Privacy policy

Last updated: 1 August 2026

This Privacy Policy explains how MY TCG LIMITED, trading as MY TCG, collects, uses, stores and shares personal information when you visit our website, place an order, create an account or contact us.

MY TCG LIMITED is the data controller for the personal information described in this policy, except where another organisation acts as a separate controller for its own processing activities.

1. Who we are

Trading name: MY TCG
Legal business name: MY TCG LIMITED
Company number: 15006366
VAT registration number: 448 5283 65
Email: sales@mytcg.co.uk
Location: Bedfordshire, United Kingdom

MY TCG is an independent UK online retailer of genuine trading card games, collectible cards, playing cards and card-protection accessories.

Our website and online store are hosted using Shopify.

2. Personal information we collect

The personal information we collect depends on how you use our website and services.

It may include:

• your name;
• billing and delivery addresses;
• email address and telephone number;
• customer-account information;
• order history and transaction details;
• products viewed, added to your basket or purchased;
• returns, cancellations and refund information;
• communications sent to us;
• delivery and tracking information;
• marketing preferences;
• IP address, browser, device and network information;
• website usage and interaction information; and
• cookie identifiers and similar technical information.

You are not generally required to create an account to browse our website. However, certain information is required to place and deliver an order. If you do not provide the required information, we may be unable to process the transaction.

3. Payment information

Payments are processed through Shopify and the payment providers made available at checkout.

Although limited payment and transaction information may be visible to us, MY TCG does not normally receive or store your complete payment-card number or security code.

Payment providers process payment information under their own privacy terms and security arrangements.

4. How we collect personal information

We collect personal information:

• directly from you when you place an order, create an account, contact us, request a return or join a mailing list;
• automatically when you use our website, subject to your cookie choices;
• from Shopify and payment providers when they process an order or payment;
• from delivery providers when they provide tracking or delivery information;
• from fraud-prevention and security providers; and
• from other service providers that assist us in operating the store.

5. How and why we use personal information

Under UK data-protection law, we must have a lawful basis for using personal information.

Processing and fulfilling orders

We use customer and order information to:

• process payments;
• confirm and fulfil orders;
• arrange delivery;
• provide tracking information;
• manage cancellations, returns and refunds;
• communicate about an order; and
• provide customer support.

Our lawful basis is that this processing is necessary to enter into or perform our contract with you.

Legal and regulatory obligations

We use and retain information where necessary to:

• maintain financial, accounting and tax records;
• comply with consumer-protection obligations;
• respond to lawful requests from public authorities;
• manage product-safety or recall matters; and
• establish, exercise or defend legal claims.

Our lawful basis is compliance with a legal obligation and, where applicable, our legitimate interests in protecting and managing our business.

Security and fraud prevention

We may use account, order, payment, device and technical information to:

• detect and prevent fraud;
• verify transactions;
• protect customer accounts;
• prevent misuse of promotions or purchase limits;
• maintain website security; and
• investigate suspicious or unlawful activity.

Our lawful basis is our legitimate interest in protecting customers, MY TCG and our website from fraud, misuse and security threats.

Customer service and business administration

We use communications, order information and customer details to answer enquiries, resolve complaints, maintain business records and improve our customer service.

Our lawful basis is performance of our contract with you and our legitimate interest in operating and improving our business.

Website operation and improvement

We may use technical and website-usage information to operate the website, diagnose errors, understand website performance and improve the shopping experience.

Strictly necessary processing is based on our legitimate interest in operating a secure and functional website.

Where analytics or similar optional technologies require consent, we rely on your consent.

Marketing

Where you have chosen to receive marketing, we may use your name, email address, preferences and purchase information to send relevant news, product information or promotional messages.

Our lawful basis is your consent where consent is required.

You can unsubscribe at any time using the link contained in a marketing email or by contacting sales@mytcg.co.uk.

Stopping marketing messages will not prevent us from sending essential service messages about orders, payments, deliveries, accounts, returns or security.

6. Cookies and similar technologies

Our website uses cookies and similar technologies.

Some cookies are strictly necessary to:

• operate the website;
• remember the contents of your basket;
• support checkout and payment;
• maintain security; and
• remember privacy preferences.

Strictly necessary cookies may operate without consent because they are required to provide the service requested.

Optional cookies and similar technologies may be used for analytics, personalisation or advertising. Where consent is required, these technologies should not be activated unless you accept the relevant category through our cookie banner.

You can review or change your cookie choices using the privacy or cookie-preference controls available on our website.

You can also control cookies through your browser settings, although disabling necessary cookies may affect website functions or checkout.

7. Who we share personal information with

We share personal information only where reasonably necessary to operate the store, fulfil orders, comply with the law or protect our legitimate interests.

