Privacy Policy

Last updated: 28 September 2026

1. Introduction

Welcome to PatternPeak.

This Privacy Policy explains how PRISMPALETTE GRAPHICS LTD ("PatternPeak", the "Company", "we", "us" or "our") collects, uses, stores, shares and safeguards personal data when you visit or use the PatternPeak store, website and related services available at patternpeak.com (the "Website" or the "Services").

We are committed to protecting your privacy and to processing personal data lawfully, fairly and transparently. This Privacy Policy has been prepared in accordance with applicable data protection law, including the United Kingdom General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other relevant privacy legislation.

The Website is an online store where users can buy virtual in-game items from the Company and receive them on their Steam accounts. To provide the Services, we need to collect and process certain information about users, orders, devices and the way people interact with the Website.

This Privacy Policy describes what information we collect, how we use it, the legal bases we rely on, when we share it, how long we retain it and what rights you have in relation to your personal data.

By visiting or using the Website and the Services, you confirm that you have read and understood this Privacy Policy. If you do not agree with any part of it, you should stop using the Website and the Services.

Nothing in this Privacy Policy limits any rights you have under applicable data protection law.

2. Scope of this Privacy Policy

This Privacy Policy applies to all personal data processed by PRISMPALETTE GRAPHICS LTD in connection with operating the Website and providing the Services.

It governs how personal data is collected, used, stored, disclosed, transferred and protected when you use the Website, interact with the Services, contact our support team, place orders on the Website or otherwise deal with us in relation to the Services.

It applies to all users of the Website, including registered users, customers, visitors and any other person who interacts with the Services.

This Privacy Policy applies only to information processed by the Company in connection with the Website and the Services. It does not apply to third-party websites, services, applications, payment providers, Steam, Valve Corporation, social media platforms or other external services that may be linked to or integrated with the Website. Those third parties operate under their own privacy policies and terms, which we encourage you to review before providing them with any personal information.

Where we rely on third-party services for sign-in, payment processing, security monitoring, fraud prevention, analytics, customer support or the delivery of purchased items, those providers may process personal data in accordance with their own privacy practices and applicable legal requirements.

If this Privacy Policy conflicts with any mandatory provision of applicable data protection law, the law will prevail to the extent necessary.

3. Data Controller

For the purposes of applicable data protection law, including the UK General Data Protection Regulation and the Data Protection Act 2018, the controller of personal data collected through the Website and the Services is:

PRISMPALETTE GRAPHICS LTD

Company number: 16984583

Registered office: Level One, Basecamp, 49, Jamaica Street, Liverpool, England, L1 0AH

Email: support@patternpeak.com

Phone: +447407092159

The Company determines the purposes and means of processing personal data in connection with operating the Website and providing the Services.

If you have any questions about this Privacy Policy, how we process your personal data, how to exercise your privacy rights or any other privacy-related matter, please contact us using the details above.

We will make reasonable efforts to respond to privacy requests and enquiries within the timeframes required by applicable law.

4. Categories of Personal Data We Collect

Depending on how you use the Website, we may collect and process the following categories of personal data in connection with operating the Website and providing the Services.

Account Information may include your Steam account identifier, SteamID, Steam Trade URL, username, profile details made available through Steam sign-in, account preferences and other information associated with your use of the Services.

Order Information may include records of purchases, balance top-ups, deliveries, the virtual items concerned, prices paid, timestamps, your top-up balance, order history and any other information required to process and record your orders.

Payment Information may include payment-related data required to process payments. Card details are handled by authorised third-party payment service providers. We do not knowingly store full card numbers, CVV codes or other sensitive payment credentials.

Communication Information may include messages sent to customer support, dispute submissions, reports, complaints, feedback, enquiries, survey responses and any other correspondence with the Company.

Technical Information may include your IP address, device identifiers, browser type, operating system, language settings, access times, referring URLs, session data, security logs and other technical data generated when you use the Website.

Usage Information may include information about your activity on the Website, such as pages visited, features used, purchasing behaviour, interactions with Website functions and other details about how you use the Services.

