Personal Data Protection, Processing, and Privacy Policy

Our Company strictly adheres to the fundamental data protection principles set out in Article 5 of the GDPR:

• Lawfulness, fairness, and transparency: Data is processed lawfully, fairly, and in a transparent manner in relation to the data subject.
• Purpose limitation: Collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes.
• Data minimisation: Adequate, relevant, and limited to what is strictly necessary in relation to the purposes for which they are processed.
• Accuracy: Accurate and, where necessary, kept up to date.
• Storage limitation: Kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
• Integrity and confidentiality: Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss.

When you register, list digital goods for sale, purchase digital game keys or software licenses, or interact with our platform, we collect and process the following categories of data:

• Identity and Profile Data: Full name, username, date of birth, nationality, national ID / passport number, and hashed authentication credentials.
• Contact Data: Verified email address, phone number (used for optional two-factor SMS authentication), and billing details.
• P2P Marketplace & Transaction Data: Listed digital codes, order histories, key delivery timestamps, escrow balances, and user feedback ratings.
• Financial & Payout Data: Payment gateway transaction reference tokens, seller bank account details (IBAN, account holder name), account balances, and invoice records. (Note: Full payment card numbers and CVV security codes are never stored on our servers; they are tokenized directly by PCI-DSS Level 1 certified licensed payment gateways.)
• Technical, Device, and Network Data: Static and dynamic IP address, port details, Internet Service Provider (ISP), User-Agent string, browser specifications, operating system, and session cookies.
• Customer Support & Dispute Records: Support tickets, dispute inquiries, and user-provided verification attachments or screenshots.

Digital software licenses, game activation keys, and gift cards represent intangible digital goods that are delivered instantaneously and cannot be physically reclaimed once redeemed. To prevent fraudulent chargebacks, stolen credit card abuse (carding), identity theft, and synthetic bot accounts, our platform mandates Biometric Identity Verification (KYC).

4.1. Accredited Independent Verification Providers

Identity verification procedures are conducted via independent, accredited verification and anti-fraud infrastructure providers possessing international security certifications (ISO/IEC 27001, SOC 2 Type II).

4.2. Scope of Verification and Biometric Data

• Government-Issued ID Optical Recognition (OCR): Verification of front and rear scans of National ID Cards, Driver's Licenses, or Passports, including security hologram and MRZ zone validation.
• Facial Liveness & 3D Geometry Detection: Real-time biometric camera evaluation determining 3D facial depth to prevent spoofing, pre-recorded video injection, printed photos, silicone masks, or synthetic deepfake attacks.
• Hardware & Virtual Camera Inspection: Detection of virtual webcam software, emulators, or hooking scripts at the hardware sensor layer.
• Sanctions and PEP Screening: Automated cross-referencing against global Politically Exposed Persons (PEP) and anti-money laundering (AML) watchlists.

4.3. Biometric Safeguards and Explicit Consent

Biometric facial geometry records are never stored in raw unencrypted image format on Grapsyh web servers. Data is processed in cryptographic hash representations within accredited secure environments. Prior to verification, explicit consent is obtained from the user. Without completing verification, users cannot create P2P sales listings or execute marketplace withdrawals.

Your personal data is processed pursuant to Article 6 and Article 9 of the GDPR on the following legal bases:

• Performance of a Contract (GDPR Art. 6(1)(b)): Account management, processing P2P transactions, escrow execution, and digital key delivery.
• Compliance with Legal Obligations (GDPR Art. 6(1)(c)): Commercial tax accounting, invoice issuance, and consumer protection records.
• Legitimate Interests (GDPR Art. 6(1)(f)): Protecting our platform and legitimate merchants against fraudulent payment methods, account takeovers, and cybersecurity attacks.
• Explicit Consent (GDPR Art. 9(2)(a)): Provided voluntarily by the user prior to capturing facial biometric liveness scans.

