Privacy Policy

Valve respects the privacy of its online visitors and customers of its products and services and complies with applicable laws for the protection of your privacy, including, without limitation, the California Consumer Privacy Act ("CCPA"), the European Union General Data Protection Regulation ("GDPR") and the UK GDPR.

Valve and its subsidiary TR Technical Inc. comply with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Valve has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. Valve has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

1. Definitions

Wherever we talk about personal data ("Personal Data") below, we mean any information that can either itself identify you as an individual ("Personally Identifying Information") or that can be connected to you indirectly by linking it to Personally Identifying Information. Valve also processes anonymous data, aggregated or not, to analyze and produce statistics related to the habits, usage patterns, and demographics of customers as a group or as individuals. Such anonymous data does not allow the identification of the customers to which it relates. Valve may share anonymous data, aggregated or not, with third parties.

Other capitalized terms in this Privacy Policy shall have the meanings defined in the Steam Subscriber Agreement ("SSA").

2. Why Valve Collects and Processes Data

Valve collects and processes Personal Data for the following reasons:

a) where it is necessary for the performance of our agreement with you to provide a full-featured gaming service and deliver associated Content and Services;
b) where it is necessary for compliance with legal obligations that we are subject to (e.g. our obligations to keep certain information under tax laws);
c) where it is necessary for the purposes of the legitimate and legal interests of Valve or a third party (e.g. the interests of our other customers), except where such interests are overridden by your prevailing legitimate interests and rights; or
d) where you have given consent to it.

These reasons for collecting and processing Personal Data determine and limit what Personal Data we collect and how we use it (section 3. below), how long we store it (section 4. below), who has access to it (section 5. below) and what rights and other control mechanisms are available to you as a user (section 6. below).

3. The Types and Sources of Data We Collect

3.1 Basic Account Data
When setting up an Account, Valve will collect your email address and country of residence. You are also required to choose a user name and a password. The provision of this information is necessary to register a Steam User Account. During setup of your account, the account is automatically assigned a number (the "Steam ID") that is later used to reference your user account without directly exposing Personally Identifying Information about you.
We do not require you to provide or use your real name for the setup of a Steam User Account.

3.2 Transaction and Payment Data
In order to make a transaction on Steam (e.g. to purchase Subscriptions for Content and Services or to fund your Steam Wallet), you may need to provide payment data to Valve to enable the transaction. If you pay by credit card, you need to provide typical credit card information (name, address, credit card number, expiration date and security code) to Valve, which Valve will process and transmit to the payment service provider of your choice to enable the transaction and perform anti-fraud checks. Likewise, Valve will receive data from your payment service provider for the same reasons.

3.3 Other Data You Explicitly Submit
We will collect and process Personal Data whenever you explicitly provide it to us or send it as part of communication with others on Steam, e.g. in Steam Community Forums, chats, or when you provide feedback or other user generated content. This data includes:

• Information that you post, comment or follow in any of our Content and Services;
• Information sent through chat;
• Information you provide when you request information or support from us or purchase Content and Services from us, including information necessary to process your orders with the relevant payment merchant or, in case of physical goods, shipping providers;
• Information you provide to us when participating in competitions, contests and tournaments or responding to surveys, e.g. your contact details.

3.4 Your Use of the Steam Client and Websites
We collect a variety of information through your general interaction with the websites, Content and Services offered by Steam. Personal Data we collect may include, but is not limited to, browser and device information, data collected through automated electronic interactions and application usage data.
Likewise, we will track your process across our websites and applications to verify that you are not a bot and to optimize our services.

3.5 Your Use of Games and other Subscriptions
In order to provide you with services, we need to collect, store and use various information about your activity in our Content and Services. "Content-Related Information" includes your Steam ID, as well as what is usually referred to as "game statistics". By game statistics we mean information about your games' preferences, progress in the games, playtime, as well as information about the device you are using, including what operating system you are using, device settings, unique device identifiers, and crash data.

