POLICIES · LAST UPDATED 1 AUGUST 2026
Privacy and data
This notice explains what personal data TCG Bros handles through the shop, market tools, Premium Intel and advertising, why we use it, and the choices and rights available to you.
Who controls your data
TCG Bros is the data controller for personal data handled directly by this site. You can contact us at hello@tcgbros.co.uk. Stripe and Google may act as separate controllers for data they collect through their services; their own notices also apply.
Data we handle
- Shop and payment data: the product you choose and a checkout reference. Stripe collects payment, billing and contact details on its hosted checkout; full card numbers are not sent to our application.
- Premium subscription data: email address, Stripe customer and subscription identifiers, subscription status and current period end. A signed access cookie contains your email, expiry and subscription identifier.
- Messages: your email address and anything you include when contacting us, including wholesale application details.
- Technical records: our hosting and security providers may process IP address, user agent, request time, requested URL and diagnostic information in access and error logs.
- Local browser data: display preferences, up to eight recent search terms, and your advertising-consent decision. These stay in your browser unless you clear them.
- Advertising data:when the certified Google Privacy & messaging CMP is active, Google AdSense and its partners may process cookies, online identifiers, device and interaction data according to the choices collected in Google’s European regulations message.
Why we use it
| Purpose | UK GDPR lawful basis |
|---|---|
| Checkout, orders and Premium access | Contract or steps you ask us to take before a contract |
| Accounting, tax, disputes and legal requests | Legal obligation and legitimate interests |
| Security, reliability and abuse prevention | Legitimate interests in operating a safe service |
| Responding to enquiries | Contract steps or legitimate interests, depending on the enquiry |
| Non-essential advertising storage and personalisation | Consent, which you may withdraw at any time |
Who receives data
We use service providers only where needed to run the site: our hosting and database providers, Stripe for checkout and subscriptions, and our email provider for messages. Google AdSense is enabled only with the certified Google CMP deployment mode. Clicking an affiliate or marketplace link takes you to TCGplayer or Cardmarket, which then handles data under its own policy. We may disclose data where required by law or to establish, exercise or defend legal claims. We do not sell your directly supplied personal data.
Some providers may process data outside the UK. Where UK data-protection law requires it, the provider or transfer must rely on an adequacy regulation or appropriate safeguards such as approved contractual clauses. Review the destination provider’s notice before using its service.
How long we keep it
- Browser preferences and recent searches remain until you clear site data.
- Your consent choice remains until you change it or clear site data.
- The Premium access cookie expires after 35 days.
- Subscription, transaction and related correspondence records are kept while needed to provide the service and then only as needed for tax, accounting, disputes or other legal obligations—normally no longer than six years after the relationship or transaction ends.
- Operational logs are retained according to the hosting provider’s configured security and diagnostic retention period.
Your choices and rights
Depending on the circumstances, you can ask for access to your personal data, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You can withdraw consent without affecting processing that was lawful before withdrawal. We do not use your data for solely automated decisions that produce legal or similarly significant effects.
Email hello@tcgbros.co.uk to make a request. We may need to verify your identity. You also have the right to complain to the UK Information Commissioner’s Office through the ICO complaint service.
Cookies and updates
Our cookie policy lists the browser storage used by the app and explains how to change advertising consent. We may update this notice when the service or providers change; the date at the top shows the latest revision.