Verification and Compliance Information may include information provided for identity verification, fraud prevention, account security, dispute resolution, compliance reviews, sanctions screening or other risk management purposes where verification is required.

Cookies and Similar Technologies may collect information about your interactions with the Website, your preferences, your device characteristics, your session activity and analytics information, as described in the Cookies section of this Privacy Policy.

We do not knowingly collect special categories of personal data, such as information revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data used for identification, health, sex life or sexual orientation, unless required by law or you choose to provide it in connection with a specific request.

You are responsible for ensuring that any information you provide to us is accurate, complete and kept up to date.

5. Sources of Personal Data

We obtain personal data from various sources, depending on how you use the Website and the Services.

We collect information directly from you when you visit the Website, create an account, sign in with Steam, place orders, contact customer support, submit requests or otherwise provide information to us.

We receive certain information from Steam and related services when you choose to sign in with or connect your Steam account to the Website. This is limited to the data Steam makes available and that you authorise during the sign-in process.

We collect order information when you buy items, top up your balance, receive purchased items or otherwise use the purchasing features available through the Services.

We automatically collect certain technical and usage information when you visit the Website. This may be collected through server logs, cookies, analytics tools, security tools and similar technologies that support the operation, security and improvement of the Services.

We may receive information from payment service providers, fraud prevention providers, identity verification providers, analytics providers, hosting providers, customer support providers and other service providers that help us operate the Website. We collect such information only to the extent necessary to provide the Services, monitor security, meet compliance obligations, prevent fraud, process payments and orders or satisfy legal requirements.

We may also collect information when you contact us by email, through support channels, contact forms, social media accounts or any other communication channel we make available.

In certain cases, we may obtain information from publicly available sources, regulatory databases, sanctions lists, fraud prevention databases or other legitimate sources where necessary to protect the Website, comply with the law, prevent fraud, investigate misuse of the Services or enforce our contractual rights.

We collect and process personal data only where we have a lawful basis for doing so under applicable data protection law.

6. Purposes of Processing

We process personal data only where necessary to operate the Website, provide the Services, comply with the law, protect legitimate business interests or for another lawful purpose.

We may use personal data to create and manage user accounts, authenticate users, connect Steam accounts, keep accounts secure and provide access to the features of the Website.

We use personal data to process your orders, deliver purchased virtual items to your Steam account, operate your top-up balance and maintain a record of your purchases.

We may use personal data to process payments, verify orders, maintain order records, prevent payment abuse, investigate suspicious activity and support financial reconciliation.

We use personal data to detect, prevent, investigate and mitigate fraud, unauthorised access, account misuse, security incidents, breaches of our Terms of Service and other activity that may threaten the integrity of the Website or its users.

We may use personal data to provide customer support, respond to enquiries, investigate complaints, resolve disputes, enforce contractual rights and communicate with users about their accounts, orders or use of the Services.

We may use personal data to improve the functionality, performance and security of the Website, develop new features, conduct internal analytics, monitor Website activity and better understand how users interact with the Services.

Where permitted by law, we may use personal data to send operational notices, service messages, security alerts, order updates, notices of policy changes and other information required to administer the Website.

We may process personal data to comply with legal obligations, regulatory requirements, court orders, lawful requests from public authorities, sanctions requirements, fraud prevention obligations and other applicable legal or regulatory duties.

We may also process personal data to establish, exercise or defend legal claims, to protect the rights, property and safety of the Company, its users, business partners or others, and to maintain the security and reliability of the Services.

We do not sell personal data to third parties and do not use it for unrelated purposes incompatible with those described in this Privacy Policy.

7. Lawful Bases for Processing

We process personal data only where applicable data protection law provides a lawful basis for doing so.

We process personal data where necessary to perform our contract with you, or to take steps at your request before entering into a contract. This includes creating and managing your account, providing access to the Website, supporting Steam sign-in, processing and delivering your orders, maintaining your order history and providing customer support.