Recipients may include:

• Shopify, which hosts and supports our online store;
• payment processors, banks and fraud-prevention providers;
• Royal Mail and other delivery or fulfilment providers;
• website hosting, cloud-storage, security and technical-support providers;
• email, customer-service and marketing providers;
• analytics and advertising providers, where permitted by your cookie and consent choices;
• accountants, insurers, legal advisers and other professional advisers;
• government bodies, regulators, law-enforcement agencies or courts where legally required; and
• another organisation involved in a genuine sale, transfer or restructuring of the business, subject to appropriate confidentiality and data-protection measures.

We do not sell customer personal information for money.

8. Shopify

Our store is hosted by Shopify, which processes information needed to provide the website, checkout and related ecommerce services.

Information submitted through our store is transmitted to Shopify and may also be processed by service providers supporting Shopify’s platform.

Shopify may process certain information as a separate data controller for its own purposes or enhanced services. Further information and controls are available through the Shopify Consumer Privacy Policy and Shopify Privacy Portal.

Some Shopify features may use information about how customers interact with our store to provide analytics, personalisation or advertising services. Where consent is required, these features will operate according to the choices made through our website’s privacy and cookie controls.

9. International transfers

Shopify and some other service providers may process or store personal information outside the United Kingdom.

Where personal information is transferred internationally, we require an appropriate legal mechanism or safeguard recognised under UK data-protection law. This may include:

• transfer to a country recognised as providing adequate protection;
• approved contractual safeguards; or
• another lawful transfer mechanism.

10. How long we retain personal information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, tax, fraud-prevention and dispute-resolution requirements.

Our usual retention approach is:

• order, invoice, payment and transaction records: generally retained for up to six years from the end of the relevant company financial year, or longer where legally required;
• customer-service, complaint, return and refund records: retained for as long as necessary to resolve the matter and manage possible legal claims;
• customer-account information: retained while the account remains active and for a reasonable period afterwards;
• marketing information: retained until you unsubscribe, withdraw consent or we determine that it is no longer required;
• marketing suppression records: limited information may be retained to ensure that an unsubscribe request continues to be respected;
• security and fraud-prevention information: retained for as long as reasonably necessary to prevent and investigate fraud or misuse; and
• cookie and analytics information: retained according to the applicable cookie duration, service setting and consent choice.

We may securely delete or anonymise information when it is no longer required.

11. Security

We use reasonable organisational and technical measures intended to protect personal information from unauthorised access, loss, alteration, disclosure or misuse.

Our website and checkout are operated through Shopify and supported by security measures provided by Shopify and relevant payment processors.

No method of online transmission or electronic storage can be guaranteed as completely secure. Please do not send full payment-card details or other highly sensitive information through ordinary email or website chat.

12. Your data-protection rights

Depending on the circumstances, you may have the right to:

• request access to the personal information we hold about you;
• request correction of inaccurate or incomplete information;
• request deletion of your information;
• request restriction of particular processing;
• object to processing based on legitimate interests;
• receive certain information in a portable format;
• withdraw consent at any time where we rely on consent; and
• complain to the Information Commissioner’s Office.

These rights are not absolute and may be subject to legal exceptions.

You have an absolute right to object to the use of your personal information for direct marketing.

Withdrawing consent does not affect processing that took place before consent was withdrawn.

To exercise a right, contact sales@mytcg.co.uk. We may request information needed to confirm your identity before responding.

We normally respond to valid requests within the period required by applicable data-protection law.

13. Automated processing and fraud checks

Payment, security and fraud-prevention providers may use automated systems to produce transaction-risk indicators.

These indicators may be considered when deciding whether further verification or manual review is required.

MY TCG does not intentionally make decisions based solely on automated processing that produce legal or similarly significant effects without appropriate safeguards.

14. Children

Our online store is intended for customers who are legally capable of entering into a purchase contract.

Customers under 18 should use the website and place orders only with the involvement and permission of a parent or legal guardian.

We do not knowingly use children’s personal information for targeted marketing.

A parent or guardian who believes that a child has provided personal information without appropriate permission may contact sales@mytcg.co.uk.

15. Third-party websites

Our website may contain links to websites operated by product manufacturers, social-media platforms or other third parties.

Those organisations are responsible for their own websites and privacy practices. You should review their privacy information before providing personal details to them.

A link from our website does not necessarily mean that MY TCG endorses the third party or accepts responsibility for its privacy practices.

16. Complaints

Please contact us first if you have a concern about how we use personal information:

Email: sales@mytcg.co.uk

We will review your concern and aim to resolve it promptly.

You also have the right to raise a complaint with the Information Commissioner’s Office, the UK supervisory authority for data protection.

Information about making a complaint is available through the Information Commissioner’s Office website.

17. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to our business, website, service providers or legal obligations.

The updated version will be published on this page and the “Last updated” date will be amended.

Where a change materially affects how we use personal information, we will provide additional notice where required.

18. Contact information

For questions about this Privacy Policy or to exercise your data-protection rights, contact:

MY TCG LIMITED
Trading as MY TCG
Company number: 15006366
VAT registration number: 448 5283 65
Email: sales@mytcg.co.uk
Location: Bedfordshire, United Kingdom