3.6 Tracking Data and Cookies
We use "Cookies", which are text files placed on your computer, and similar technologies (e.g. web beacons, pixels, ad tags and device identifiers) to help us analyze how users use our services, as well as to improve the services we are offering, to improve marketing, analytics or website functionality. The use of Cookies is standard on the internet. Although most web browsers automatically accept cookies, the decision of whether to accept or not is yours. You may adjust your browser settings to prevent the reception of cookies, or to provide notification whenever a cookie is sent to you.
You can manage the use of optional cookies by clicking on the "Cookies setting" page accessible via the cookie banner displayed when you first visit our website and at any time through the Cookie Settings page available here.
When you visit any of our services, our servers log your IP address, which is a number that is automatically assigned to the network your computer is part of.

3.7 Content Recommendations
We may process information collected under this section 3 so that content, products and services shown on the pages of the Steam store and in update messages displayed when launching the Steam Client can be tailored to meet your needs and populated with relevant recommendations and offers. This is done to improve your customer experience. You can prevent the processing of your data in this way by turning off the automatic loading of the Steam store page and of Steam notifications in the "Interface" section of the Steam Client settings.
Valve may send you marketing messages about products and services that are similar to goods and services you have previously requested from Valve to your email address or where you have given explicit consent. In such a case we may also use your collected information to customize such marketing messages as well as collect information on whether you opened such messages and which links in their text you followed.
You can opt out or withdraw your consent to receive marketing emails at any time by either withdrawing the consent on the same page where you previously provided it or clicking the "unsubscribe" link provided in every marketing email. Alternatively, you can select what kinds of emails you wish to receive on the email setting page.

3.8 Information Required to Detect Violations
We collect certain data that is required for our detection, investigation and prevention of fraud, cheating and other violations of the SSA and applicable laws ("Violations"). This data is used only for the purposes of detection, investigation, prevention and, where applicable, acting on of such Violations and stored only for the minimum amount of time needed for this purpose. If the data indicates that a Violation has occurred, we will further store the data for the establishment, exercise or defense of legal claims during the applicable statute of limitations or until a legal case related to it has been resolved. Please note that the specific data stored for this purpose may not be disclosed to you if the disclosure will compromise the mechanism through which we detect, investigate and prevent such Violations.

4. How Long We Store Data

We will only store your information as long as necessary to fulfil the purposes for which the information is collected and processed or — where the applicable law provides for longer storage and retention period — for the storage and retention period required by law. After that your Personal Data will be deleted, blocked or anonymized, as provided by applicable law.

In particular:

• If you terminate your Steam User Account, your Personal Data will be marked for deletion except to the degree legal requirements or other prevailing legitimate purposes dictate a longer storage.
• In certain cases, Personal Data cannot be completely deleted in order to ensure the consistency of the gameplay experience or the Steam Community Market. For instance, matches you have played that affect other players' matchmaking data and scores will not be deleted; rather, your connection to these matches will be permanently anonymized.
• Please note that Valve is required to retain certain transactional data under statutory commercial and tax law for a period of up to ten (10) years.
• If you withdraw your consent on which a processing of your Personal Data or of the Personal Data of your child is based, we will delete your Personal Data or respectively the Personal Data of your child without undue delay to the extent that the collection and processing of the Personal Data was based on the withdrawn consent.
• If you exercise a right to object to the processing of your Personal Data, we will review your objection and delete your Personal Data that we processed for the purpose to which you objected without undue delay, unless another legal basis for processing and retaining this data exists or unless applicable law requires us to retain the data.

5. Who Has Access to Data

Valve does not sell Personal Data. However, we may share or provide access to each of the categories of Personal Data we collect as necessary for the following business purposes.

5.1 Valve and its subsidiaries may share your Personal Data with each other and use it to the degree necessary to achieve the purposes listed in section 2 above. In the event of a reorganization, sale or merger we may transfer Personal Data to the relevant third party subject to applicable laws, the Principles and liability requirements under the DPF.

5.2 We may also share your Personal Data with our third party service providers that provide customer support services in connection with goods, Content and Services distributed via Steam. Your Personal Data will be used in accordance with this Privacy Policy and only as far as this is necessary for performing customer support services. Valve complies with the Principles for all onward transfers of Personal Data from the EU, Switzerland, and the UK, including the provisions governing onward transfer liability.