We process personal data where necessary to comply with legal obligations applicable to the Company. These may include obligations relating to accounting, tax records, fraud prevention, sanctions, consumer protection, dispute handling, regulatory requests, court orders and lawful requests from public authorities.

We process personal data where necessary for our legitimate interests or those of third parties, provided those interests are not overridden by your rights and freedoms. Such interests may include protecting the Website against fraud and abuse, maintaining security, preventing unauthorised access, resolving disputes, enforcing our Terms of Service, improving the Services, analysing Website performance and protecting the rights and property of the Company, its users and business partners.

Where required by law, we may process personal data on the basis of your consent. This may apply to certain cookies, optional marketing communications or specific processing activities for which consent is legally required. You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

In limited circumstances, we may process personal data where necessary to establish, exercise or defend legal claims, or to protect the vital interests of an individual.

Where more than one lawful basis may apply to a processing activity, the Company will rely on the basis that best reflects the purpose, nature and legal context of that processing.

8. Steam Account and Delivery Data

The Website is integrated with Steam and related services to allow users to sign in and receive the virtual items they buy.

When you choose to sign in with Steam, we may receive and process information made available by Steam, including your SteamID, Steam profile name, profile URL, avatar, Steam Trade URL, account status information and other data required to operate the Services.

The Company does not control the information made available by Steam and is not responsible for the privacy practices of Steam or Valve Corporation. We recommend that you review the privacy documentation published by Steam and Valve Corporation before using features that rely on Steam.

We use Steam-related information to authenticate users, connect Steam accounts to the Website, send trade offers for purchased items, check whether your Steam account is able to receive items, maintain delivery records, prevent fraud, detect suspicious activity, resolve disputes and keep the Website secure.

The Company may process information about the virtual items delivered to your account, including item identifiers, trade offer records, delivery status, trade hold status and any other information required to complete and verify deliveries.

Steam-related information may also be used for security purposes, such as detecting attempted unauthorised access, fraudulent orders, account abuse, attempts to circumvent Website restrictions or breaches of applicable terms and policies.

You remain responsible for keeping your Steam account, login credentials, authentication methods and Steam Trade URL secure. The Company is not responsible for losses arising from unauthorised access to your Steam account, compromised credentials, actions taken through your Steam account or failures in systems controlled by Steam.

The Company may suspend, restrict, review or terminate access to Steam-related features where necessary to protect the security, integrity or lawful operation of the Website, to comply with legal obligations, to investigate suspicious activity or to enforce its contractual rights.

We retain Steam-related information only for as long as necessary to provide the Services, maintain order and delivery records, meet legal obligations, resolve disputes, prevent fraud and protect the legitimate interests of the Company and its users.

9. Payment Data

The Company may process certain payment-related information in connection with purchases made through the Website.

Payments on the Website are processed by authorised third-party payment service providers. The Company is not a bank, payment institution, electronic money institution, money remittance provider, custodian or financial institution.

When you buy items or top up your balance on the Website, payment service providers may collect and process the payment information needed to complete the payment. This may include payment method details, transaction identifiers, payment status, billing information and other data required for payment processing.

The Company does not knowingly store full card numbers, card verification values (CVV), PIN codes or other sensitive payment authentication data. Card details are processed directly by the relevant payment service providers in accordance with their own privacy policies, security standards and regulatory obligations.

The Company may receive limited payment information from payment service providers, such as transaction identifiers, payment status updates, payment amounts, currencies, timestamps, chargeback notifications, refund information, fraud alerts and other information needed to operate the Services and maintain order records.

We may use payment-related information for payment processing, fraud prevention, risk management, dispute resolution, customer support, accounting, financial reporting, regulatory compliance and the enforcement of contractual rights.

Where necessary, payment-related information may be shared with payment service providers, fraud prevention providers, financial institutions, legal advisers, regulators, law enforcement authorities or other authorised parties where required by law, contractual obligations, legitimate interests or the protection of the Website and its users.

You acknowledge that payments may be subject to additional terms, conditions, privacy policies and compliance requirements imposed by the relevant payment service providers.

