Privacy policy.

01 —Introduction¶

What this policy covers and who is responsible for your data.

This Privacy Policy explains how TCG Mart London ("we", "us", "our") collects, uses, retains, and protects personal data when you visit tcgmartlondon.com (the "Site"), subscribe to the newsletter, use the Collection or Cardfolio features, or otherwise communicate with us.

We are the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you have questions not answered below, please use the contact address in Section 12.

02 —Definitions¶

Key terms used throughout this policy.

03 —Data we collect¶

A complete list of every type of personal data we hold, and where it comes from.

We collect personal data in three contexts only:

1. When you subscribe to the newsletter. We collect your email address and the date you subscribed. We do not ask for, and do not store, your name unless you choose to provide it.
2. When you contact us directly. If you email us, we retain your email address and the content of the message for as long as the conversation is open and for twelve months thereafter.
3. When you visit the Site. Our analytics tool records each page view along with the referring URL, your country (not city), browser type, and operating system. It does not use cookies and cannot identify you as an individual.

All personal data we hold comes directly from you. We do not purchase email lists, enrich subscriber data, or obtain personal data from data brokers.

04 —How we use your data¶

The purposes for which we use each type of data we collect.

We use personal data for three purposes only:

• Sending the newsletter you subscribed to.
• Replying to your enquiry or message.
• Understanding which articles and pages are read so we can improve the content we publish.

We do not use personal data for advertising, profiling, or automated decision-making. We do not sell personal data.

05 —Legal bases under UK GDPR¶

The lawful ground for each processing activity.

Data type	Purpose	Legal basis
Email address (newsletter)	Sending the newsletter	Consent (Art. 6(1)(a) UK GDPR)
Email address + message (contact)	Responding to your enquiry	Legitimate interest (Art. 6(1)(f) UK GDPR)
Analytics data (aggregated, non-identifying)	Understanding content performance	Legitimate interest (Art. 6(1)(f) UK GDPR)

Where we rely on legitimate interest, we have balanced our interest against your rights and concluded that our interest does not override your fundamental rights or freedoms. You can object to any legitimate-interest processing at any time — see Section 9.

06 —Cookies and analytics¶

The cookies set on this site and how our analytics tool works.

This Site uses no advertising cookies and no third-party tracking pixels. The complete set of cookies we may set is:

Cookie	Purpose	Duration
wp_session_*	Set by WordPress for logged-in editors only. Never set for regular visitors.	Session
tcgm_consent	Records your cookie-banner preference so we don't show it again.	12 months

Analytics. We use Plausible Analytics to count page views. Plausible does not use cookies, does not collect personal data, and is not able to identify individual visitors. Aggregate data (page views, country, browser) is stored on servers in the EU.

07 —Sharing with third parties¶

Who we share data with and why.

We share personal data with third parties only where necessary:

• Email service provider. We use a third-party provider to deliver the newsletter. Your email address is transferred to them and they act as our data processor under a data-processing agreement. They do not use your data for their own purposes.
• Website hosting. The Site is hosted on shared hosting infrastructure. The hosting provider may process limited server log data (IP addresses) as part of routine infrastructure operation.
• Analytics. Plausible Analytics processes aggregate visit data. No personal data is transferred.

We do not sell, rent, or share personal data with any third party for marketing, advertising, or commercial purposes.

08 —Data retention¶

How long we keep each type of data.

• Newsletter subscribers: retained until you unsubscribe. On unsubscribe, your email address is deleted within 30 days.
• Contact messages: retained for twelve months from the date the conversation closes.
• Analytics data: Plausible stores aggregate data only. No personal data is retained.
• Server logs: retained by the hosting provider for up to 30 days in line with standard infrastructure practice.

09 —Your rights¶

The rights you have over your personal data under UK GDPR.

Under UK GDPR, you have the following rights:

• Right of access. You can request a copy of the personal data we hold about you.
• Right to rectification. You can ask us to correct inaccurate personal data.
• Right to erasure. You can ask us to delete your personal data where there is no legitimate reason for us to continue holding it.
• Right to data portability. Where processing is based on consent or a contract, you can request your data in a commonly used, machine-readable format.
• Right to restrict processing. You can ask us to restrict processing of your data in certain circumstances.
• Right to object. You can object at any time to processing based on legitimate interest. We will stop unless we have compelling legitimate grounds that override your rights.
• Right to withdraw consent. Where processing is based on consent (e.g. newsletter subscription), you can withdraw consent at any time by unsubscribing. Withdrawal does not affect the lawfulness of processing before withdrawal.

To exercise any of these rights, write to us at privacy@tcgmartlondon.com. We will respond within one calendar month as required by UK GDPR.

10 —Children¶

Our policy on processing data relating to children.

The Site is not directed at children under 13 years of age. We do not knowingly collect personal data from children under 13 without verifiable parental consent. If you believe a child under 13 has submitted personal data to us, please contact us and we will delete it promptly.

11 —Changes to this policy¶

How we notify you of material changes.

We may update this policy from time to time. Material changes — for example, a change in the data we collect, the purposes we use it for, or the legal basis — will be recorded in the Revision history below with a version number and description of the change. The "Last updated" date in the document header will also be updated.

For significant changes affecting newsletter subscribers, we will include a notice in the newsletter before the changes take effect.

12 —Contact and complaints¶

How to reach us with questions or to make a complaint.

For any question about this policy, to exercise a data subject right, or to raise a concern:

If you are not satisfied with our response, or believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection:

• Website: ico.org.uk
• Helpline: 0303 123 1113