Privacy Policy

This Privacy Policy explains how OGSTASH ("OGSTASH", "we", "us") collects, uses, shares and protects personal data when you visit or use our marketplace, website and related services (the "Platform"). We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and other applicable data protection laws.

By using the Platform you confirm that you have read this Policy. Where the law requires your consent for a specific activity, we will ask for it separately and you may withdraw it at any time.

The controller of the personal data processed through the Platform is Jakub Miechowicz, a sole proprietor trading as OGSTASH, with registered address at Pod Stawami 25, 26-026 Zaborze, Poland, NIP: 6572984779, REGON: 527347454. For any question about this Policy or about how we handle your data, contact us at contact@ogstash.net.

You also have the right to lodge a complaint with the supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl); you may also contact the authority of your habitual residence in the EU/EEA.

This Policy does not apply to websites or applications of third parties that we do not own or control, even if they link to us or use our logo.

Depending on how you use the Platform, we process the following categories of personal data:

• • Account data: e-mail address, user ID and sign-in information.
• • Order data: product purchased, order status and date, amount paid, payment session reference and the e-mail address used at checkout.
• • Delivery data: the account credentials and delivery notes made available to you on your order page.
• • Support data: messages you send us through the support chat, contact form or e-mail, and any details you provide so we can deliver or correct an order.
• • Seller application data: full name, date of birth, country of residence, optional Discord username and your answers about the accounts you want to sell and how you obtained them.
• • Technical data: IP address, device and browser type, language, pages viewed and similar log data, including data collected through cookies (see section 11).

We do not collect your full card number, card security code or bank login details. We do not intentionally collect special categories of personal data (such as health data or political opinions).

We process personal data only where we have a legal basis under Article 6 GDPR:

• • Contract (Art. 6(1)(b)): creating and managing your account, processing payments, delivering orders, providing customer support and handling seller applications and listings.
• • Legal obligation (Art. 6(1)(c)): accounting, tax and bookkeeping duties, and responding to requests from courts and authorities.
• • Legitimate interests (Art. 6(1)(f)): preventing fraud and abuse, verifying that sellers are at least 18 years old and own the accounts they sell, securing the Platform, handling disputes and chargebacks, and improving our services. You may object to processing based on legitimate interests (see section 10).
• • Consent (Art. 6(1)(a)): non-essential cookies and any optional communication that requires consent. You can withdraw consent at any time without affecting earlier processing.

Payments on the Platform are processed by an external third-party payment service provider, ZEN.com. When you pay, you are redirected to or served a payment form provided by ZEN.com, and your payment data (such as card details and information needed for authentication, including 3D Secure) is collected and processed directly by ZEN.com. OGSTASH does not receive, store or have access to your full card number or card security code.

ZEN.com processes this payment data under its own legal basis and privacy policy, acting as an independent controller for its payment services, fraud prevention and regulatory obligations. We encourage you to read the ZEN.com privacy policy before paying.

OGSTASH receives from ZEN.com only the information needed to complete and administer your order: the payment status, a transaction reference, the amount and the e-mail address used at checkout. We may exchange order and payment data with ZEN.com, banks and card schemes when needed to investigate fraud, respond to a payment dispute or chargeback, or comply with the law.

Card data is protected during the payment process with industry-standard encryption, and ZEN.com applies the Payment Card Industry Data Security Standard (PCI DSS) and strong customer authentication where required.

If you apply to become a seller, we use your full name, date of birth, country of residence and your answers about the accounts you wish to sell only to verify that you are at least 18 years old, to confirm your identity and the ownership of the accounts, to prevent fraud and to comply with the law.

We may ask for additional proof, such as a copy of a government ID. Such documents are deleted once verification is complete unless the law requires us to keep them. Seller application data is never shown publicly and is accessible only to OGSTASH staff who review applications. Rejected applications are deleted on request.