The Company retains payment-related records only for as long as necessary to meet contractual obligations, comply with legal and regulatory requirements, maintain accounting records, resolve disputes, prevent fraud and protect its legitimate interests.

10. Disclosure of Personal Data

The Company shares personal data with third parties only where necessary to operate the Website, provide the Services, comply with legal obligations, protect legitimate interests or for another lawful purpose.

We may share personal data with service providers that support the operation of the Website, including hosting providers, cloud infrastructure providers, payment service providers, fraud prevention providers, analytics providers, customer support providers, security providers, identity verification providers and other technology partners engaged by the Company.

We may share personal data with Steam, Valve Corporation or other third-party platforms where necessary for sign-in, the delivery of purchased items, account verification, dispute resolution, fraud prevention or other features related to the Services.

The Company may disclose personal data where required to comply with applicable laws, regulations, court orders, legal proceedings, regulatory requests, law enforcement requests, sanctions obligations or other lawful requirements of competent authorities.

We may share personal data where necessary to establish, exercise or defend legal claims, investigate suspected unlawful activity, prevent fraud, enforce contractual rights, protect the security of the Website or safeguard the rights, property or safety of the Company, its users, business partners or others.

In the event of a merger, acquisition, restructuring, sale of assets, financing, corporate reorganisation or similar transaction, personal data may be transferred to the parties involved, subject to appropriate confidentiality and data protection safeguards.

The Company does not sell personal data to third parties and does not disclose it to third parties for their own marketing purposes.

We require every third party receiving personal data to process it only to the extent necessary for the relevant purpose and in accordance with applicable data protection law, contractual obligations and appropriate security requirements.

Where required by law, the Company will implement appropriate safeguards before transferring personal data to third parties and will take reasonable steps to keep it protected throughout its processing.

11. International Data Transfers

The Company may transfer, store, access or process personal data in countries outside the United Kingdom and the European Economic Area where necessary to operate the Website, provide the Services, use third-party service providers or for other legitimate business purposes.

Given the international nature of the Services, personal data may be processed by service providers, technology partners, hosting providers, payment service providers, fraud prevention providers, analytics providers, customer support providers and other authorised partners located in different jurisdictions.

Where personal data is transferred to a country that does not provide an equivalent level of data protection under applicable law, the Company will take reasonable steps to implement appropriate safeguards. These may include contractual protections, standard contractual clauses, adequacy decisions, binding corporate rules or other transfer mechanisms recognised by applicable data protection law.

The Company will take reasonable measures to ensure that recipients of personal data maintain appropriate technical, organisational and security measures to protect it against unauthorised access, disclosure, alteration, loss, misuse or unlawful processing.

You acknowledge that certain third-party providers integrated with the Website may process personal data in multiple jurisdictions as part of their global infrastructure and operations. Such processing remains subject to the privacy policies, contractual commitments and legal obligations applicable to those providers.

Where required by law, you may request further information about the safeguards used for international transfers of personal data by contacting the Company using the details in this Privacy Policy.

12. Data Retention

The Company retains personal data only for as long as necessary to fulfil the purposes for which it was collected, provide the Services, comply with legal obligations, resolve disputes, enforce contractual rights, prevent fraud and protect the legitimate interests of the Company and its users.

The retention period for personal data depends on the type of information, the purpose of processing, legal requirements, operational needs and the risks associated with the processing.

Account information may be retained for as long as you maintain an active account and for a reasonable period afterwards where necessary for security, fraud prevention, dispute resolution, legal compliance or record-keeping.

Order records, payment-related information, delivery records, communications and other business records may be retained for longer where required by applicable accounting, tax, regulatory, anti-fraud, legal or contractual obligations.

Technical logs, security records and monitoring information may be retained for as long as reasonably necessary to maintain the security, integrity and reliability of the Website and the Services, investigate incidents, prevent abuse and enforce Website rules.

When personal data is no longer required for the purposes for which it was collected, the Company will take reasonable steps to securely delete it, anonymise it or otherwise ensure that it can no longer identify any individual, unless applicable law requires or permits its retention.

