-party Payment Processors. We receive the information needed to confirm and manage the transaction.

3.4 Verification and Compliance Data

Where reasonably necessary for security, fraud prevention, payment verification, or legal compliance, we may request or receive:

• confirmation of age;

• proof of identity;

• proof of address;

• evidence that you are authorised to use a Payment Method;

• payment or transaction evidence;

• country or location information;

• fraud or sanctions screening results; and

• explanations or documents provided during a review.

We do not request verification documents from every user.

3.5 Technical and Usage Data

When you use the Platform, we may automatically collect:

• IP address;

• approximate location based on IP address;

• browser type and version;

• operating system;

• device type;

• language and time-zone settings;

• session or device identifiers;

• login activity;

• pages and features used;

• navigation and interaction data;

• error and diagnostic information;

• security logs; and

• cookie or similar technology identifiers.

3.6 Communications and Support Data

When you contact us, we may collect:

• your contact details;

• Account email;

• Order or transaction reference;

• the content of your request;

• Steam Trade Link or delivery information;

• screenshots or attachments;

• complaint or dispute details; and

• records of our response.

4. How We Collect Personal Data

We may collect personal data:

• directly from you;

• automatically through the Platform;

• from Payment Processors, banks, and card networks;

• from our Digital Item Supplier;

• from Steam where relevant information is available;

• from fraud-prevention, hosting, security, and technical providers;

• from public compliance or sanctions sources; and

• from authorities or other parties where legally permitted.

5. How We Use Personal Data

We use personal data to:

• create, verify, and manage Accounts;

• authenticate users and protect Account security;

• process Top-ups and credit BC;

• maintain Balance and transaction records;

• process Orders;

• arrange delivery through our Supplier and Steam;

• confirm, cancel, or investigate deliveries;

• process refunds and Steam trade reversals;

• detect fraud, abuse, unauthorised payments, and multiple Accounts;

• manage chargebacks and payment disputes;

• enforce our Terms & Conditions;

• provide customer support;

• send service and security communications;

• operate, maintain, and improve the Platform;

• comply with tax, accounting, sanctions, and other legal obligations; and

• establish, exercise, or defend legal claims.

We may also use aggregated or anonymised information for analytics and service improvement.

6. Legal Bases for Processing

We process personal data in accordance with applicable data protection laws, including, where applicable, the UK General Data Protection Regulation (“UK GDPR”) and the European Union General Data Protection Regulation (“EU GDPR”).

The references below refer to Article 6(1) of the applicable GDPR framework.

6.1 Contractual Necessity — Article 6(1)(b)

We process personal data where necessary to enter into or perform our contract with you, including to:

• create and manage your Account;

• process Top-ups;

• issue and administer BC;

• process and deliver Orders;

• manage cancellations and refunds; and

• provide customer support.

6.2 Legal Obligation — Article 6(1)(c)

We process personal data where necessary to comply with legal obligations, including:

• tax and accounting requirements;

• consumer protection laws;

• sanctions and compliance requirements;

• legally valid requests from authorities; and

• required record-keeping obligations.

6.3 Legitimate Interests — Article 6(1)(f)

We may process personal data for legitimate business interests, including:

• protecting the Platform and users;

• preventing fraud and Account abuse;

• verifying payments;

• managing chargebacks and Steam trade reversals;

• maintaining accurate records;

• improving Platform performance;

• enforcing our Terms; and

• protecting our legal rights.

We use this basis only where our interests are not overridden by your rights and freedoms.

6.4 Consent — Article 6(1)(a)

We rely on consent where required, including for certain non-essential cookies and similar technologies.

You may withdraw your consent at any time. Withdrawal does not affect processing carried out before consent was withdrawn.

7. Required Information

Some information is required to use the Platform.

For example:

• registration information is required to create an Account;

• an email address is required for verification;

• payment information is required to complete a Top-up;

• a Steam Trade Link is required to deliver a Digital Item; and

• verification information may be required during a security or payment review.

If required information is not provided, we may be unable to create an Account, process a payment, fulfil an Order, issue a refund, or continue providing the service.

