Privacy policy

1. Who is responsible

Chase Cards Collectables Ltd, trading as Chase Cards UK, operates this store and is the data controller responsible for deciding how customer information is used for our retail business. In this policy, “we”, “us” and “our” refer to Chase Cards Collectables Ltd.

Our store is hosted by Shopify. Shopify processes information for us and also acts as a separate controller for certain services, as explained below.

2. Information we collect

• Contact and delivery details: your name, email, billing and delivery addresses, and telephone number where provided.
• Orders and payments: items ordered, amounts paid, payment status, transaction references, delivery records, returns and refunds. Payment providers process the payment credentials needed for your chosen method. The information available to us depends on that provider; please do not email full card details.
• Account and rewards information: account identifiers, preferences, purchase history, points and rewards activity when you use those features.
• Messages and reviews: enquiries, complaints, correspondence and photographs you send us, together with reviews you submit or that are displayed through our review tools.
• Device and website activity: IP address, browser and device details, pages viewed, cart activity and cookie or similar identifiers, depending on the features used and your privacy choices.
• Privacy preferences: marketing subscriptions, consent choices, opt-outs and records of privacy requests.

We receive information directly from you, through your use of the website, and from providers such as Shopify, payment services and delivery companies. Review content may also come from eBay through our review widget.

Some information is needed to fulfil an order or meet legal obligations. If you do not provide the necessary delivery or payment information, we may be unable to complete your purchase. Optional marketing consent is not required to buy from us.

3. How and why we use information

UK data protection law requires a lawful basis for each purpose. The purposes and bases below apply according to how you interact with the store.

Processing purchases and helping you

We use contact, order and payment information to take steps you request before buying, fulfil your purchase, arrange delivery and deal with returns. Our basis is performance of our contract with you. Where handling a matter is required by law, we also rely on that legal obligation.

Accounts and rewards

When you choose to use an account or join our rewards programme, we use the information necessary to provide those requested features under the relevant agreement with you.

Keeping the store secure

We use relevant account, transaction and device information to investigate suspicious activity, prevent fraud and protect the store. We rely on our legitimate interests in operating a secure business, balanced against your rights and reasonable expectations.

Records and legal responsibilities

We keep information needed for accounting, tax and other legal obligations. Where necessary to establish, exercise or defend legal claims, we rely on our legitimate interests in resolving disputes or an applicable legal obligation.

Marketing, reviews and improvements

Where consent is required, we rely on consent for marketing and optional tracking. A permitted existing-customer email marketing exception may apply only if its legal conditions are met, including an opt-out when details are collected and in every message. Where we use that exception, our data-protection basis is our legitimate interest in promoting similar products to customers.

For publishing submitted reviews and improving customer support, our legitimate interests are sharing genuine shopping experiences and improving our service. This does not replace consent where tracking technology or another activity requires it.

4. Who we share information with

We share relevant information with providers that help us operate the store, including:

• Shopify: hosting, checkout, order and account management, security and other enabled store features.
• Payment providers: processing payments, refunds and payment disputes for the method you select.
• Delivery providers: including Royal Mail and DHL, to deliver and investigate your parcel.
• Review tools: including Jotform for the embedded eBay feedback display. Embedded content can also involve device and connection information being sent to the provider.
• Rewards: YOYO is installed to support loyalty and rewards features. When you use enabled rewards features, relevant account, purchase and points information may be processed to operate them.
• Forms and communications: Shopify Forms and Messaging support the collection of details you submit and customer communications where those features are used.
• Search, discounts and order tools: Shopify Search & Discovery, Smart Filter & Search, Yuko Order Limits, UpsellFly:Order Limit Quantity, Discount Mixer and Shopify Flow support enabled search, promotion, purchase-limit and workflow features. Relevant search, cart, customer or order information may be processed depending on the feature and permissions.
• Storefront display providers: installed tools include GSC Countdown Timer, GG Product Gallery, Image Zoom, Image & Video Slider, Magic Zoom Plus and Section Store. Where their content or services load from an external provider, device and connection information may be sent to that provider. Installation alone does not mean an app receives every category of customer information.
• Professional advisers and authorities: where needed for accounting, legal advice, a legal obligation or a lawful request.

If the business is sold or reorganised, relevant records may be shared with advisers and a prospective or new owner where lawful and subject to appropriate safeguards. We will explain material changes to how information is used.

Providers may process information on our instructions or have their own legal responsibilities as independent controllers. We remain responsible for our own processing and for selecting appropriate arrangements with providers.

5. Shopify and enhanced services

Shopify processes information about visits and purchases to run the store. For certain services, it processes information for its own purposes under its Consumer Privacy Policy.