In certain circumstances, the Company may retain personal data for longer where necessary to establish, exercise or defend legal claims, comply with regulatory requirements, investigate fraud, respond to lawful requests from competent authorities or protect the rights, property and safety of the Company, its users or others.

Backup copies of personal data may remain in secure backup systems for a limited period after deletion from live systems where necessary for disaster recovery, business continuity, security or operational purposes. Such backups remain subject to appropriate security measures and access controls.

At the end of the applicable retention period, personal data will be securely deleted, anonymised or otherwise disposed of in accordance with the Company's internal procedures and applicable legal requirements.

13. Cookies and Similar Technologies

The Website uses cookies, similar tracking technologies and related tools to support its functionality, improve performance, enhance security, analyse usage and provide a better user experience.

Cookies are small text files placed on your device when you visit a website. They enable the Website to recognise your device, remember your preferences, keep you signed in, improve functionality and collect information about how the Website is used.

The Company uses the following categories of cookies and tracking technologies.

Strictly Necessary Cookies are essential for the operation of the Website. They enable core functions such as sign-in, account access, security controls, session management, fraud prevention and the proper functioning of the checkout and delivery features. These cookies generally cannot be disabled, as the Website may not function properly without them.

Performance and Analytics Cookies help us understand how visitors use the Website by collecting information about page visits, navigation, user interactions, technical performance and system errors. This information is generally aggregated and used to improve the Website and the Services.

Functionality Cookies allow the Website to remember your preferences and settings, such as language, interface customisation, account settings and other options you select to enhance your browsing experience.

Security and Fraud Prevention Cookies help identify suspicious activity, prevent unauthorised access, detect abuse, support risk management and protect the security and integrity of the Website and its users.

The Company may use third-party analytics, security, performance monitoring, hosting and technology providers that use cookies or similar technologies in connection with the Website. These providers may collect information such as device characteristics, browser details, IP address, session identifiers, usage patterns and technical performance data.

You can manage, restrict or block cookies through your browser settings. However, blocking certain cookies may affect the availability, functionality, performance or security of the Website and may prevent some Services from working properly.

Where required by applicable law, the Company will obtain your consent before placing non-essential cookies on your device. You may withdraw or change your cookie preferences at any time through the available consent tools or your browser settings.

The Company may update its use of cookies and tracking technologies from time to time to reflect operational, technical, legal or regulatory changes. Any material changes will be reflected in this Privacy Policy or communicated through other appropriate notices on the Website.

14. Data Security

The Company is committed to protecting personal data and maintaining appropriate security measures to safeguard it against unauthorised access, disclosure, alteration, loss, misuse, destruction or other unlawful processing.

We implement reasonable technical, organisational and administrative safeguards appropriate to the nature of the personal data we process, the associated risks and the operational requirements of the Website.

These measures may include access controls, authentication procedures, encryption, network protection, security monitoring, logging and audit controls, vulnerability management, backup procedures and other measures designed to protect the confidentiality, integrity and availability of information.

Access to personal data is restricted to authorised personnel, contractors, service providers and business partners who require it for legitimate business purposes and who are bound by appropriate confidentiality obligations.

The Company regularly reviews its security practices and may update its technical and organisational measures in response to emerging security risks, technological developments, operational needs and legal obligations.

Where third-party service providers process personal data on behalf of the Company, reasonable steps are taken to ensure that they maintain appropriate security standards and implement suitable protective measures.

Despite these safeguards, no method of electronic transmission, storage or processing can be guaranteed to be completely secure. Accordingly, while the Company takes reasonable steps to protect personal data, it cannot guarantee the absolute security of information transmitted to, from or through the Website.

You are responsible for keeping your account credentials confidential, protecting access to your devices, safeguarding your Steam account credentials and taking reasonable steps to prevent unauthorised access to your accounts.

If the Company becomes aware of a security incident affecting personal data, it will take appropriate steps to investigate it, mitigate any risks, comply with its legal obligations and, where required by law, notify the affected individuals and the relevant authorities.

