Legal
Privacy policy
Template written for this shop's design under UK GDPR. Check it against how you actually run the business before launch.
Who is responsible for your data
Haunted TCG, Devon, United Kingdom is the "controller" of the personal data on this site. Contact us at hello@hauntedtcg.store.
What we collect, why, and our legal basis
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Name, email, delivery address, phone (optional), order contents | To take payment, pack and post your order, and send receipts and tracking | Contract | 6 years after the order (UK tax and accounting rules), then anonymised |
| Account: email, name, password (stored only as a salted one-way hash), saved address | To let you sign in and see your orders | Contract / legitimate interests | Until you delete the account. Unconfirmed accounts are deleted after 30 days |
| Marketing email choice | To send news about new stock, only if you tick the box | Consent (withdraw any time) | Until you untick it or delete your account |
| Contact form messages | To reply to you | Legitimate interests | 12 months |
| Security records: a one-way hash of your IP address for rate limiting; sign-in lock counters; staff action logs | To stop abuse and keep the site secure | Legitimate interests | Under 24 hours (rate limits); 2 years (staff audit log) |
| Session cookie | Basket and sign-in | Strictly necessary | See cookies |
We do not sell your data, use advertising trackers, or make automated decisions about you. We never see or store your full card number.
Who else handles your data
- Stripe (payments) — receives your payment details and email to take payment and prevent fraud.
- Our email provider — sends receipts, tracking and account emails.
- Our hosting provider — stores the site's database.
- Royal Mail — receives your name and address to deliver your parcel.
Some of these providers may process data outside the UK under approved safeguards (such as the UK International Data Transfer Agreement or adequacy regulations).
Your rights
You can: see what we hold about you; correct it; delete it; restrict or object to how we use it; take a copy to reuse; and withdraw consent at any time. Most of this you can do yourself in your account: edit your details, download all your data, or delete your account. Otherwise, email us and we'll respond within one month.
When you delete your account we remove your sign-in, name, phone, saved address and marketing choices. We must keep basic order records for 6 years for tax purposes; these are unlinked from any account and anonymised afterwards.
Security
Passwords are hashed with scrypt. Connections are encrypted. Staff accounts use two-factor sign-in. Payment pages are hosted by Stripe. We limit sign-in attempts and keep a log of staff actions.
Complaints
If you're unhappy with how we've handled your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.