Grapsyh operates as a peer-to-peer marketplace connecting independent buyers and sellers. An automated escrow protocol protects both parties:

• Buyers and sellers never view each other's payment cards, government ID numbers, or physical addresses; only system usernames are visible.
• Sellers are only permitted to publish listings after successfully passing biometric identity verification (KYC).
• Funds remain frozen in our secure escrow pool until the buyer validates the software key activation or the dispute window elapses.

We do not sell or monetize personal data under any circumstances. Personal data is shared strictly on a need-to-know basis with:

• Accredited Identity & Anti-Fraud Providers: For processing document OCR and facial liveness verification.
• Licensed Payment Institutions: For executing credit card transactions and seller payouts under PCI-DSS standards.
• Cloud Infrastructure & CDN Vendors: To ensure high-availability hosting, encrypted storage, and DDoS mitigation.
• Judicial & Law Enforcement Authorities: When formally required under subpoena, court order, or applicable statutory mandates.

Our hosting infrastructure, content delivery networks (CDN), and identity verification data centers are hosted within the European Union (EU) and the United Kingdom (UK).

Any cross-border data transfers outside the European Economic Area are safeguarded in full compliance with Article 46 of the GDPR via European Commission approved Standard Contractual Clauses (SCCs) and robust encryption controls.

Personal data is retained only for the duration required by applicable statutory limitation periods or processing purposes:

• Accounting & Tax Records: 10 years pursuant to statutory tax and commercial codes.
• Network Access & IP Logs: 2 years for telecommunications and security compliance.
• Identity Verification Records: For the active duration of the account plus 3 years following closure to defend against potential fraud claims.
• Customer Support Records: 3 years following inquiry closure.

Upon expiration of retention periods, records are permanently deleted, overwritten, or irreversibly anonymized.

We implement industry-grade technical and organizational safeguards to protect data:

• All web traffic is encrypted using 256-bit TLS 1.3 transport security.
• Verification API tokens utilize timestamped HMAC-SHA256 cryptographic signatures.
• Web Application Firewalls (WAF) and automated rate limiting mitigate brute-force and DDoS attacks.
• Database access is enforced through strict role-based access controls (RBAC) and two-factor authentication.

Cookies are utilized to deliver essential functionality and ensure secure user sessions:

• Strictly Necessary Cookies: Essential for session authentication, CSRF security, and shopping basket management.
• Functional Cookies: Retain UI preferences such as theme, filters, and language selections.
• Analytical Cookies: Collect aggregated, anonymous metrics regarding page latency and error logs.

Users may modify cookie preferences or delete cookies at any time through their browser settings.

We do not send unsolicited marketing communications. Promotional newsletters are transmitted solely to users who have explicitly opted in.

Users can unsubscribe at any time via their profile preferences or by clicking the one-click “Unsubscribe” link in any newsletter.

Under the GDPR, data subjects have the right to:

• Right of Access (Art. 15): Request confirmation and copies of your personal data.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete information.
• Right to Erasure (Art. 17): Request deletion of your data (“Right to be Forgotten”), subject to legal retention obligations.
• Right to Restriction (Art. 18): Request restricted processing under certain conditions.
• Right to Data Portability (Art. 20): Receive your personal data in a structured, machine-readable format.
• Right to Object (Art. 21): Object to processing based on legitimate interests.
• Automated Decisions (Art. 22): Request human review of automated decisions (e.g., identity verification reviews).

Our marketplace and digital transaction services are strictly designated for individuals aged 18 years or older possessing full legal contractual capacity.

If identity verification checks reveal an account holder is under 18, the account will be immediately suspended and all associated data handled in accordance with child protection mandates.

To exercise any statutory data protection rights or submit queries regarding this Policy, please email us from your registered account address at: iletisim@grapsyh.cyou.

Requests will be processed and answered free of charge within 30 (thirty) days.

If you believe your personal data is not processed lawfully, you retain the right to lodge a formal complaint with the competent Data Protection Authority (DPA) in your EU Member State or the Turkish Personal Data Protection Authority (KVKK).