8. How We Share Personal Data

We share personal data only where reasonably necessary to provide the service, protect the Platform, comply with the law, or handle a transaction or dispute.

8.1 Digital Item Supplier

We may share relevant information with our Supplier to:

• confirm item availability;

• prepare and deliver Orders;

• send Steam Trade Offers;

• investigate delivery issues;

• process cancellations; and

• investigate Steam trade reversals.

This may include:

• Order information;

• Digital Item details;

• Steam Trade Link;

• Steam trade identifiers;

• delivery status; and

• limited transaction information where required.

8.2 Payment and Financial Providers

We may share or receive information from:

• Payment Processors;

• acquiring banks;

• card networks;

• card issuers;

• fraud-prevention providers; and

• chargeback or dispute services.

These providers may process information to authorise payments, prevent fraud, process refunds, and manage disputes.

8.3 Technology and Service Providers

We may use providers supporting:

• website and cloud hosting;

• database storage;

• cybersecurity;

• email communications;

• customer support;

• system monitoring;

• analytics;

• cookie management; and

• technical maintenance.

These providers may process personal data only as needed to provide their services.

8.4 Professional Advisers and Authorities

We may share personal data with:

• lawyers;

• accountants;

• auditors;

• insurers;

• regulators;

• courts;

• tax authorities;

• law enforcement bodies; and

• other competent authorities.

We do so where reasonably necessary or legally required.

8.5 Business Transfers

If the Company or Platform is sold, merged, reorganised, or transferred, personal data may be shared with relevant advisers, buyers, or successor entities.

9. Sale of Personal Data

We do not sell personal data in exchange for money.

Our Supplier is not permitted to use personal data received from us for unrelated advertising or unrelated commercial communications.

10. International Data Transfers

The Company, Supplier, Payment Processors, Steam systems, and technical providers may operate in different countries.

As a result, personal data may be processed or stored outside your country of residence.

Where required by applicable law, we use recognised safeguards, which may include:

• adequacy decisions;

• approved standard contractual clauses;

• the UK International Data Transfer Agreement;

• the UK Addendum to EU standard contractual clauses; or

• another lawful transfer mechanism.

You may contact Customer support for more information about the safeguards used for international transfers.

11. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy and to meet legal, accounting, security, fraud-prevention, and dispute-resolution requirements.

When deciding how long to retain data, we consider:

• the type and sensitivity of the data;

• how long the Account remains active;

• applicable legal requirements;

• tax and accounting obligations;

• outstanding Orders, refunds, or chargebacks;

• fraud and security risks; and

• applicable limitation periods.

In general:

• Account information may be kept while the Account is active and for a reasonable period after closure;

• payment, Top-up, Balance, Order, and refund records may be retained as required by tax, accounting, and consumer laws;

• fraud, chargeback, and security records may be retained to prevent repeated abuse;

• support communications may be retained for dispute, security, and service purposes; and

• verification documents will be retained only for as long as reasonably necessary.

When data is no longer required, we may delete, anonymise, or securely isolate it.

12. Data Security

We use reasonable technical and organisational measures designed to protect personal data against:

• unauthorised access;

• accidental loss;

• unlawful disclosure;

• alteration;

• destruction; and

• misuse.

These measures may include:

• access controls;

• authentication systems;

• logging and monitoring;

• secure communications;

• fraud-detection systems;

• restricted provider access; and

• incident-response procedures.

No online system can be guaranteed to be completely secure.

You are responsible for keeping your password confidential and securing the email and Steam Accounts connected to Bravopoint.

Contact Customer support immediately if you suspect unauthorised access to your Account.

13. Cookies and Similar Technologies

The Platform may use cookies, local storage, pixels, scripts, and similar technologies.

13.1 Strictly Necessary Technologies

These technologies may be used to:

• operate the Website;

• maintain login sessions;

• authenticate users;

• secure Accounts;

• prevent fraud;

• provide checkout and Balance functionality; and

• remember privacy choices.

These technologies may be used without consent where they are necessary to provide the requested service.