5.3 In accordance with internet standards, we may also share certain information (including your IP address and the identification of Steam content you wish to access) with our third party network providers that provide content delivery network services and game server services in connection with Steam. Our content delivery network providers enable the delivery of digital content you have requested, e.g. when using Steam, by using a system of distributed servers that deliver the content to you, based on your geographic location.

5.4 We make certain data related to your Steam User Account available to other players and our partners through the Steamworks API. This information can be accessed by anyone by querying your Steam ID. At a minimum, the public persona name you have chosen to represent you on Steam and your Avatar picture are accessible this way, as well as whether you have received a ban for cheating in a multiplayer game. The accessibility of any additional info about you can be controlled through your Steam Community user profile page; data publicly available on your profile page can be accessed automatically through the Steamworks API. In addition to the publicly available information, game developers and publishers have access to certain information from the Steamworks API directly relating to the users of the games they operate. This information includes as a minimum your ownership of the game in question. Depending on which Steamworks services are implemented in the game it may also include leaderboard information, your progress in the game, achievements you have completed, your multiplayer game matchmaking information, in-game items and other information needed to operate the game and provide support for it. For more information on what Steamworks services a specific game has implemented, please review its store page.
While we do not knowingly share Personally Identifying Information about you through the Steamworks API such as your real name or your email address, any information you share about yourself on your public Steam Profile can be accessed through the Steamworks API, including information that may make you identifiable.

5.5 The Steam community includes message boards, forums and/or chat areas, where users can exchange ideas and communicate with each other. When posting a message to a board, forum or chat area, please be aware that the information is being made publicly available online; therefore, you are doing so at your own risk. If your Personal Data is posted on one of our community forums against your will, please use the reporting function and the Steam help site to request its removal.

5.6 Valve may allow you to link your Steam User Account to an account offered by a third party. If you consent to link the accounts, Valve may collect and combine information you allowed Valve to receive from a third party with information of your Steam User Account to the degree allowed by your consent at the time. If the linking of the accounts requires the transmission of information about your person from Valve to a third party, you will be informed about it before the linking takes place and you will be given the opportunity to consent to the linking and the transmission of your information. The third party's use of your information will be subject to the third party's privacy policy, which we encourage you to review.

5.7 Valve may release Personal Data to comply with court orders or laws and regulations that require us to disclose such information.

6. Your Rights and Control Mechanisms

The data protection laws of the European Economic Area, United Kingdom, California, and other territories grant their residents certain rights in relation to their Personal Data. While other jurisdictions may provide fewer statutory rights, we make the tools designed to exercise such rights available to our customers worldwide. (When we talk about the GDPR in this section, we mean the version of the GDPR that applies to you in the EU or UK).

To allow you to exercise your data protection rights in a simple way we are providing a dedicated section on the Steam support page (the "Privacy Dashboard"). This gives you access to your Personal Data, allows you to rectify and delete it where necessary and to object to its use where you feel necessary. To access it, log into the Steam support page at https://node2.projectplanet.cn/@help.steampowered.com and choose the menu items My Account -> Data Related to Your Steam Account. In most cases, you can access, manage, or delete Personal Data in the Privacy Dashboard, but you may also contact Valve with questions or requests via the contact processes described in sections 8 and 10 below.

As a visitor to the Steam Website without being logged in, you can control Cookies through the process described in section 3.6 above. You can also contact Valve or its European representative through the contact info provided in section 8. below to exercise your rights or use this web form.

As a resident of the European Economic Area or United Kingdom you have the following rights in relation to your Personal Data:

6.1 Right of Access.
You have the right to access your Personal Data that we hold about you, i.e. the right to require free of charge (i) information whether your Personal Data is retained, (ii) access to and/or (iii) duplicates of the Personal Data retained. You can use the right to access to your Personal Data through the Privacy Dashboard. If the request affects the rights and freedoms of others or is manifestly unfounded or excessive, we reserve the right to charge a reasonable fee (taking into account the administrative costs of providing the information or communication or taking the action requested) or refuse to act on the request.