We have enabled Shopify Network Intelligence. Through these enhanced services, Shopify uses information about interactions with our store alongside interactions with other merchants and Shopify to provide and improve services such as analytics, personalisation and advertising. Information may be shared with Shopify and relevant third parties outside the UK.

For UK visitors, advertising based on this activity requires your consent, which you can withdraw. You can learn about Shopify's processing and exercise applicable rights, including withdrawing consent or objecting, through the Shopify Privacy Portal. You can also contact us about information we control.

6. Cookies, embedded content and marketing

Cookies and similar technologies can support checkout, security, preferences, measurement and advertising. Strictly necessary technologies can operate without consent. Advertising technologies require consent; other optional uses require consent unless a specific legal exception applies and its conditions are met.

Use the privacy choices presented by the website to accept or reject optional uses. If you need help finding or changing those choices, email us at support@chasecards.uk. You can also manage Shopify's own processing through its Privacy Portal linked above. Browser controls can block or delete cookies, although blocking necessary cookies may stop parts of checkout working. Unsubscribing from emails does not automatically change your cookie choices, or vice versa.

Embedded review or social content can connect your device to its provider. Following an external link to eBay or a social platform brings you under that provider's own privacy arrangements for activity there.

You can unsubscribe from marketing using the link in a message or by contacting us. We may retain a minimal suppression record to respect your choice. Necessary order, delivery and service messages can still be sent after you unsubscribe.

7. How long information is kept

We retain personal information only for as long as needed for the purpose for which it was collected, taking account of legal requirements and outstanding disputes.

• Orders and accounting records: for the applicable tax and accounting record-keeping period and longer where a specific legal hold is needed.
• Accounts and rewards: while needed to provide the account or programme, followed by any necessary period for outstanding transactions, complaints or legal obligations.
• Customer messages: until the issue is resolved and for a proportionate period needed to handle related complaints or claims.
• Marketing records: while the subscription or other lawful marketing basis continues, with limited opt-out and consent records kept where necessary.
• Device, cookie and analytics records: according to the purpose and the configured expiry and retention settings of the relevant service.

When deciding retention periods, we consider the type of record, the service it supports, legal record-keeping duties, applicable claim periods and whether an issue remains unresolved. You can ask us about the retention period applicable to your information. Deleting an account does not automatically delete records we must retain for legal reasons.

8. Security and overseas processing

We use appropriate technical and organisational safeguards to protect personal information, including limiting access to those who need it. No system is completely risk-free. Please keep account access details private and do not send unnecessary sensitive information in support messages.

Shopify and other providers may process information outside the UK. For restricted transfers, we rely on applicable UK adequacy regulations or appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses, as appropriate to the transfer. These arrangements must be supported by any assessment and additional measures required by law.

Contact us for information about the destination and safeguards applicable to a transfer of your information, and how to obtain a copy of relevant safeguards. Confidential information may be redacted where necessary. Shopify explains its processing arrangements in its Data Processing Addendum and Consumer Privacy Policy.

9. Your privacy rights

Depending on the circumstances, you can ask us to:

• Provide access to your personal information and explain how it is used.
• Correct inaccurate or incomplete information.
• Delete information where there is no lawful reason to keep it.
• Restrict particular uses of your information.
• Provide eligible information in a portable format.
• Stop processing based on legitimate interests, subject to applicable exceptions.

You have the right to object to direct marketing, including related profiling. Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing that was lawful before you withdrew it.

Email support@chasecards.uk to make a request. We may ask for proportionate information to verify your identity. We normally respond within one month; where the law permits additional time or an exception, we will explain it. Requests are normally free.

Enabled features may use automated processing to assess fraud risks, apply purchase limits, calculate rewards or personalise content. If you believe an automated check has incorrectly affected your order or account, contact us to ask for a review. Where a decision made solely by automated processing has a legal or similarly significant effect, you have applicable rights to information, to make representations, to contest the decision and to seek human intervention.

10. Children and young people

Trading cards can appeal to young people. We do not treat a visitor as an adult simply because they use this site. If you are a parent or guardian concerned about information a child has provided, contact us so we can assess the request and take appropriate action.

Young people should ask a parent or guardian for help if they do not understand a privacy choice or are unsure what information to provide. Please avoid sharing unnecessary information about children in messages or public reviews. Any processing involving children must take account of their age, understanding and applicable legal protections.

11. Complaints and policy changes

Please contact us if you are concerned about how we handle personal information. You can also complain to the UK Information Commissioner's Office through ico.org.uk/make-a-complaint. You do not need our permission to contact the ICO. Other local supervisory authority rights may apply where you live.

We will update this policy when our practices or legal requirements change and show the update date. Where required, we will notify you of material changes or obtain fresh consent before a new use of your information.