15. Your Data Protection Rights

Subject to applicable data protection law, you may have certain rights in relation to the personal data processed by the Company.

You have the right to request access to the personal data the Company holds about you and to receive information about how it is processed.

You have the right to request the correction of inaccurate or incomplete personal data where the information we hold is incorrect, outdated or incomplete.

You have the right to request the deletion of your personal data where there is no lawful reason for us to continue processing it, subject to applicable legal, regulatory, contractual, security, fraud prevention, record-keeping or dispute resolution requirements.

You have the right to request the restriction of processing of your personal data in certain circumstances, for example where you contest its accuracy or where the processing is unlawful.

You have the right to receive the personal data you have provided to the Company in a structured, commonly used and machine-readable format, where required by applicable law and technically feasible.

You have the right to object to the processing of your personal data where it is based on legitimate interests and your particular situation justifies the objection.

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you, except where permitted by applicable law.

You also have the right to lodge a complaint with the relevant data protection supervisory authority if you believe your personal data has been processed in breach of applicable data protection law. In the United Kingdom, this is the Information Commissioner's Office (ICO).

The Company may request reasonable information to verify your identity before responding to a privacy request. This helps protect personal data and prevent its disclosure to unauthorised persons.

You may submit requests relating to your privacy rights using the contact details in this Privacy Policy. The Company will respond within the timeframes required by applicable law.

16. Children's Privacy

The Website and the Services are intended solely for individuals who are at least eighteen (18) years old or who have otherwise reached the age of legal majority in their jurisdiction.

The Company does not knowingly collect, request, process or store personal data from children or from any person who is not legally permitted to use the Services under applicable law.

By visiting or using the Website, you confirm that you meet the minimum age requirements for the Services and have the legal capacity to enter into binding agreements.

If the Company becomes aware that it has collected personal data from a person who does not meet the age requirements, it may take appropriate measures, including restricting access to the Services, suspending or closing the relevant account and deleting the related personal data where required by applicable law.

Parents, guardians or any other person who believes that a child has provided personal data to the Company may contact us using the details in this Privacy Policy. Following verification, and where required by law, the Company will take reasonable steps to investigate the matter and deal with the relevant personal data.

The Company does not knowingly use personal data relating to children for marketing, profiling, behavioural analysis or similar activities.

17. Updates to this Privacy Policy

The Company may amend, update, modify or replace this Privacy Policy from time to time to reflect changes in applicable law, regulatory requirements, business operations, technology, security practices, services or other operational developments.

Any updated version of this Privacy Policy will take effect upon publication on the Website, unless a different effective date is specified.

Where required by applicable law, or where material changes significantly affect how personal data is processed, the Company may provide additional notice through the Website, your account, email or other appropriate channels.

We encourage you to review this Privacy Policy periodically to stay informed about how personal data is collected, used, shared, protected and otherwise processed.

Your continued access to or use of the Website after an updated Privacy Policy has been published will be treated as acknowledgement of the revised version to the extent permitted by applicable law.

If any provision of this Privacy Policy is found to be invalid, unlawful or unenforceable, the remaining provisions will continue in full force and effect.

18. Contact Details

If you have any questions about this Privacy Policy, the processing of your personal data, your privacy rights or any other privacy-related matter, please contact the Company using the details below.

Operator: PRISMPALETTE GRAPHICS LTD

Company number: 16984583

Registered office: Level One, Basecamp, 49, Jamaica Street, Liverpool, England, L1 0AH

Email: support@patternpeak.com

Phone: +447407092159

The Company will make reasonable efforts to review and respond to privacy enquiries within a reasonable timeframe and in accordance with applicable legal requirements.

Where permitted by law, the Company may request additional information to verify the identity of the person making a privacy request before taking any action regarding personal data.

This Privacy Policy constitutes the complete privacy notice governing the processing of personal data through the Website and the Services, unless supplemented by additional notices, disclosures or policies that the Company makes available from time to time.