6.2 Right to Rectification.
If we process your Personal Data, we shall endeavor to ensure by implementing suitable measures that your Personal Data is accurate and up-to-date for the purposes for which it was collected. If your Personal Data is inaccurate or incomplete, you can change the information you provided via the Privacy Dashboard.

6.3. Right to Erasure.
You have the right to obtain deletion of Personal Data concerning you if the reason why we could collect it (see section 2. above) does not exist anymore or if there is another legal ground for its deletion. For individual items of Personal Data please edit them through the Privacy Dashboard or request the deletion via the Steam support page. You can also request the deletion of your Steam user account via the Steam support page.

As a result of deleting your Steam User Account, you will lose access to Steam services, including the Steam User Account, Subscriptions and game-related information linked to the Steam User Account and the possibility to access other services you are using the Steam User Account for.

We allow you to restore your Steam User Account during a grace period of 30 (thirty) days from the moment you request deletion of your Steam User Account. This functionality allows you not to lose your account by mistake, because of your loss of your account credentials or due to hacking. During the suspension period, we will be able to finalize financial and other activities that you may have initiated before sending the Steam User Account deletion request. After the grace period, Personal Data associated with your account will be deleted subject to section 4. above.

In some cases, deletion of your Steam User Account, and therefore Personal Data deletion, is complicated. Namely, if your account has a business relationship with Valve, such as due to your work for a game developer, you will only be able to delete your Steam User Account after you have transferred this role to another user or have dissolved the business relationship. In some cases, considering the complexity and number of the requests, the period for Personal Data erasure may be extended, but for no longer than two further months.

6.4 Right to Object.
When our processing of your Personal Data is based on legitimate interests according to Article 6(1)(f) of the GDPR / section 2.c) of this Privacy Policy, you have the right to object to this processing. If you object we will no longer process your Personal Data unless there are compelling and prevailing legitimate grounds for the processing as described in Article 21 of the GDPR; in particular if the data is necessary for the establishment, exercise or defense of legal claims. You also have the right to lodge a complaint at a supervisory authority.

6.5 Right to restriction of processing of your Personal Data
You have the right to obtain restriction of processing of your Personal Data under the conditions set out in article 18 of the GDPR.

6.6 Right to Personal Data portability
You have the right to receive your Personal Data in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller under the conditions set out in article 20 of the GDPR. Valve makes your Personal Data available in structured HTML format through the Privacy Dashboard as described above.

6.7 Right to Post-Mortem Control of Your Personal Data
If French data protection legislation is applicable to you, you have the right to establish guidelines for the preservation, the deletion and the transmission of Personal Data after your death in accordance with article 40-1 of the Act No 78-17 of 6 January 1978 on Information, Technology, Data Files and Civil Liberties.

6.8 Arbitration
If Valve does not resolve any claimed violations of the Principles by any other DPF mechanism or by your rights under this section, you have � in accordance with the requirements of Annex I to the DPF � the possibility to invoke binding arbitration before the EU-U.S. Data Privacy Framework Panel.

7. Children

The minimum age to create a Steam User Account is 13. Valve will not knowingly collect Personal Data from children under this age. Where certain countries apply a higher age of consent for the collection of Personal Data, Valve requires parental consent before a Steam User Account can be created and Personal Data associated with it collected. Valve encourages parents to instruct their children to never give out personal information when online.

8. Contact Info

You can contact Valve's data protection officer at the address below.

While we review any request sent by mail, please be aware that to combat fraud, harassment and identity theft, the only way to access, rectify or delete your data is through logging in with your Steam User Account at http://node2.projectplanet.cn/@help.steampowered.com and selecting the menu items -> My Account -> View Account Data.

