18+ Offers on this site use referral links. We may earn a commission. Referral links. How we make money
Language: EN

Privacy policy

This policy explains what data we process when you use CS2PromoHub (cs2promohub.com), why, how long we keep it and what rights you have. It describes exactly what the site does.

In short:

  • We have no user accounts, sign-ups or newsletter.
  • We use no cookies, no third-party analytics (such as Google Analytics) and no tracking ads.
  • We do not store your IP address in our database. Clicks are counted with pseudonymous hashes that change every month and are erased after 30 days.
  • The site loads nothing from other companies' servers: fonts, images and scripts come from our own server.
  • We do not sell data or pass it on to partners.

1. Controller

The controller of your personal data is the owner of CS2PromoHub, referred to as "we". For anything about personal data, write to [email protected]. We have not appointed a data protection officer, as we are not required to.

2. What data we process and why

2.1. Showing the site and security

Each time you open a page, your browser sends our server your IP address, browser and system details (User-Agent), the page address, the address of the page you came from and the time of the request. This is needed to show the site and to protect it from attacks and abuse. It is kept in server logs for 14 days.

Legal basis: our legitimate interest in running the site securely and reliably (Art. 6(1)(f) GDPR).

2.2. Your country

We work out the country you visit from based on your IP address (our CDN provider, Cloudflare, does this). We use it so we do not show codes for sites that are on a national blocklist of unlicensed gambling sites or do not work in your country, and for statistics. We do not store the IP address for this.

Legal basis: legitimate interest in not promoting sites that are not allowed in your country (Art. 6(1)(f) GDPR).

2.3. Clicks on offers (affiliate links)

When you click an offer button, you pass through our redirect address (/go/...) to the partner's site. We then record:

  • which site was clicked, the language version and the page the click came from;
  • the country, date and time;
  • how you arrived on our site (for example Google or ChatGPT, see 2.4) and the referring page address without parameters;
  • whether the click was confirmed as made by a person;
  • two pseudonymous identifiers: a hash of the IP address, and a hash of the IP address together with the browser.

The hashes are one-way, made with a secret key known only to our server and changed every month. They are pseudonymous data: without that key the IP address cannot be recovered from them. They are only used to skip repeated clicks and automated traffic. They are erased automatically after 30 days and the click remains as an anonymous statistic.

Purposes: statistics on offer popularity, settlements in affiliate programmes and protection against fake clicks. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Bot protection. The page fetches a short-lived signed token from our server (valid for at most 6 hours, not stored anywhere) and checks whether there was mouse movement, touch or keyboard use on the page. We record only the result of this check with the click, never the movements or any content. If an automated program opens a hidden link meant for bots, clicks from the same pseudonymous identifier are skipped for 24 hours. This check has no effect on you: the redirect to the partner always works.

2.4. How you arrived

When you come to our site from another website or from a link with a utm_source parameter, we keep only the name of the source (for example "google.com") on our server under a pseudonymous identifier for 30 minutes, to attribute a later click on an offer to it. Nothing is stored in your browser. Legal basis: legitimate interest in knowing where visitors come from (Art. 6(1)(f) GDPR).

2.5. "Did the code work?" votes

We record the vote (yes or no), the country, the date and a pseudonymous hash of the IP address, so one person can cast one vote per code per day. The hash is erased after 30 days. Legal basis: legitimate interest in reliable information about whether codes work (Art. 6(1)(f) GDPR).

2.6. Email

If you write to us, we process your email address, signature and message to reply and deal with your matter. We keep the correspondence for 12 months after it ends, and longer only when it is needed to establish, pursue or defend legal claims. Legal basis: legitimate interest in replying to messages (Art. 6(1)(f) GDPR).

2.7. Giveaway winners

With giveaways we show the results of draws run by partner sites: the winner's Steam account name (with links and domain names removed), Steam avatar, the item won and the date. We receive this from the site running the giveaway (through its API) and from the public Steam profile. We keep a copy of the avatar on our server. Purpose: showing that prizes are actually given out. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Winner data is erased automatically 12 months after the giveaway ends. If you are a winner and do not want to be shown, write to us and we will remove your data without undue delay.

3. Cookies and browser storage

Our site sets no cookies. The only thing we store in your browser is the theme you chose (light or dark), in localStorage under the name "theme". It is stored only when you switch the theme yourself and stays until you clear it in your browser settings. This is strictly necessary for a feature you asked for, so it does not require consent.

Our CDN and attack protection provider, Cloudflare, may set technical cookies used only for security (for example "__cf_bm", valid for up to 30 minutes) when it detects suspicious traffic. They are needed to protect the site and are not used for tracking.

Once you go to a partner's site, that partner's cookie rules apply.

4. Affiliate links

The offers on this site are affiliate links. If you sign up or deposit through our link or code, the partner may pay us a commission. The partner learns that you came from us through the referral code in the link or the promo code you enter. We pass no other data from our site to partners. The partner is responsible for data processed on its own site, under its own privacy policy.

5. Who receives data

  • our hosting provider, which stores the site and database on our behalf;
  • Cloudflare, Inc., which provides the CDN, protects the site from attacks and determines the visitor's country, on our behalf;
  • our email provider, which handles our correspondence;
  • public authorities, only when the law requires it.

Providers act as processors under data processing agreements and process data only on our instructions. We do not sell data or share it for marketing.

6. Transfers outside the European Economic Area

Cloudflare may process technical data such as IP addresses outside the European Economic Area, including in the United States. This is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework, in which Cloudflare participates, and on standard contractual clauses.

If any provider processes data outside the EEA, this happens only on the basis of a European Commission adequacy decision or standard contractual clauses adopted by the Commission.

7. How long we keep data

  • server logs: 14 days;
  • pseudonymous hashes on clicks and votes: 30 days, after which only anonymous statistics remain;
  • remembered traffic source: 30 minutes;
  • automated traffic flag: 24 hours;
  • giveaway winner data: 12 months after the giveaway ends;
  • email correspondence: 12 months after it ends.

Data is erased automatically when these periods end.

8. Your rights

You have the right to:

  • access your data and get a copy (Art. 15 GDPR);
  • have your data corrected (Art. 16 GDPR);
  • have your data erased (Art. 17 GDPR);
  • restrict processing (Art. 18 GDPR);
  • data portability, where it applies (Art. 20 GDPR);
  • object to processing based on legitimate interest, on grounds relating to your particular situation (Art. 21 GDPR);
  • lodge a complaint with a supervisory authority, in particular in the EU country where you live or work. In Poland this is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw (uodo.gov.pl).

To use your rights, write to [email protected]. We reply within one month. Most of the data we keep is pseudonymous and does not by itself let us identify you. To find it, we may ask for additional information, such as the approximate time of your visit and the IP address and browser you used (Art. 11 and Art. 12(2) GDPR).

9. Do you have to provide data

Using the site does not require you to provide any data. Your browser sends the technical data from 2.1 automatically, and the site cannot be shown without it. Emailing us is voluntary.

10. Automated decisions and profiling

We make no decisions about you based solely on automated processing that have legal or similarly significant effects, and we do not profile you. We only check automatically whether a click comes from a program, which has no effect on you.

11. Minors

The site is for adults (18+) only. We do not knowingly collect data from minors.

12. Security

We use encrypted connections (HTTPS), pseudonymisation with a secret key, data minimisation (we do not store IP addresses and strip parameters from referring addresses), automatic erasure when retention periods end, and restricted access to the admin panel.

13. Changes to this policy

We update this policy when the way the site works changes. The date of the last change is shown below.

Last updated: October 28, 2026.