Privacy Policy

1. Who We Are (Data Controller)

Tcg-PokeShop collects and processes your personal data as the data controller, within the meaning of the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). Contact for any privacy request: privacy@tcg-pokeshop.com.

2. Data We Collect

• At checkout: full name, email address, and shipping address — used solely to process and deliver your order. These are stored in our order database (orders, customers tables).
• Payment data: never stored by Tcg-PokeShop. All payment processing is done by Tebex, which acts as an independent data controller for the payment transaction. We only receive a payment confirmation and receipt reference.
• Technical data: your PHP session identifier (a temporary cookie) is used to keep your cart between pages. It expires when you close your browser.

3. Why We Process Your Data (Legal Bases)

• Contract performance (GDPR art. 6-1-b): processing your order, shipping it, and handling returns/refunds.
• Legal obligation (GDPR art. 6-1-c): keeping order records for accounting and tax purposes.
• Legitimate interest (GDPR art. 6-1-f): securing the site and preventing fraud.

4. Cookies

Tcg-PokeShop uses a single, strictly necessary cookie: the PHP session cookie (PHPSESSID). It stores only your cart contents (product IDs and quantities) while you browse. No analytics, advertising or third-party tracking cookies are set by the shop itself. The Tebex checkout page may set its own cookies required for payment security — please refer to Tebex's privacy policy for details.

5. Data Sharing

Your data is shared only with what is strictly necessary:

• Tebex: receives the payment transaction (your banking data goes directly to them, never to us).
• Carriers: receive the name and address needed to deliver your parcel.
• We never sell, rent or share your data with advertisers or data brokers.

6. Retention

Order and customer records are kept for the duration required by accounting and consumer law (typically 10 years for invoices). Session cart data disappears when your browsing session ends. You may request deletion of your non-transactional data at any time.

7. Your Rights (GDPR & CCPA)

Depending on your place of residence, you have the right to:

• Access the personal data we hold about you and receive a copy (GDPR) / know what is collected (CCPA).
• Rectify inaccurate data.
• Delete your data ("right to be forgotten" / right to delete), within legal retention limits.
• Object or restrict processing, and withdraw consent at any time.
• Data portability: receive your data in a machine-readable format.
• Non-discrimination (CCPA) for exercising any of these rights.

To exercise any right, email privacy@tcg-pokeshop.com with proof of identity. We respond within 30 days. EU residents may also lodge a complaint with their local supervisory authority; California residents with the California Attorney General.

8. Security

The site is served over encrypted connections where configured, passwords are not stored (no customer accounts), and the order database is not publicly accessible. Payment security is delegated entirely to the PCI-DSS compliant Tebex platform.

9. Changes to This Policy

We may update this policy to reflect legal or functional changes. The "Last updated" date above indicates the current version; significant changes will be highlighted on the shop page.