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Valve commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU, UK and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF should first contact Valve at:

Valve Corporation
Att. Data Protection officer
P.O. Box 1688
Bellevue, WA 98009

EU and Switzerland representative for data protection questions:

Valve GmbH
Att. Legal
Rödingsmarkt 9
D-20459 Hamburg
Germany

UK representative for data protection questions:

RIVACY Ltd.
71, Warriner Gardens, Unit G1/G2
London, SW11 4DX
United Kingdom

9. Additional Information for Users from the European Economic Area, U.K., and Switzerland

As a US-based company that operates a worldwide gaming service, we may transfer your personal data outside of the European Economic Area or the United Kingdom. In such case, we take additional steps to ensure your personal data is protected by appropriate legal safeguards, and that it is treated securely and in accordance with this Privacy Policy. In this respect, Valve has implemented appropriate contractual and organizational measures to ensure the confidentiality, security and integrity of user data in connection with its collection, processing and transfer. Measures we have taken include, among other things:

• Minimization of data collection; in particular the possibility to set up and operate anonymous accounts
• Pseudonymization of data
• Industry-standard encryption
• Provision of access to data on a need-to-know basis
• The use of Standard Contractual Clauses in their version in force and approved by the European Commission and the UK ICO to safeguard transfers
• Certification and participation in the DPF, set out in the DPF List available at https://www.dataprivacyframework.gov/s/participant-search

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Valve commits, free of charge to the affected individual, to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs), the UK Information Commissioner�s Office (ICO) and the Gibraltar Regulatory Authority (GRA) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF., the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF. Links to the website of each authority are available below.

• EU DPAs: https://edpb.europa.eu/about-edpb/about-edpb/members_en
• UK ICO: https://ico.org.uk/for-the-public/
• GRA: https://www.gra.gi/data-protection
• FDPIC: https://www.edoeb.admin.ch/edoeb/home.html

The Federal Trade Commission has jurisdiction over Valve�s compliance with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF).

10. Additional Information for Users from California

The CCPA grants California residents certain privacy rights regarding the Personal Data we collect. We are committed to respecting these rights and complying with the CCPA. The following explains these rights and Valve's practices with respect to them.

Right to Know. Under the CCPA you have the right to request that we disclose to you what Personal Data we collect, use, disclose, and sell.

Right to Request Deletion. You also have the right to request deletion of Personal Data that is in our possession, subject to certain exceptions. Please note that your request to delete data may impact your use of the Steam service in some cases, and we may decline to delete information for reasons set forth in this Privacy Policy or as permitted by the CCPA.

Other Rights. The CCPA also gives California residents a right to opt-out from the sale of their Personal Data. As described in section 5, we do not sell Personal Data and have not done so in the past 12 months. You also have a right to receive notice of our practices at or before collection of your Personal Data. Finally, you have a right to not be discriminated against for exercising your rights under the CCPA.

Exercising Your Rights. The primary means of accessing, managing or deleting your Personal Data is through the Privacy Dashboard, as described in section 6 of this Policy. Customers may also delete their Steam Account and associated Personal Data as described in section 6.3 of this Privacy Policy. If you are unable to access or delete data through the Privacy Dashboard, you can also contact us with a request to exercise these rights by using the form found at https://node2.projectplanet.cn/@help.steampowered.com/en/wizard/HelpAccountDataQuestion. To verify your identity, you will need to log in with your Steam User Account to use the form. Finally, you can contact us with a request at questions@valvesoftware.com, however, before providing access to, or deleting any, Personal Data, based on a request received via email, we will need to verify your identity utilizing the "Proof of Ownership" process described at https://node2.projectplanet.cn/@support.steampowered.com/kb_article.php?ref=2268-EAFZ-9762.

You may designate, in writing or through a power of attorney, an authorized agent to make requests on your behalf to exercise your rights under the CCPA. Before accepting such a request from an agent, we will require the agent to provide proof you have authorized it to act on your behalf, and we may need you to verify your identity directly with us.

Categories, Sources, Purposes, and Recipients of the Data We Collect. Over the preceding 12 months, we have collected the categories of Personal Data described in section 3 of this Privacy Policy. The sources from which we collect Personal Data, and the purposes for which we collect and process it, are described in sections 2 and 3. Over the preceding 12 months, we have disclosed for business purposes each of the categories of Personal Data with the categories of third parties as described in section 5.

Revision Date: February 14th, 2024