We do not sell your personal data. We share it only with:

• • ZEN.com, our external payment service provider, for payment processing (see section 5).
• • Service providers acting on our behalf (processors) for hosting, authentication and database storage, e-mail delivery and the customer support chat, bound by data processing agreements and only to the extent needed to operate the Platform.
• • Professional advisers, courts, law enforcement and other authorities where required by law or to establish, exercise or defend legal claims.
• • A successor entity, if OGSTASH is involved in a merger, acquisition or sale of assets, subject to this Policy.

Some of our service providers, including ZEN.com, may process data outside the European Economic Area (EEA). Where personal data is transferred to a country that does not offer an adequate level of protection recognised by the European Commission, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission and, where needed, supplementary measures. You can request information about the safeguards used by contacting contact@ogstash.net.

We keep personal data only for as long as needed for the purposes described in this Policy:

• • Account data: while your account is active and for a limited period afterwards, unless you ask us to delete it.
• • Order and payment records: for the period required by accounting and tax law, and as needed to handle disputes and chargebacks.
• • Support messages: for as long as needed to resolve your request and for a limited period afterwards for quality and dispute purposes.
• • Seller application data: while your seller account is active and for a limited period afterwards for fraud-prevention and legal purposes; identity documents are deleted after verification.

When data is no longer needed, we delete or anonymise it. Data we must retain by law is restricted to those purposes.

Under the GDPR you have the following rights, which you may exercise by writing to contact@ogstash.net:

• • Access (Art. 15): obtain confirmation of whether we process your data and receive a copy.
• • Rectification (Art. 16): correct inaccurate or incomplete data.
• • Erasure (Art. 17): ask us to delete your data, where no overriding reason to keep it applies.
• • Restriction (Art. 18): ask us to limit the processing of your data in certain cases.
• • Data portability (Art. 20): receive data you provided to us in a structured, commonly used, machine-readable format and have it transmitted to another controller.
• • Objection (Art. 21): object to processing based on our legitimate interests.
• • Withdrawal of consent (Art. 7(3)): withdraw any consent you have given, at any time.

We will respond within one month of receiving a valid request, and may ask you to verify your identity first. We may keep data that we must retain by law or need to handle a pending order or dispute.

You also have the right to lodge a complaint with the data protection supervisory authority in the EU/EEA country where you live, work or where you believe an infringement occurred. We would appreciate the chance to resolve your concern first, so please contact us at contact@ogstash.net.

Cookies are small text files stored on your device when you visit a website. We use strictly necessary cookies to keep the Platform working (for example to keep you signed in), and, where you agree, other cookies. Where required by law, we only use non-essential cookies after you give consent. For details about the cookies we use and how to manage them, see our Cookie Policy.

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration and disclosure, including encrypted connections (TLS), access controls limited to authorised staff and restricted server-side access to sensitive data such as seller application details. No online service can be completely secure, so we also encourage you to use a strong, unique password and to keep your account credentials confidential.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required, affected users, as set out in Articles 33 and 34 GDPR.

The Platform is not directed to children. You must be at least 18 years old to become a seller and to use the Platform where required by our Terms of Service. We do not knowingly collect personal data from persons under the applicable age. If you believe a minor has provided us with personal data, contact contact@ogstash.net and we will delete it.

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Payment fraud checks carried out by ZEN.com or your bank may use automated tools; you can contact them or us to request human review of such a decision.

The Platform may contain links to third-party websites. We are not responsible for their privacy practices, and your use of those sites is subject to their own policies.

OGSTASH never sends e-mails or messages requesting your card details, account passwords or other sensitive information. Please ignore any message that does so while using the OGSTASH name or logo, and report it to contact@ogstash.net.

We may update this Policy from time to time to reflect changes in our services or the law. The updated version takes effect when published on the Platform, and we will notify you of material changes where required. Please review this page periodically.

For questions, requests to exercise your rights or complaints about this Policy, write to contact@ogstash.net.