13.2 Preference Technologies

Preference technologies may remember choices such as language, currency display, regional settings, and interface preferences.

Where required by law, they will be used only after consent is provided.

13.3 Analytics and Performance Technologies

Where implemented, these technologies may help us understand:

• Website traffic;

• frequently used functions;

• technical errors;

• performance issues; and

• general navigation patterns.

Where consent is required, non-essential analytics technologies will not be activated until consent is provided.

13.4 Cookie Controls

You may manage cookie choices through:

• the Platform’s cookie banner or settings tool; and

• your browser settings.

Disabling certain technologies may affect some Platform features.

14. Fraud and Risk Assessment

We may use automated systems to analyse Account, payment, technical, Steam, and transaction information for fraud, security, and compliance purposes.

These systems may:

• identify unusual activity;

• calculate risk indicators;

• flag a payment or Order for review;

• request additional verification;

• delay a transaction;

• restrict affected BC; or

• prevent a suspected fraudulent transaction.

Automated indicators may be reviewed manually.

Where applicable law gives you rights concerning an automated decision that has a significant effect, you may request information, human review, and an opportunity to challenge the decision.

15. Your Data Protection Rights

Depending on your location and applicable law, you may have the following rights.

15.1 Access

You may request confirmation of whether we process your personal data and ask for a copy.

15.2 Correction

You may ask us to correct inaccurate or incomplete personal data.

15.3 Deletion

You may ask us to delete personal data where the law allows.

We may retain data where necessary to comply with legal obligations, prevent fraud, resolve disputes, manage chargebacks, or protect legal rights.

15.4 Restriction

You may ask us to restrict processing in circumstances provided by law.

15.5 Data Portability

Where applicable, you may request certain personal data in a structured, commonly used, and machine-readable format.

15.6 Objection

You may object to processing based on legitimate interests.

We may continue processing where we have compelling lawful grounds or where the data is required for legal claims.

15.7 Withdrawal of Consent

Where processing is based on consent, you may withdraw consent at any time.

15.8 Automated Decisions

Where applicable, you may have rights concerning decisions based solely on automated processing.

15.9 Complaint to an Authority

You may complain to the data protection authority responsible for your country or region.

We encourage you to contact us first so that we can review your concern.

16. Exercising Your Rights

To exercise a data protection right, contact helpme@bravopoint.gg.

Please provide enough information for us to understand your request.

We may ask you to verify your identity before responding. This helps prevent personal data from being disclosed, changed, or deleted at the request of an unauthorised person.

Where permitted by law, we may request additional information, extend the response period for complex requests, or decline requests that are clearly unfounded or excessive.

17. Account Closure

You may request closure of your Account by contacting Customer support.

Closing an Account does not necessarily result in the immediate deletion of all associated personal data.

We may retain information where necessary to:

• complete or cancel pending Orders;

• resolve Balance issues;

• process refunds;

• manage chargebacks;

• investigate fraud or security incidents;

• comply with tax and accounting obligations; or

• establish, exercise, or defend legal claims.

Unused BC and Balance records are handled in accordance with our Terms & Conditions, Refund Info, and applicable law.

18. Children and Age Restrictions

The Platform is intended only for persons who:

• are at least 18 years old; and

• have reached the legal age required to enter into a binding contract in their jurisdiction.

We do not knowingly permit ineligible minors to create or use an Account.

If we reasonably believe that an Account belongs to an ineligible minor, we may restrict or close the Account and take reasonable steps concerning the associated personal data.

19. Third-Party Services

The Platform may interact with third-party services, including:

• Steam;

• Payment Processors;

• banks and card issuers;

• game publishers;

• our Supplier; and

• technical or verification providers.

These third parties may independently process personal data under their own privacy policies.

We do not control their privacy practices, security measures, or content.

20. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to:

• the Platform;

• BC or payment functionality;

• our Supplier or service providers;

• Steam functionality;

• security and fraud-prevention practices;

• applicable laws; or

• our data-processing activities.

The updated Privacy Policy will display a revised “Last Updated” date.

Where a change is material, we may provide additional notice through the Platform, by email, or by another appropriate method.